HIPAA Health Record Access Request

Summary

Use this HIPAA Health Record Access Request for an employer-sponsored group health plan to allow plan participants to request access, inspection, and copying of their protected health information (PHI) maintained in designated formats. This template includes practical guidance, an optional clause, and drafting notes. With limited exceptions, the Health Insurance Portability and Accountability Act of 1996, as amended (HIPAA) provides individuals with a legal, enforceable right to access the information in their medical and other health records maintained by their health care providers and health plans. This includes the right to inspect or obtain a copy, or both, of their PHI, and to direct the covered entity (whether a group health plan or health provider) to transmit a copy to the individual, or to a designated person or entity of the individual’s choice. 45 C.F.R. § 164.524. Individuals have a right to access their PHI for as long as the information is maintained by a covered entity, or by a business associate on behalf of a covered entity, regardless of the date the information was created, whether the information is maintained in paper or electronic systems onsite, remotely, or is archived, or where the PHI originated. See Dep’t of Health and Human Services’ (HHS) website for more information. Increasingly, health care providers maintain a web portal through which patients can gain immediate access to their PHI. See HHS: Your Rights under HIPAA. In a fully-insured group health plan the obligation to provide access to a participant’s PHI will rest with the insurer, and not the employer, as fully-insured group health plans are exempt from most of the administrative responsibilities under the HIPAA’s privacy rule. See 45 C.F.R. §164.530(k) and Dep’t of Health and Human Services: Employer Offering Full-Insured Health Plan. For extensive coverage of important topics in the healthcare industry, see Healthcare Fundamentals Resource Kit. For more information on compliance with HIPAA privacy and security rules, see HIPAA Privacy, Security, Breach Notification, and Other Administrative Simplification Rules. For other HIPAA-related content, see HIPAA Resource Kit. For more on health information privacy and security, see Health Information Privacy and Security Resource Kit.