Patients have a federal right to “request to amend” their medical record. This right is conferred by the Standards for Privacy of Individually Identifiable Health Information, otherwise known as the HIPAA Privacy Rule of 2001 (45 C.F.R. § 164.526).

The provider may deny a patient’s request to amend. In denying the amendment, the provider must provide an explanation to the patient for the denial in plain language and in a timely manner. In this notification, the patient must be given the option to submit a statement of disagreement. The patient must also be given options to further complain, such as the name and telephone number of the health system’s compliance officer and relevant government agencies. If the patient submits a statement of disagreement, then the provider may issue a rebuttal statement.
Recordkeeping is crucial because ignoring a patient’s request to amend the record is a HIPAA violation. The Office for Civil Rights (OCR) has an online complaint portal and a toll-free number to trigger investigations. The OCR is empowered to assign civil money penalties and, with the Department of Justice, to enforce criminal prosecutions to medical providers.
If the record is amended, be sure to note the amendment in the medical record. Providers should never delete any portion of the medical record. Penalties skyrocket if there is evidence of retaliation against the patient. Retaliation could be evident if something derogatory is written about the patient in the chart because of the request to amend the medical record.
The Privacy Rule does not allow the provider to charge a fee to the patient for any work performed to receive, deny, or approve a patient’s request to amend the health record.

Providers have 60 days to respond but may extend another 30 days if needed.