Skip to content

Cognetti & Conaboy Family Practice

You are here: Home HIPAA Policies General HIPAA Policies PHI Access Amendment and Accounting Policy
PHI Access Amendment and Accounting Policy

POLICY: PHI Access Amendment and Accounting


PURPOSE: To provide a process for individuals to request access to, amendments to and an accounting of their protected health information.


POLICY: Individuals may request access to, amendments to and an accounting of their protected health information under the Privacy Rule.


APPLIES TO: Physicians, Employees and Business Associates


1.     Patients have the right to access and copy their PHI in our medical records. There are exceptions for psychotherapy notes and any information relating to an administrative, civil or criminal investigation.

2.     We can deny access for several reasons, including a physician's professional judgment (if disclosure is reasonably likely to endanger the life or physical safety of the patient or another person), if PHI was obtained from another person with a promise not to disclose that information, or the PITT was created for research purposes and the patient signed a release agreeing not to have access.

3.     We will grant or deny access within 30 days of receiving a request. We will take up to 60 days if the PHI is stored off site. We can and will take a 30 day extension to respond if needed.

4.     If access is granted, the patient may receive a copy of the records requested, but a reasonable charge can and will be imposed. We will follow the applicable Medical Records Copying Costs Act allowances for any copies of records given to the patient.

5.     If access is denied, we will allow the patient to appeal as required by law. The appeal will be processed under the Complaints policy.



1.      Patients may request an amendment of their PHI.

2.      We will require a written request containing the reasons for the requested amendment,

3.      We will deny any request for amendment" if we did not create the PHI or if we believe the PHI in the record is correct.

4.      We will respond to the written amendment request within 60 days from the date we receive it, and take one 30 day extension if needed. If we want an extension, we will tell the patient why we need it and when the response will be given,

5.      If we deny the request, we will notify the patient in writing and explain why we denied the request. We will give the patient information about filing a statement of disagreement within 30 days of our letter, and describe our complaint procedures.

6.      The Complaint policies and procedures will be followed.

7.      If we still want to deny the request after the patient files a statement of disagreement, we will give the patient a written rebuttal.

S. All documents relating to an amendment request will be kept in the patient's file.

9.      If we amend the PHI, we will follow Act 13 of 2002, which requires the amendment to state that the information was not available previously; to clearly date it as a subsequent record entry; and to make the change within a reasonable period of time. Information to correct an error or to clarify an entry must be identified as a subsequent entry and be dated and timed.

10.  Sometimes patients make requests to eliminate or alter protected health information after the patient receives an insurance coverage denial. We will not participate in or tolerate any such behavior. Any denial letter will expressly state that we believe the amendment request is fraudulent and that we refuse to participate in such conduct.

11.  Documents relating to an amendment process may have to be included in any future disclosures of the patient's records.



1.      Patients have a limited right to an accounting of our disclosures of the patient's PHI. Any request for an accounting must be in writing.

2.      The right to an accounting does not apply to any use or disclosure we make: for treatment, payment or health care operations; subject to an Authorization signed by the patient allowing us to make the disclosure; incidental to a permissible use or disclosure; to the patient; to a person involved in the patient's care; for national security or intelligence; that is part of a limited data set (which has removed unique patient identifiers); or to a Business Associate for TPO. This list includes the vast majority of uses and disclosures of PHT in our practice.

3.      The right to an accounting does apply to any use or disclosure for public purpose disclosures defined under the Privacy rule; any disclosure required by law (where we have no choice but to disclose information such as HIV information to the Health Department, or a court order); disclosures to a government entity; disclosures to law enforcement or to insurers for claims investigations; and disclosures concerning abuse, neglect or domestic violence victims.

4.      Wc will respond to the written accounting request within 60 days from the date we receive it, and take one 30 day extension if needed. If we want an extension, we will tell the patient why we need it and when the response will be given.

5.      We will make every reasonable effort to track disclosures of PHI subject to accounting requests.

6.      The accounting period is six years looking back from the date of the request, but the look-back period does not apply before the April 14, 2003 compliance date.

7.      A patient has the right to one free accounting in each calendar year. If more than one accounting is requested during a calendar year, we will charge the patient reasonable fees to make the accounting, and will notify the patient in advance of the existence of the charge and the charge itself, and give the patient the chance to withdraw the request,


VIOLATIONS: Violations of the business associates policy should be reported immediately to the Privacy Officer.