1. Purpose

1.1. East Carolina University's Health Care Components ("ECU's Health Care Components") have a legal duty to permit an individual to request amendments to his/her protected health information ("PHI"). The purpose of this regulation is to describe the manner in which requests for amendments will be processed.

2. Definitions

2.1. Access means the individual's right to inspect and obtain a copy of their PHI.

2.2. Designated Record Set means a group of Records maintained by or for an ECU Health Care Component that is:

2.2.1. The medical and billing Records about an individual;

2.2.2. The enrollment, payment, claims adjudication and case or medical management record systems; or

2.2.3. Used, in part or in whole, by an ECU Health Care Component to make decisions about the individual.

3. Regulation

3.1. ECU Health Care Components must comply with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") regarding the obligation to amend PHI about an individual contained in a Designated Record Set for as long as the PHI is maintained in the Designated Record Set.

3.2. An individual's request for amendment may be denied if it is determined that the PHI that is the subject of the request:

3.2.1. Was not created by an ECU Health Care Component, unless the individual provides a reasonable basis to believe that the originator of PHI is no longer available to act on the requested amendment;

3.2.2. Is not part of the Designated Record Set;

3.2.3. Is not available for Access by the individual; or

3.2.4. Is accurate and complete.

4. Procedure

4.1. Request for Amendment to PHI and Timely Action

4.1.1. Written Request. ECU Health Care Components must permit an individual to request that the Component amend the PHI maintained in the designated record set.

4.1.1.1. ECU Health Care Components must require individuals to request amendments to his/her PHI in writing by submitting the Request for Amendment of Protected Health Information form to the ECU HIPAA Privacy Office.

4.1.2. Timely Acton. ECU Health Care Components, in coordination with the ECU HIPAA Privacy Office, must act on an individual's request for an amendment no later than 60 calendar days after receipt of such a request.

4.1.2.1. If an ECU Health Care Component is unable to take action within 60 calendar days, such Component may extend the time for such action by not more than 30 calendar days provided that:

4.1.2.1.1. The individual is provided with a written statement, within 60 calendar days of receipt of the request, of the reasons for the delay and the date by which the ECU Health Care Component will complete its action on the request; and

4.1.2.1.2. The ECU Health Care Component may have only one such extension of time for action on a request for an amendment.

4.2. Accepting the Amendment. If an ECU Health Care Component accepts the requested amendment, in whole or in part, such Component must comply with the following requirements:

4.2.1. Making the Amendment. Make the appropriate amendment to the PHI or record that is subject to the request for amendment by, at a minimum, identifying the records in the Designated Record Set that are affected by the amendment and appending or otherwise providing a link to the location of the amendment.

4.2.1.1. When appending, efforts should be made to identify that this is being done at the request of the individual and acceptance by the respective Component.

4.2.1.2. When the amendment cannot be accommodated by appending to the original PHI in the Record, the entry made should specifically indicate which PHI the accepted amendment is applicable to.

4.2.2. Informing the Individual. In accordance with paragraph 4.1.2, the ECU HIPAA Privacy Office shall inform the individual that the amendment is accepted by completing the individual's Request for Amendment of Protected Health Information form and sending a copy to the individual by mail. The original shall be maintained in Component's Designated Record Set for the individual.

4.2.2.1. Obtain the individual's identification of and agreement to notify the relevant persons with which the amendment needs to be shared in accordance with paragraph 4.2.3.

4.2.3. Informing Others. The ECU HIPAA Privacy Office shall make reasonable efforts to inform and provide the amendment within a reasonable time to:

4.2.3.1. Persons identified by the individual as having received PHI about the individual and needing the amendment; and

4.2.3.2. Persons, including business associates, that the Health Care Component knows have the PHI that is the subject of the amendment and that may have relied, or could foreseeably rely, on such information to the detriment of the individual.

4.3. Denying the Amendment. If an ECU Health Care Component denies the requested amendment, in whole or in part, such Component must comply with the following requirements:

4.3.1. Denial. The ECU HIPAA Privacy Office shall provide the individual with a timely, written denial in accordance with paragraph 4.1.2. by completing and sending the individual a copy of the Request for Amendment of Protected Health Information form by mail. The original shall be maintained in ECU Health Care Component's Designated Record Set for the individual.

4.3.1.1. The denial must use plain language and contain:

4.3.1.1.1. The basis for the denial, in accordance with paragraph 3.2;

4.3.1.1.2. The individual's right to submit a written statement disagreeing with the denial and instruction as to how the individual may file such a statement;

4.3.1.1.3. A statement that, if the individual does not submit a statement of disagreement, the individual may request that the ECU Health Care Component provide the individual's request for amendment and the denial with any future disclosures of the PHI that is the subject of the amendment; and

4.3.1.1.4. A description of how the individual may complain to the ECU Health Care Component or to the Secretary of the Department of Health and Human Services. The description must include the name, or title, and telephone number of the contact person or office.

4.3.2. Statement of Disagreement. ECU Health Care Components must permit the individual to submit to the Component a written statement disagreeing with the denial of all or part of a requested amendment and the basis of such disagreement. ECU Health Care Components may reasonably limit the length of a statement of disagreement.

4.3.2.1. ECU Health Care Components must designate an official to review and respond to statements of disagreements.

4.3.3. Rebuttal Statement. If a statement of disagreement is submitted, the ECU Health Care Component may, through their designated official per paragraph 4.3.2.1, provide a rebuttal statement to the individual's statement of disagreement. If a rebuttal statement is prepared, a copy must be sent to the individual who submitted the statement of disagreement.

4.3.4. Recordkeeping. The ECU Health Care Component must, as appropriate, identify the record or PHI in the Designated Record Set that is the subject of the disputed amendment and append or otherwise link the individual's request for an amendment, the Component's denial of the request, the individual's statement of disagreement, if any, and the Component's rebuttal, if any, to the Designated Record Set.

4.3.5. Future Disclosures.

4.3.5.1. If a statement of disagreement has been submitted by the individual, the ECU Health Care Component must include the material appended in accordance with paragraph 4.3.4., or, at the election of the Component, an accurate summary of any such information, with any subsequent disclosure of the PHI to which the disagreement relates.

4.3.5.2. If the individual has not submitted a written statement of disagreement, the ECU Health Care Component must include the individual's request for amendment and its denial, or an accurate summary of such information, with any subsequent disclosures of the PHI only if the individual has requested such action in accordance with paragraph 4.3.1.1.3.

4.3.5.3. When a subsequent disclosure described in paragraph 4.3.5.1 or 4.3.5.2 is made using a standard transaction that does permit additional material to be included with the disclosure, the covered entity may separately transmit the material required by paragraph 4.3.5.1 or 4.3.5.2, as applicable, to the recipient of the standard transaction.

4.4. Actions on Notices of Amendment. An ECU Health Care Component that is informed by any Covered Entity of an amendment to an individual's PHI, must amend the PHI received from the other Covered Entity in the Component's Designated Record Set.

4.5. Distinction of ECU Health Care Components. ECU Health Care Components must ensure that the individual requesting an amendment is notified that any such request is only applicable to the particular ECU Health Care Component to which the request is submitted. If the individual would like his/her PHI held or maintained by another ECU Health Care Component to be amended, a separate request must be submitted for that ECU Health Care Component.