NRPM: Standards for Privacy of Individually Identifiable Health Information. iii. Acceptance of a request for amendment or correction.

11/03/1999

If a covered plan or provider accepts an individual’s request for amendment or correction, it would be required to make the appropriate amendments or corrections. In making the change, the entity would have to either add the amended or corrected information as a permanent part of the record or mark the challenged entries as amended or corrected entries and, if appropriate, indicate the place in the record where the amended or corrected information is located. Covered plans or providers would not be required to expunge any protected health information, but rather mark it as erroneous or incomplete.

We also propose in § 164.506(e) that entities include a contract requirement that when the covered plan or provider notifies the business partner of an amendment or correction, the business partner must make the necessary amendments or corrections to protected health information in its custody.

In § 164.516(c)(3), we are proposing that, upon accepting an amendment or correction, the covered plan or provider would be required to make reasonable efforts to notify relevant persons, organizations, or other entities of the change or addition. An entity would be required to notify such persons that the individual identifies, or that the covered plan or provider identifies as 1) a recipient of the erroneous or incomplete information, and 2) a person who:

  • has relied upon that information to the detriment of the individual; or
  • is a person who may foreseeably rely on such erroneous or incomplete information to the detriment of the individual.

We are concerned about the potential burden that this notification requirement would impose on covered plans and providers. We do not, however, anticipate that a significant number of requests would be submitted to any entity and therefore the need for such notifications would be rare. In addition, we determined that because health information can travel so quickly and efficiently in the modern health care system, the need for notification outweighed the potential burden. It is important to note that a reasonableness standard should be applied to the notification process -- if the recipient has not relied upon the erroneous or incomplete information to the detriment of the individual or if it is not foreseeable that the recipient will do so, then it would not be reasonable for the covered plan or provider to incur the time and expense of notification. If, however, if the incorrect information is reasonably likely to be used to the detriment of the individual, the entity should make every effort to notify the recipients of the information of the changes as quickly as possible.