Unlimited access

Q: Does HIPAA give patients unlimited rights to obtain their medical records?

A: No. Patients don't have access to (a) psychotherapy notes; (b) information compiled for use in (or in reasonable anticipation of) a civil, criminal, or administrative proceeding; or (c) information restricted by the Clinical Laboratory Improvement Act, which permits labs to disclose test results to providers and not directly to patients.

You may also refuse a patient access to medical records if, among other reasons, you work for a correctional institution and release may jeopardize another person's safety; your patient participates in a research protocol and has waived her right of access until completion of the research; or the records are subject to the federal Privacy Act of 1974. In such cases, you must tell the patient why you denied the request.

If you deny access for other reasons (for example, access may place the patient in physical danger), the patient has the right to request an internal review. In such cases, the reviewing official must be a healthcare professional who didn't take part in the initial decision to deny access. A solo physician might designate her nurse, for instance; a physician group could assign one physician to review all such cases, assuming care is taken not to involve him in initial decisions. In either case, the decision of the reviewer must be followed.