Iowa Admin. Code r. 441-9.9

Current through Regsiter Vol. 46, No. 26, June 12, 2024

Rule 441-9.9 - [Effective until 7/3/2024] Release to subject

(1)Access by subjects to protected health information.

a. Right of access. Except as otherwise provided in paragraphs 9.9(1) and"g, " a subject has a right of access to inspect or to obtain a copy of the protected health information about the subject that is maintained in a designated record set. Subjects shall submit all requests for access to the department using Form 470-3952, Request for Access to Health Information.

If the department does not maintain the protected health information that is the topic of the subject's request for access, and the department knows where the requested information is maintained, the department shall inform the subject where to direct the request for access.

b. Timely action.

(1) The department shall act on a request for access no later than 30 days after receipt of the request unless the protected health information is not maintained or accessible to the department on site.

(2) If the requested information is not maintained or accessible to the department on site, the department shall take action no later than 60 days from the receipt of the request.

(3) If the department is unable to act within 30 days or 60 days as appropriate, the department may extend the time for the action by no more than 30 days. Within the applicable time lunit, the department shall provide the subject with a written statement of the reasons for the delay and the date by which the department will complete its action on the request. The department shall have only one extension of time for action on a request for access.

c. Action on providing access. If the department grants the request, in whole or in part, the department shall inform the subject that the request is accepted and shall provide the access requested. Access includes inspecting the protected health information about the subject in designated record sets, obtaining a copy of the information, or both. If the same protected health information that is the subject of a request for access is maintained in more than one designated record set or at more than one location, the department need only produce the protected health information once in response to a request for access.

(1) The department shall provide the subject with access to the protected health information in the form or format requested by the subject, if the requested format is readily producible. If the requested format is not readily producible, the department shall provide the information in a readable hard-copy form or other format as agreed to by the department and the subject.

(2) The department may provide the subject with a summary of the protected health information requested instead of providing access to the protected health information. The department may provide an explanation of the protected health information to which access has been provided. The subject must agree in advance to a summary or explanation and to any fees imposed by the department for the summary or explanation.

d. Time and manner ofaccess. The department shall provide the access as requested by the subject in a timely manner as described in paragraph 9.9(1) "b. " The department shall arrange with the subject for a time and place to inspect or obtain a copy of the protected health information that is convenient for both the subject and the department, or shall mail the copy of the protected health information at the subject's request. The department may discuss the scope, format, and other aspects of the request for access with the subject as necessary to facilitate the timely provision of access.

e. Fees for access. If the subject requests a copy of the protected health information or agrees to a summary or explanation of the information, the department may impose a reasonable, cost-based fee, as set forth in subrule 9.3(7).

f. Mandatory reasons for denial ofaccess. The department shall deny a subject access to protected health information when the requested information is:

(1) Psychotherapy notes;

(2) Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding; or

(3) Protected health information maintained by the department that is:

1. Subject to the Clinical Laboratory Improvements Amendments of 1988, 42 U.S.C. Section 263a, to the extent the provision of access to the subject would be prohibited by law; or

2. Exempt from the Clinical Laboratory Improvements Amendments of 1988, pursuant to 42 CFR 493.3(a) (2).

g. Optional reasons for denial of access. The department may deny a subject access in the following circumstances.

(1) The department may temporarily suspend a subject's access to protected health information created or obtained by a covered health care provider in the course of research that includes treatment. The subject must have agreed to the denial of access when consenting to participate in the research that includes treatment. The suspension may last for as long as the research is in progress. The department shall inform the subject that the right of access will be reinstated upon completion of the research.

(2) The department may deny a subject's access to protected health information that is contained in records that are subject to the Privacy Act, 5 U.S.C. Section 552a, if the denial of access under the Privacy Act would meet the requirements of that law.

(3) The department may deny a subject's access if the protected health information was obtained from someone other than a health care provider under a promise of confidentiality and the access requested would be reasonably likely to reveal the source of the information.

(4) State or federal law prohibits a subject's access to protected health information, such as the state law lunitations described in subrule 9.9(2).

(5) The department may deny a subject access, provided that the subject is given a right to have the denials reviewed as required by paragraph 9.9(1) "i, " in the following circumstances:

1. A licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to endanger the life or physical safety of the subject or another person;

2. The protected health information makes reference to another person (unless the other person is a health care provider) and a licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to cause substantial harm to the other person; or

3. The request for access is made by the subject's personal representative, subject to the more restrictive definition of personal representative for protected health information, and a licensed health care professional has determined, in the exercise of professional judgment, that the provision of access to the personal representative is reasonably likely to cause substantial harm to the subject or another person.

h. Action on denial of access. If the department denies access, in whole or in part, to protected health information, the department shall comply with the following requirements.

(1) The department shall, to the extent possible, give the subject access to any other protected health information requested, after excluding the protected health information to which the department has a reason to deny access.

(2) The department shall provide a timely, written denial to the subject, in accordance with paragraph 9.9(1) "b."

i. Review of denial of access. If access is denied for a reason permitted under subparagraph 9.9(1) "g"(5) , a subject may submit a written request for a review of a denial. If the subject requests a review, the department shall promptly refer the request to a licensed health care professional who is designated by the department to act as a reviewing official and who did not participate in the original decision to deny.

(1) The designated reviewing official shall determine, within 30 days, whether or not to deny the access requested based on the standards in subparagraph 9.9(1) "g "(5).

(2) The department shall promptly provide written notice to the subject of the determination made by the designated reviewing official and shall take other action as required to carry out the designated reviewing official's determination.

(2)Access by subjects to other confidential information. The department shall release confidential records to the subject of the record. However, when a record has multiple subjects with interest in the confidentiality of the record, the department may take reasonable steps to protect confidential information relating to another subject. The department need not release the following records to the subject:

a. Records need not be disclosed to the subject when they are the work product of an attorney or are otherwise privileged.

b. The identity of a person reporting suspected abuse to the department need not be disclosed to the subject. (See 441-subrule 175.41(2) and Iowa Code section 235A.19.)

c. The identity of a person providing information to the department need not be disclosed directly or indirectly to the subject of the information when that information is authorized to be held confidential pursuant to Iowa Code section 22.7(18).

d. Peace officers' investigative reports may be withheld from the subject, pursuant to Iowa Code section 22.7(5).

e. The department may withhold disclosure of confidential information when the department has reason to believe that disclosure of the information would cause substantial and irreparable harm and would not be in the public interest. The department may withhold disclosure to seek an injunction to restrain examination of the record according to procedures in Iowa Code section 22.8 or to notify the person who would be harmed to allow that person to seek an injunction.

f. The department may withhold information as otherwise authorized by law.

Iowa Admin. Code r. 441-9.9