How to Correct a Wrong Entry in Your Medical Record

Answer first: an amendment adds, it does not erase

The federal privacy rule gives an individual a right to have a record amended. The word does a lot of quiet work.

When a request is granted, the rule tells the entity how to make the change, and the instruction is to append. At minimum it identifies the affected records and appends the amendment or provides a link to where it sits.

So the original entry stays. What changes is that the file now carries the correction beside it.

That shapes everything downstream, including what happens when a company says no.

What can be amended, and for how long

The right covers protected health information, or a record about you, held in a designated record set.

It lasts as long as the information is maintained in that set. There is no separate deadline running from the date of the entry.

The entity may require the request to be made in writing, and may require you to give a reason supporting it. It may only do that if it tells you those requirements in advance.

That advance-notice condition is the part a reader can check. A requirement nobody told you about is not one the rule permits.

Four grounds for refusal, and the fourth is the argument

A covered entity may deny a request, and the rule names exactly four determinations that support a denial.

That the information was not created by the entity. This one has an exception: it does not hold where you give a reasonable basis to believe the originator is no longer available to act on the request.

That the information is not part of the designated record set.

That it would not be available for inspection under the access right, which ties the two rights together at their edges.

And that the information is accurate and complete.

The fourth is where most disagreements land, because it is the only one that is about the substance rather than about the file. The rest of the section is built around what happens when it is invoked.

The clock, and its single extension

The entity has to act no later than sixty days after receiving the request.

Acting means one of two things. Granting the amendment in whole or in part and doing the things the rule then requires, or denying it in whole or in part with a written denial.

One extension is available, of no more than thirty further days. It is conditional.

Within the original sixty days the entity has to give you a written statement of the reasons for the delay and the date by which it will finish.

And the rule says plainly that there may be only one such extension. The same shape appears in the access right, with different numbers.

If it is granted, other people get told

Making the change is only the first of three steps.

The second is informing you that the amendment is accepted, and obtaining from you the identification of, and agreement to notify, the relevant people who need it.

The third is the one with reach. The entity has to make reasonable efforts to inform, and provide the amendment to, two groups within a reasonable time.

The first group is people you identify as having received the information and needing the correction.

The second group is people the entity knows hold the information, including business associates, and who may have relied, or could foreseeably rely, on it to your detriment.

That second group is not limited to anyone you name. It is defined by what the entity knows and by foreseeable reliance.

If it is denied, the denial has required contents

A denial has to be timely, written, and in plain language. It then has to contain four things.

The basis for the denial, which means one of the four permitted grounds rather than a general refusal.

Your right to submit a written statement disagreeing with the denial, and how to file one.

A statement that if you do not submit a disagreement, you may request that your original request and the denial accompany future disclosures of the information.

And a description of how to complain, both to the entity under its own complaint procedure and to the Secretary. That description has to include the name or title and telephone number of the entity's designated contact person or office.

A denial that omits the complaint route is missing a required element, which is a concrete thing to look for in the document you receive.

The statement of disagreement, and the rebuttal

You may submit a written statement disagreeing with the denial and setting out the basis for the disagreement. The entity may reasonably limit its length.

The entity may then prepare a written rebuttal to your statement. Where it does, it has to give you a copy.

Whatever exists at the end of that exchange gets attached. The entity has to identify the record at issue and append, or link, your request, its denial, your statement of disagreement, and its rebuttal.

So a refused amendment does not vanish from the file. It becomes a documented dispute inside it.

What travels with the record afterwards

The rule then says what happens on the next disclosure, and it splits on whether you filed a disagreement.

Where you did, the entity has to include the appended material, or at its election an accurate summary of it, with any subsequent disclosure of the information the disagreement relates to.

Where you did not, the request and the denial go with subsequent disclosures only if you asked for that, using the route the denial was required to tell you about.

There is one accommodation for machinery. Where the disclosure uses a standard electronic transaction that cannot carry the extra material, the entity may transmit it separately to the same recipient.

Not carrying it is not an option the paragraph offers. Only sending it by another means is.

When a company is told about someone else's amendment

One short paragraph runs in the other direction, and it is easy to miss.

A covered entity informed by another covered entity of an amendment has to amend the information in its own designated record sets, in the same way an entity making the original change would.

That is what turns a single correction into a chain rather than an event at one company.

The entity also has to document the titles of the persons or offices responsible for receiving and processing amendment requests, and retain that documentation.

What this does not decide

It does not say whether any company holds a duty here. The right runs against a covered entity, and whether a particular business is one turns on facts a homepage does not show.

It does not say what any company would do with a request, or how long anything takes in practice.

It does not describe the right to obtain a copy, which is a different section with its own clock and its own fee rules, or the right to a record of where information went.

And it is not legal advice. It reports what one federal section says.