1. A family has a right to request amendment of records under HIPAA similar to the right granted under FERPA, 34 CFR 99.20-22. Additional requirements under HIPAA are as follows:
  2. Procedure - Requests for amendment must be in writing and provide a reason to support the requested amendment. They must be designated as a request for amendment under HIPAA. You must handle requests regarding records created and maintained by you in the course of providing EI services. If the request relates to records created and maintained by the Bureau of EI or the CBO, you should instruct the individual to contact the Bureau or the CBO directly to request the amendment.
  3. Denials that are allowed - The standard for amendment of records under FERPA is whether the record is "inaccurate, misleading, or otherwise in violation of privacy rights of the child". Under HIPAA you may deny the request if the record they wish to amend:
    1. Was not created by the EI program, unless the individual provides a reasonable basis to believe that the originator of the protected health information is no longer available to act on the requested amendment;
    2. Is not part of the records subject to amendment;
    3. Is not accessible to the person under the access provisions above; or
    4. Is accurate and complete.
  4. Response required in 60 days - Under HIPAA if you are unable to act on the amendment within 60 days, you may extend the time by no more than 30 days, if you provide the individual with a written statement of the reasons for the delay and the date by which you will respond in writing.
  5. Acceptance - If you agree to an amendment, under both HIPAA and FERPA you must notify the person in writing and make the change. Under HIPAA you must also:
    1. Obtain the individual's identification of and agreement to notification of relevant persons with whom the amendment needs to be shared.
    2. Make reasonable efforts to inform and provide the amendment within a reasonable time to those identified and persons that you know have the record and could rely on it to the detriment of the individual.
  6. Denial - If you deny the request, in whole or in part you must provide the timely written notification giving the basis for denial and the right to contest the decision. Under FERPA the person has a right to a hearing by the agency. Under HIPAA there is a right to submit a complaint under the HIPAA complaint procedure below.
  7. Statement of disagreement - Under HIPAA and FERPA the person must also be informed of the right to place a statement in the record commenting on the contested information and their disagreement with it. Under HIPAA they can also request that their request to amend and its denial be placed in the record. The statement of disagreement can be limited in length and you may provide and maintain a rebuttal, if it is shown to the individual.
  8. Future disclosures - You must include the material appended through the above procedures, with any subsequent disclosure of the PHI to which the disagreement relates. When a subsequent disclosure is made using a standard transaction under 45 CFR 162 that does not permit the additional material to be included with the disclosure, you may separately transmit the material to the recipient of the standard transaction.