Patient rights procedures, request forms and logs

Granite City Family Dental · Policy set version 1.0 · Effective November 1, 2026

Authority: 45 CFR 164.522, 164.524, 164.526, 164.528; Minnesota Statutes 144.292. Requests are processed by Janelle Okafor under the direction of the Privacy Officer, Janelle Okafor.

Right of access is the most frequently enforced HIPAA provision against small practices. Every request is logged the day it arrives, given a due date, and tracked to completion in the log at the end of this document.

1. Right of access (45 CFR 164.524)

What the patient may get. The patient, or their personal representative, may inspect and obtain a copy of PHI in a designated record set (medical and billing records and anything used to make decisions about the patient), for as long as we maintain it. Excluded: psychotherapy notes, information compiled for a legal proceeding, and certain laboratory information restricted by law.

Timing. Our internal target is 10 days. The legal limit is 30 calendar days from receipt; if we cannot meet it we send the patient a written explanation and a new date, and may take one extension of no more than 30 more days. Requests are never left waiting for the provider's convenience. Minnesota Statutes 144.292 requires us to furnish copies within a reasonable time and limits what we may charge, so the shorter of the two rules applies.

Form and format. We provide the record in the form and format the patient requests if we can readily produce it. Available formats: Paper copy, PDF by secure email or portal and CD / USB. If the requested form is not readily producible, we offer a readable alternative, and paper if no electronic form is agreed. On the patient's clear, signed written direction we transmit copies to a third party the patient names.

Fees. Electronic copies to the patient: no charge. Paper copies: actual cost of labor and supplies, not exceeding Minnesota Statutes 144.292 limits. No fee for records needed to continue care or to appeal a benefit denial. Fees are never charged for searching or retrieving, and no fee is charged when the records are needed to continue care or to appeal a benefit denial.

Verification. Identity is verified under the Uses and Disclosures policy before release. We may not require a notarized request or an in-person visit.

Denials. Unreviewable denials (psychotherapy notes, legal-proceeding compilations, certain inmate and research situations) and reviewable denials (a licensed professional determines access is reasonably likely to endanger life or physical safety, or to cause substantial harm to another person named in the record) are made in writing within the time limit, state the basis, explain how to request review by a licensed professional not involved in the original decision where review is available, and explain how to complain to us and to HHS. Any part of the record not subject to the denial is still provided.

2. Right to amend (45 CFR 164.526)

The patient may ask us to amend PHI in a designated record set. Dr. Maria Lindqvist reviews each request with the author of the entry. We act within 60 days, with one 30-day extension on written notice. If accepted, we make the amendment, identify the affected records, inform the patient and, with the patient's agreement, notify persons who have the information and may rely on it. We may deny a request if the information was not created by us (unless the originator is no longer available), is not part of the designated record set, is not available for inspection, or is accurate and complete. A denial is written, states the reason, and tells the patient they may file a statement of disagreement (which we may rebut), ask that the request and denial accompany future disclosures, and complain to us and HHS. Disagreements and rebuttals are appended to the record.

3. Accounting of disclosures (45 CFR 164.528)

The patient may request a list of disclosures made in the six years before the request, except disclosures for treatment, payment and health care operations, to the patient, under an authorization, for the facility directory or to persons involved in care, for national security, to correctional institutions, or as part of a limited data set. The accounting shows date, recipient, description of the information and purpose. We respond within 60 days, with one 30-day extension on written notice. The first accounting in any 12 months is free; a reasonable cost-based fee may be charged for further requests after advance notice. Disclosures subject to accounting are recorded in Both as they occur.

4. Right to request restrictions (45 CFR 164.522(a))

The patient may ask us to restrict uses or disclosures for treatment, payment or operations, or to family and friends. We are not required to agree except in one case: when the patient pays out of pocket in full for an item or service and asks us not to disclose it to their health plan for payment or operations, we must comply unless the disclosure is required by law.

Self-pay restriction workflow. A restriction flag is set on the encounter in the practice management system before claims are generated; billing staff confirm the flag before any claim or statement is released.

Agreed restrictions are documented in the chart and honored until terminated by the patient or, for non-mandatory restrictions, by us with written notice (prospectively only). We may disclose restricted information for emergency treatment.

5. Confidential communications (45 CFR 164.522(b))

The patient may ask to be contacted by alternative means or at an alternative location. We accommodate all reasonable requests without asking the reason. Options offered: Alternate phone number, alternate mailing address, portal-only messaging, no voicemail. Requests are recorded in the patient's demographics.. The preference is recorded in the patient's demographics and followed by all staff.

6. Tracking and review

Every request under sections 1–5 is entered in the log below (or the EHR equivalent) on the day it arrives with its due date. The log is reviewed at the annual compliance meeting and any request completed late is examined for cause.

Request for Access to Health Records

Patient name: ______________________________________ Date of birth: ______________ Phone: ______________

Records requested (dates of service, type of record, or "entire record"): ________________________________________________

Format: [ ] Paper [ ] PDF by secure email / portal [ ] Portal download [ ] CD or USB [ ] Send directly to: ______________________________ (name, address, fax or secure email)

I understand a cost-based fee may apply to paper copies as described in the fee schedule.

Signature: ______________________________________ Date: ______________

Personal representative name and authority (if applicable): ______________________________________

Office use. Received: ______________ Due (30 days): ______________ Extension sent: ______________ Completed: ______________ By: ______________ Fee charged: ______________

Request to Amend Health Records

Patient name: ______________________________________ Date of birth: ______________

Entry to be amended (date, document, location): ________________________________________________

What is incorrect or incomplete: ________________________________________________

What it should say: ________________________________________________

Signature: ______________________________________ Date: ______________

Office use. Received: ______________ Due (60 days): ______________ Reviewer: ______________ Decision: [ ] Accepted [ ] Denied — reason: ______________ Patient notified: ______________ By: ______________

Request for Accounting of Disclosures

Patient name: ______________________________________ Date of birth: ______________

Period requested (up to six years): from ______________ to ______________

Signature: ______________________________________ Date: ______________

Office use. Received: ______________ Due (60 days): ______________ Prior accounting in last 12 months: [ ] No (free) [ ] Yes — fee notice given: ______________ Completed: ______________ By: ______________

Request for Restriction or Confidential Communication

Patient name: ______________________________________ Date of birth: ______________

☐ I request that the following information not be disclosed to my health plan because I paid in full out of pocket: ________________________________________________ (date of service / item). *This request must be honored.*

☐ I request the following other restriction: ________________________________________________

☐ I request to be contacted only by: [ ] phone ______________ [ ] mail at ______________ [ ] portal [ ] no voicemail [ ] other ______________

Signature: ______________________________________ Date: ______________

Office use. Received: ______________ Decision: [ ] Agreed [ ] Declined (not permitted for self-pay) Entered in chart/PM system: ______________ By: ______________

Patient request log

Approval

Approved by: Dr. Maria Lindqvist, Owner

Signature: ______________________________________ Date: ______________