![]() ![]() These timelines are outer limits, and it is expected that many covered entities should be able to respond to requests for access well before these outer limits are reached. The PHI that is the subject of the request is old, archived, and/or not otherwise readily accessible.Covered entities that spend significant time before reaching agreement with individuals on format are depleting the 30 days allotted for the response by that amount of time. ![]() The covered entity negotiates with the individual on the format of the response.Alternatively, the 30-day clock starts when, instead of the covered entity, a business associate receives a request directly from an individual because the covered entity instructed the individual through its notice of privacy practices (or otherwise) to submit the access request directly to its business associate for processing. The 30-day clock starts on the date that the covered entity receives a request for access, so any delay in obtaining the necessary information from a business associate or forwarding the request to the business associate for action “uses up” part of the allotted time. The PHI that is the subject of the request is maintained by the covered entity or by a business associate on behalf of the covered entity, or the covered entity uses a business associate to fulfill individual requests for access. ![]() These timelines apply regardless of whether: If the covered entity is not able to act within this timeframe, the entity may have up to an additional 30 calendar days, as long as it provides the individual – within that initial 30-day period – with a written statement of the reasons for the delay and the date by which the entity will complete its action on the request. EPA OIG Mandatory Disclosure Submission Form (pdf) (1.Under the HIPAA Privacy Rule, a covered entity must act on an individual’s request for access no later than 30 calendar days after receipt of the request.Receipt of any information via the OIG telephone hotline will not be considered as fulfilling mandatory disclosure requirements. ![]() Mandatory disclosures are required to be in writing.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |