Section 164.526 Modification of Protected Health Information.
(A) Default: right to change.
(1) right to change.An individual has the right to have protected health information or records about the individual in a specified record amended by an affected entity for as long as the protected health information is maintained in the specified record.
(2) rejection of the change.A covered entity may deny an individual's change request if it determines that the protected health information or records subject to the request:
(EU)not prepared by the organization in question, unless the individual provides a reasonable basis to believe that the originator of the protected health information is no longer available to respond to the requested change;
(you)not part of the designated dataset;
(iii)Not available for inspection in§ 164.524; o
(4)It is correct and complete.
(B) Implementation Requirements: Change Requests and Timely Action-
(1) Individual change orders.The covered entity must allow a person to request the covered entity to change protected health information stored in the designated registry. The affected company may require individuals to submit change requests in writing and provide a reason to support a requested change, provided it notifies individuals in advance of such requests.
(2) Timely action by the interested company.
(EU)The affected entity must comply with the individual's change request no later than 60 days after receiving the request, as follows.
(A)If the interested company fully or partially agrees with the requested change, it must take the appropriate measuresparagraph (c)(1)Y(2)this section.
(B)If the interested company totally or partially rejects the requested change, it must provide the person with a written rejection.Paragraph (d)(1)this section.
(you)If the affected company cannot respond to the change within the required timeframeParagraph (b)(2)(i)of this Section, the affected entity may extend the term of such action for a maximum of 30 days, provided that:
(A)The interested company, within the period established by theParagraph (b)(2)(i)of this section provides the individual with a written statement explaining the reasons for the delay and the date by which the affected entity will complete its action on the request; AND
(B)The company in question can only have this amount of time to respond to a change request.
(C) Implementation requirements: acceptance of change.If the affected company accepts the requested change in whole or in part, the affected company must comply with the following requirements.
(1) To make changes.The affected entity must make appropriate changes to the protected health information or records that are the subject of the change request, at a minimum, identify the records in the designated dataset that are affected by the change and attach or provide a link to the change location .
(2) informing the personAccording toparagraph (b)Pursuant to this section, the affected company must inform the person in a timely manner that the change will be accepted and obtain their identification and consent for the affected company to notify the relevant persons to whom it must notify the change in accordance withParagraph (c)(3)this section.
(3) Inform the others.The affected company must use reasonable efforts to inform and facilitate the change within a reasonable time, in order to:
(EU)Individuals identified by the individual who have received protected health information about the individual and need the change; AND
(you)Individuals, including business associates, known to the affected entity to have the protected health information that is the subject of the amendment and who may have relied or are likely to rely on that information to the individual's detriment.
(D) Execution requirements: rejection of the change.In case the affected company totally or partially rejects the requested change, the affected company must comply with the following requirements.
(1) Rejection.The company in question must provide the person with a written refusal well in advance.Paragraph (b)(2)this section. The refusal must be in plain language and contain the following:
(EU)The basis for rejection is accParagraph (a)(2)this section;
(you)The person's right to make a written statement contesting the refusal and how the person can make such a statement;
(iii)A statement that if the individual does not submit a deletion notice, the individual may request that the data subject submit the request to change the individual and opt out of future disclosures of the protected health information that is the subject of the modification; AND
(4)A description of how the individual can file a complaint with the relevant entity in accordance with the complaint procedures set out in§ 164.530 (d)or the Secretary in accordance with the procedures set out in the§ 160.306. The description must include the name or title and telephone number of the contact person or notified body.§164.530(a)(1)(ii).
(2) opposition statement.The subject entity must allow the individual to provide the subject entity with a written statement that it disagrees with the rejection of all or part of a requested change and establishes the basis for such disagreement. The company in question may appropriately limit the duration of a statement of objection.
(3) rebuttal statement.The company in question can prepare a written response to the person's statement of objection. Whenever such a response is drawn up, the company concerned must send a copy to the person who filed the response.
(4) records.The affected entity will identify, as appropriate, the records or protected health information in the designated dataset that are the subject of the contested change and will attach or link the person's change request, the affected entity's denial of the request, and the change request from the person. request, if applicable, a declaration of rejection and, if applicable, the contestation of the company interested in the set of data provided for this purpose.
(5) Future disclosures.
(EU)If the natural person has filed a statement of opposition, the interested entity must attach the attached materialParagraph (d)(4)of this Section or, at the discretion of the affected entity, an accurate summary of such information, followed by the disclosure of the protected health information to which the disagreement relates.
(you)If the individual has not filed a written statement of objection, the affected entity must include the individual's amendment request and denial or an accurate summary of that information with any subsequent disclosure of protected health information, only if the individual has requested an action According to artParagraph (d)(1)(iii)this section.
(iii)If a subsequent disclosure described inParagraph (d)(5)(i)o(ii)of this Section is made using a standard transaction pursuant to Section 162 of this subchapter that does not allow additional material to be included in the disclosure, the affected entity may submit the required material separatelyParagraph (d)(5)(i)o(ii)of this Section, if applicable, to the recipient of the Standard Transaction.
(mi) Regulation of application: Measures for notification of changes.A Covered Entity being notified by another Covered Entity of a change to an individual's Protected Health Information pursuant toParagraph (c)(3)of this section, you must correct protected health information in designated records as directed byParagraph (c)(1)this section.
(F) Implementation Specification: Documentation.A covered organization must document the titles of individuals or entities responsible for receiving and processing requests for change from individuals and retain documentation as necessary.§164.530(j).