BP in Practice

Privacy & Confidentiality Volume 17, No. 11—November 2020

Recognizing the Right of Access

A COMMITMENT TO PATIENTS
Under HIPAA, patients have a right to access
their medical records. HM takes this very
seriously, and so does the Office for Civil Rights
(OCR). In fact, OCR has made it a focus since
2019, and just recently announced it fined 9
different health care providers for failing to
provide timely access to records. In this edition
of the BPiP, we’re focusing on HM’s obligations
when it comes to the right of access.

A BASIC PATIENT RIGHT

The Houston Methodist Notice of Privacy Practices informs our patients about the right of access, and
System Policy IM08 outlines the steps we are obligated to follow. While we prefer that the request for
medical records be in writing (utilizing this form), HM is prohibited by law from creating any barriers, so
assist the patient if necessary by documenting the request. A request can be as informal as a casual “ask,”
but HM must recognize it for what it is—a patient is exercising his or her rights.

HOUSTON METHODIST’S OBLIGATIONS

 If a patient asks for copies of his/her records, recognize the request as a Patient Right, and take
immediate action in accordance with Policy IM08.
 The timeframe for fulfilling the request is very short, and there are specific requirements related to
verification, standard responses, limited fees and charges, and documentation.
 If you are authorized and have been trained to release records, some releases are permitted from the
clinic or department in limited circumstances. Otherwise, the patient should be directed to the HIM
Release of Information Department, as explained to the patient in our Notice of Privacy Practices.
 Provide assistance to the patient in submitting their record request. Houston Methodist supports
patients in exercising their privacy rights.

RECORDS OUTSIDE OF EPIC

If you have any records you store OUTSIDE of EPIC (for example, in a specialized secure system), please
contact Sharene Arocha at 713-441-2160 or sarocha@houstonmethodist.org immediately for an
assessment of your specific situation and to document the location accordingly for future release requests.

If you would like an in-service for your department or further information on this topic,
please contact privacy@houstonmethodist.org.
Now That’s Living the Houston Methodist Values Through Business Practices!
BP EthicsLine: 800.500.0333 | tmhs.myethicsline.com
Prepared by the Houston Methodist Business Practices Office. For more information, please contact Dan
Pantera, Houston Methodist Business Practices Officer, at dpantera@houstonmethodist.org or 713.383.5177.
Archives are available on the Business Practices homepage. Review Policies IM04, IM06, IM08, IM09, IM10,
IM21, IM22, BP06, BP17, and the Respecting Health Information Privacy handbook. BP in Practice (excluding
art) ©2020 Houston Methodist