CMS SOM App. H, Tag V455

The patient has the right to— Privacy and

confidentiality in personal medical records;

Interpretive Guidance §494.70(a)(4)

Patients should be able to expect the facility to maintain confidentiality of their medical record

information. Patients’ health records must be protected from casual access. Hard copy medical

records should be stored in a secure location when not in use.

Computer screens containing patient information should not be left open and unattended with

patient specific information on display and computerized systems should require passwords and

permissions to access medical records.

The facility must inform patients of their privacy rights under the Health Insurance Portability

and Accountability Act of 1996 (HIPAA) Privacy Rule through a notice of privacy practices.

A signed release is not required by the HIPAA Privacy Rule to share protected health

information for continuity of care, such as but not limited to providing emergency care or

contacting other dialysis facilities as a part of the protocol for involuntary discharge or

termination of treatment or when asking the police to help locate a patient so they can receive

dialysis.

Patients have the right to read their own medical record, have corrections made to that record,

and to have a copy of their record for which a nominal fee may be charged. The facility must

actively seek to honor patients’ requests to have a copy of their medical record as quickly as its

recordkeeping system permits.

Certain circumstances under the HIPAA Privacy Rule may not permit a patient or their designee

to have the right to review their medical record. Any established HIPAA violation should be

referred to the Office of Civil Rights and/or cited under 42 C.F.R. § 494.20 for non-compliance

with Federal, State, and local laws and regulations. Under the HIPAA Privacy Rule, reasons

why a patient or their designee would not have the right to review their record include:

• The records are psychotherapy notes or compiled in reasonable anticipation of, or for

use in , a civil, criminal, or administrative action or proceeding, or access is prohibited

by law pursuant to the Clinical Laboratory Improvements Amendments of 1988, 42

U.S.C. 263a, to which the health care provider is subject or the health care provider is

exempt from the Clinical Laboratory Improvements Amendments of 1988, pursuant to 42

Page 185 of 420

CFR 493.3(a)(2).

• The patient is an inmate of a correctional facility and access could jeopardize the health,

safety, security, custody or rehabilitation of the patient, other inmates, or the safety of

any officer, employee or other correctional system employee, including the transporter;

• The patient is participating in a research project that includes treatment and is ongoing

and the patient agreed to the denial of access and has been informed that access rights

will be reinstated upon completion of the research;

• The records are subject to the Privacy Act, 5 U.S.C. 552a, and the denial of access under

the Privacy Act would meet the requirements of that law.

• Access to the medical record would reveal a confidential source under a promise of

confidentiality that is not a health care provider;

• A licensed health care professional has determined, in the exercise of professional

judgment, that the access to the medical record is reasonably likely to endanger the life

or physical safety of the individual or another person;

• The medical record makes reference to another person (unless such other person is a

health care provider) and a licensed health care professional has determined, in the

exercise of professional judgment, that the access requested is reasonably likely to cause

substantial harm to such other person.

• The individual’s personal representative makes the request for access and a licensed

health care professional has determined, in the exercise of professional judgment, that

the provision of access to such personal representative is reasonably likely to cause

substantial harm to the individual or another person.

Confidential treatment and release of patient medical record information is also addressed in the

Condition for medical records at V727 and V728.