45 CFR 164.526 — HIPAA Privacy Rule: Amendment of protected health information

What this rule requires your agency to do

• 1A covered entity may deny an amendment request only on the enumerated grounds (not created by entity, not part of designated record set, not accessible under § 164.524, or accurate and complete) (§ 164.526(a)(2)).(45 CFR 164.526 — HIPAA Privacy Rule: Amendment of protected health information)
• 2A covered entity must permit the individual to submit a written statement of disagreement, may prepare a rebuttal (with a copy to the individual), and must link the request, denial, statement, and rebuttal to the designated record set (§ 164.526(d)(2)-(4)).(45 CFR 164.526 — HIPAA Privacy Rule: Amendment of protected health information)
• 3A covered entity that is notified of an amendment by another covered entity must amend the PHI in its designated record sets, and must document the persons/offices responsible for processing amendment requests (§ 164.526(e), (f)).(45 CFR 164.526 — HIPAA Privacy Rule: Amendment of protected health information)
• 4A covered entity must include the required amendment/disagreement material (or an accurate summary) with subsequent disclosures of the affected PHI as specified (§ 164.526(d)(5)).(45 CFR 164.526 — HIPAA Privacy Rule: Amendment of protected health information)
• 5When denying an amendment, a covered entity must provide a timely, plain-language written denial containing the basis, the right to submit a statement of disagreement, and complaint procedures (§ 164.526(d)(1)).(45 CFR 164.526 — HIPAA Privacy Rule: Amendment of protected health information)
• 6A covered entity must act on an amendment request within 60 days, with a single permitted 30-day extension supported by written notice of the reasons and completion date (§ 164.526(b)(2)).(45 CFR 164.526 — HIPAA Privacy Rule: Amendment of protected health information)
• 7A covered entity must permit an individual to request amendment of PHI in a designated record set and may require written requests with a supporting reason only if it informs individuals of that requirement in advance (§ 164.526(a)(1), (b)(1)).(45 CFR 164.526 — HIPAA Privacy Rule: Amendment of protected health information)
• 8When accepting an amendment, a covered entity must make the amendment, timely inform the individual, obtain the individual's identification of and agreement to notify relevant persons, and make reasonable efforts to inform affected persons and business associates (§ 164.526(c)).(45 CFR 164.526 — HIPAA Privacy Rule: Amendment of protected health information)