By Chris Dimick
HIPAA gave consumers the right to request that covered entities restrict certain disclosures of their protected health information, but it did not require covered entities to comply. ARRA does—in certain situations. ARRA also expands patients’ rights to an accounting of disclosures.
How well do you know the new provisions? Test your knowledge with the following scenarios. Select the one best answer; each correct answer is based directly on a given section of the law.
You also may download the scenarios as a PDF, which includes aggregated results of more than 900 AHIMA members who took the quiz previously.
Request for Restriction
The ABC Center receives a request for restrictions from Mr. Smith to withhold information. He has paid for his encounter in full at the time of service and requests that his records not be released to anyone for any reason.
Shortly thereafter Mr. Smith is involved in a car accident, and his wife indicates to the emergency department at Anywhere Medical that his primary medical provider is ABC Center. The ED at Anywhere Medical requests pertinent records to treat Mr. Smith. What information may ABC Center release by law?
- All records pertinent to care, except the restricted records
- No records, because there is a restriction on file
- All records, to ensure patient care
- All records pertinent to care, including the restricted records
4. Mr. Smith has paid for the encounter in full at the time of service, which does entitle him to a restriction under the ARRA modifications. However, the restriction applies only to disclosures to health plans. ABC Medical may release the records to Anywhere Medical if they are pertinent to Mr. Smith’s care.
Excerpt from § 13405(a): “…the covered entity must comply with the requested restriction if (1) except as otherwise required by law, the disclosure is to a health plan for purposes of carrying out payment or health care operations (and is not for purposes of carrying out treatment)…”
Request for Restriction
After his accident, Mr. Smith returns to the ABC Center for a test. He pays his copayment at the time of service and requests that no record of the test or its results be released. Under the ARRA modifications, ABC Medical Center:
- Must honor the request, because all patient requests for restrictions must now be fulfilled
- Must honor the request only if it is certain it can do so
- Is not required to honor the request, because Mr. Smith did not pay for the test in full
- Is not required to honor the request, because the request is unreasonable
3. ABC Medical is not required to honor the request, because Mr. Smith did not pay for the test in full. The right to restrictions applies only to items or services that the patient pays in full.
Excerpt from § 13405(a): “…the covered entity must comply with the requested restriction if… (2) the protected health information pertains solely to a health care item or service for which the health care provider involved has been paid out of pocket in full.”
Accounting of Disclosure
Mr. Smith writes ABC Center and requests an accounting of disclosures of his protected health information. ABC Center meets the criteria of the ARRA modifications and must comply with them. In fulfilling Mr. Smith’s request, ABC Center must account for:
- Only those disclosures for which Mr. Smith has not signed an authorization
- All disclosures for treatment, payment, and operations
- Only those disclosures for payment purposes that do not have an authorization
- Only disclosures for operations purposes that do not have an authorization
2. ABC Center must account for all disclosures, including those for treatment, payment, and operations. ARRA rescinds the TPO exception granted under HIPAA for covered entities that use or maintain an EHR system.
Excerpt from § 13405(c)(1): “In applying section 164.528 of title 45, Code of Federal Regulations, in the case that a covered entity uses or maintains an electronic health record with respect to protected health information—(A) the exception under paragraph (a)(1)(i) of such section shall not apply to disclosures through an electronic health record made by such entity of such information…”
Accounting of Disclosure
On January 1, 2011, Mr. Smith phones ABC Center to request an accounting of disclosures. ABC uses an EHR system that it purchased in mid-2008. Mr. Smith last requested an accounting five months earlier. Is ABC Center required to abide by the terms of the ARRA modifications?
- No, fewer than 6 months have elapsed since Mr. Smith’s last request
- No, ABC Center does not need to comply with the ARRA provisions until January 1, 2014
- Yes, ABC Center uses an EHR
- Yes, ABC Center is required to comply with the ARRA provisions as of January 1, 2011
2. Covered entities that purchased EHR systems prior to January 1, 2009, have until January 1, 2014, to comply with the ARRA accounting of disclosures provisions. Covered entities that purchased systems after January 1, 2009, must comply on January 1, 2011.
Excerpt from § 13405(c)(4): “(A) Current Users of Electronic Records—In the case of a covered entity insofar as it acquired an electronic health record as of January 1, 2009, paragraph (1) shall apply to disclosures…made by the covered entity from such a record on and after January 1, 2014.”
Scenario 4 Bonus Question
Mr. Smith has been a patient of ABC Center for 23 years. Under the ARRA modifications, how many years of disclosures must ABC Center provide him?
- 2.5 years—the length of time the current EHR system has been in use
- 3 years
- 7 years
- 23 years
2. For covered entities using EHR systems, ARRA reduces the length of the accounting period to three years.
Excerpt from § 13405(c)(1): ‘‘(B) an individual shall have a right to receive an accounting of disclosures … during only the three years prior to the date on which the accounting is requested.”
Use for an organization’s internal educational purposes permissible without request as long as proper citation is made. Commercial use is not permitted. A version of scenario 1 was originally published in the June 2010 print edition.
"New Patient Rights Scenarios"
(Journal of AHIMA),