NRPM: Standards for Privacy of Individually Identifiable Health Information. i. Time limits.


In § 164.514(d)(2), we are proposing that the covered plans and providers would take action upon the request as soon as possible but not later than 30 days following receipt of the request. We considered the possibility of not including a time limitation but rather imposing a “reasonableness” requirement on the covered plans or providers. We concluded that the individual is entitled to know when to expect a response. This is particularly important in the context of health information, where an individual may need access to his or her information in order to make decisions about care. Therefore, in order to determine what would be “reasonable,” we examined the time limitations provided in the Privacy Act, the Freedom of Information Act (FOIA), and several State laws.

If the entity had fulfilled all of its duties under this proposed rule within the required time period, then the entity should not be penalized for any delay by the individual. For example, if, within the 30 days, a provider approves a request for inspection and copying, makes copies of the requested information, and notifies the individual that this information is available to be picked up and paid for at the provider’s office, then the provider’s duty would be discharged under the rule. The individual might not be able to pick up the information for another two weeks, but this extra time should not be counted against the provider.

The Privacy Act requires that upon receipt of a request for amendment (not access), the agency would send an acknowledgment to the individual within 10 working days. (5 U.S.C. 552a (d)(2)). We considered several options that included such an acknowledgment requirement. An acknowledgment would be valuable because it would assure the individual that their request was received. Despite the potential value of requiring an acknowledgment, we concluded that it could impose a significant administrative burden on some of the covered plans and providers. This proposed rule will cover a wide range of entities with varying capacities and therefore, we are reluctant to create requirements that would overwhelm smaller entities or interfere too much with procedures already in place. We would encourage plans and providers to have an acknowledgment procedure in place, but would not require it at this point. We are soliciting comment on whether this proposed rule should require such an acknowledgment.

We also considered whether to include specific procedures governing “urgent” or “emergency” requests. Such procedures would require covered plans and providers to respond in a shorter time frame. We recognize that circumstances may arise where an individual will request inspection and copying on an expedited basis and we encourage covered plans or providers to have procedures in place for handling such requests. We are not proposing additional regulatory time limitations to govern in those circumstances. The 30-day time limitation is intended to be an outside deadline, rather than an expectation. Rather, we would expect a plan or provider to always be attentive to the circumstances surrounding each request and respond in an appropriate time frame, not to exceed 30 days.

Finally, we considered including a section governing when and how an entity could have an extension for responding to a request for inspection and copying. For example, the FOIA provides that an agency may request additional time to respond to a request if the agency needs to search for and collect the requested records from facilities that are separate from the office processing the request; to search for, collect, and appropriately examine a voluminous amount of separate and distinct records; and to consult with another entity or component having a substantial interest in the determination of the request. We determined that the criteria established in the FOIA are tailored to government information systems and therefore may not be appropriate for plans and providers covered by this proposed rule. Furthermore, we determined that the 30-day time period would be sufficient for responding to requests for inspection and copying and that extensions should not be necessary. We are soliciting comments on whether a structured extension procedure should be included in this proposed rule.