Privacy and the Medical Record

This is Unit Twenty-Eight of Medical Assistant Prep. Unit Twenty-Seven made consent the patient's to give or withdraw. This unit applies the same respect to the patient's information: what the privacy rule protects, the patient's rights over it, breaches, and keeping the record honest. Carry one idea through this lecture. Release only what the rule permits, to someone verified, and keep every correction visible, because a record's value depends on its honesty. Two constructed cases at the end show a request refused courteously and an error corrected openly. By the end you will be able to define protected health information and its permitted uses. To honor patients' rights over their records. To check before releasing and report a breach at once. And to correct, add to, keep and dispose of records properly.

Four entries on the privacy rule: what is protected, permitted uses, minimum necessary, and incidental disclosures.

Spoken, written, electronic.

MAS 676 Protected Health Information

Protected health information is individually identifiable health information that a practice holds, in any form: spoken, written or electronic. A name with a diagnosis, a date of birth on a lab result, or an appointment reason on a schedule can all be protected health information. The protection applies to conversations as well as to records.

Treatment, payment, operations.

MAS 677 Treatment, Payment and Operations

The privacy rule allows a practice to use and disclose health information for treatment, payment and health care operations. Sharing a record with a specialist treating the patient, sending a claim to the insurer, and reviewing records for quality are all permitted uses. A permitted purpose does not allow unlimited information; the minimum-necessary rule still applies.

Only what the purpose needs.

MAS 678 Minimum Necessary

When using, disclosing or requesting health information, limit it to the minimum necessary for the purpose. A billing question needs billing details, not the patient's full history; staff see only what their job requires. Treatment disclosures between providers are an exception, but your own access still stays limited to your work.

Reasonable effort.

MAS 679 Incidental Disclosures and Safeguards

Practices must reasonably safeguard health information to limit incidental disclosures that happen alongside permitted ones. Lowering your voice, closing doors and positioning screens away from the waiting room are reasonable safeguards. The rule expects reasonable effort, not perfection, but carelessness with patient information is never acceptable.

Six entries on patients' rights: the notice, access, amendment, accounting, family and friends, and representatives.

How information is used.

MAS 680 The Notice of Privacy Practices

Patients have a right to a notice explaining how the practice may use and disclose their health information and what their rights are. Practices give the notice to patients and make it available, often at the first visit, and may ask patients to acknowledge receiving it. Know where your practice's notice is, so you can give it on request.

Within thirty days.

MAS 681 The Right to Access Records

Patients have a right to see and obtain copies of their health information. The practice must act on a request for access no later than thirty days after receiving it, with limited exceptions. Route access requests to the person the practice designates; do not delay or discourage them.

Requested, reviewed.

MAS 682 The Right to Request an Amendment

Patients have a right to ask the practice to amend health information they believe is wrong or incomplete. The practice reviews the request and responds; it may accept or deny it, following the rule's procedures. Never change a record yourself because a patient asked; send the request through the practice's process.

Six years of disclosures.

MAS 683 The Right to an Accounting of Disclosures

Patients can request a list of certain disclosures of their health information made in the past six years. The accounting covers disclosures outside routine treatment, payment and operations, which is one reason disclosures are documented. Record releases of information carefully, so an accounting can be produced if asked.

Agree or object first.

MAS 684 Sharing With Family and Friends

The privacy rule allows sharing information directly relevant to a family member's or friend's involvement in the patient's care, in limited ways. Generally the patient must have the chance to agree or object first; when the patient is present and agrees, sharing relevant details is allowed. When you are unsure, ask the patient privately, or ask the privacy officer.

Parents and guardians.

MAS 685 Personal Representatives and Minors

A personal representative, such as a parent of a minor or a legal guardian, can usually exercise the patient's privacy rights. The rule includes exceptions, for example where state law lets a minor consent to certain care on their own. Rules about minors vary by state; follow the practice's policy and ask before releasing.

Eight entries on release and breach: the release check, authorizations, security, breaches, notification, and secured information.

Verify before releasing.

MAS 686 Before You Release Information

Every release follows a check, so the right information goes to the right person for a permitted reason. Verify who is asking and their authority. Confirm the purpose: treatment, payment or operations, or something needing written authorization. If authorization is required, confirm a valid signed form is on file. Release only the minimum necessary, except treatment between providers. Send it securely, and document the release. A caller claiming to be a relative, employer or attorney gets nothing for asking confidently. Verify first, and route doubtful requests to the privacy officer.

Written and current.

MAS 687 Written Authorizations

Uses and disclosures not otherwise permitted by the rule require the patient's written authorization. For example, releasing records to a patient's employer or for marketing generally requires a signed authorization. Check that the authorization covers the information requested and has not expired or been revoked.

Electronic protections.

MAS 688 Security for Electronic Information

The privacy rule covers health information in every form, and the security rule adds protections for electronic information. Unit twenty-five covered those safeguards: unique logins, automatic logoff, audit trails, encryption and backups. Privacy and security failures often happen together, as when a password is shared.

Not permitted, compromised.

MAS 689 What a Breach Is

A breach is acquiring, accessing, using or disclosing protected health information in a way the privacy rule does not permit, which compromises its security or privacy. Examples include a misdirected fax, a lost unencrypted laptop, or staff viewing records they have no reason to see. Report any suspected breach at once; the practice decides whether notification is required.

Sixty days from discovery.

MAS 690 Breach Notification Timing

When a breach of unsecured health information occurs, affected individuals must be notified without unreasonable delay. The notice must go out no later than sixty calendar days after the breach is discovered. The clock starts at discovery, which is why prompt internal reporting matters so much.

Media and HHS.

MAS 691 Large Breaches

Breaches involving five hundred or more people trigger additional notifications. For large breaches, the practice must also notify prominent media in the affected area and the Department of Health and Human Services. Large breaches often start small, such as one lost device or one misconfigured system.

Audits.

MAS 692 HITECH and the Breach Rules

The breach notification requirements were adopted under the HITECH Act, which strengthened HIPAA. HITECH also requires the Department of Health and Human Services to audit practices for compliance with the privacy and security rules. Assume that your practice's privacy practices can be audited at any time.

Encryption.

MAS 693 Secured Versus Unsecured Information

The breach notification rule applies to unsecured protected health information. Information properly encrypted is generally treated as secured, which is why encryption matters so much when a device is lost. Report a lost device whether or not you think it was encrypted; let the practice determine that.

Six entries close the unit: correcting errors, late entries, retention, disposal, and two constructed cases.

Never erase.

MAS 694 Correcting the Record

Errors in the record are corrected, never erased. Federal billing guidance expects the date and author of any correction to be identifiable, and the change plainly and permanently marked, so the original stays readable. Never delete, hide or alter a record entry to cover a mistake; that can be treated as falsification.

Labeled, not backdated.

MAS 695 Late Entries

When something was not documented at the time, it is added later as a plainly labeled late entry. Label it as a late entry, and record both the time you are writing it and the time the care actually happened. Never backdate an entry to make it look as if it was written on time.

Law and policy.

MAS 696 Keeping Records

Medical records are kept for the periods that law and the practice's policy require. Federal privacy rules require practices to keep their privacy policies and related documentation for six years; how long patient records themselves are kept depends largely on state law and practice policy. Follow the practice's retention schedule; never discard records on your own judgment.

Unrecoverable.

MAS 697 Disposing of Records Safely

When records reach the end of their retention period, they are disposed of so the information cannot be recovered. Paper is shredded or otherwise destroyed; electronic media are cleared, purged or destroyed, under the practice's disposal policy. Never put records with health information in an ordinary trash or recycling bin.

A husband asks for results.

MAS 698 A Request at the Front Desk

A constructed case applies the rule to a family request. A man says his wife had blood drawn yesterday and asked him to pick up her results. The assistant does not doubt he is her husband, but that alone does not entitle him to her records. No authorization is on file and the patient has not listed him. She explains politely that she cannot release them, offers two paths, his wife calling or signing an authorization naming him, and gives him the form. She says nothing about the results, not even whether they are normal. Later the patient calls, signs up for the portal, and asks for the form. Saying the results are fine would itself have been a disclosure, however kind it sounded.

A wrong pulse and a missed note.

MAS 699 Correcting a Charting Error

A constructed case pays off the opening idea. Reviewing her morning, the assistant finds a pulse entered as one hundred twenty instead of the seventy-two she measured, typed in the wrong field, and a wound check at ten o'clock she never documented. She does not delete the wrong number. The record's correction function keeps the original visible, records the right value, stamps her name, date and time, and she notes entered in error. The wound check goes in as a labeled late entry, written now and stating it happened at ten, not backdated. Because the wrong pulse could have prompted concern, she tells the provider. An erased or backdated entry, even for an innocent mistake, makes the whole record harder to trust.

Look at what you can now do. You can define protected health information and apply permitted uses, minimum necessary and reasonable safeguards. You can honor the patient's rights to notice, access, amendment and an accounting, and share with family only as allowed. You can verify identity, purpose and authorization before any release, and report a suspected breach at once. And you can correct errors visibly, label late entries, and keep and dispose of records by policy. Unit Twenty-Nine turns to regulatory compliance.