medical record

July 30, 2026

Posted on by jwilbert

QUESTION:
A patient recently requested a list of all individuals who accessed her medical record.  Do we have to give it to her?

ANSWER FROM HORTYSPRINGER ATTORNEY DAN MULHOLLAND:
A patient has the right of access under HIPAA to her protected health information (PHI) contained in a “designated record set.” 45 CFR §164.524(a)(1).  A “designated record set” is defined as including:

    • Medical records and billing records about individuals maintained by or for a covered health care provider.
    • Enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan.
    • Other records used, in whole or in part, by or for the covered entity to make decisions about individuals.

The patient in question seems to be requesting copies of the audit logs showing who accessed her records and when.  The audit logs are security/audit controls required under the HIPAA Security Rule (45 CFR §164.312(b)) for compliance and breach detection, not for clinical or decision-making purposes.  Therefore, they are not part of a “designated record set” and thus the patient does not have a right of access to that information.

Another section of the HIPAA regulations gives patients the right to ask for an accounting of disclosures of their PHI.  45 CFR §164.528(a).  However, this does not include disclosures for treatment, payment or health care operations.  The audit log would record access for treatment, payment or health care operations so the information in the audit log would not be subject to the disclosure accounting rule.

Of course, if the patient brought suit against the hospital, she would be able to get access to the audit logs and other parts of the electronic health record through normal discovery procedures.

If you have a quick question about this, e-mail us at info@hortyspringer.com.

July 26, 2018

Posted on by hortyspringer

QUESTION:        A physician on our staff has made numerous inappropriate entries into our patients’ medical records. These include scathing critiques of other practitioners and even nasty comments about his patients and their families.  While we have approached him several times to inform him that a patient’s medical record is not an appropriate forum for these comments, he claims he has the First Amendment right to put whatever he wants to in the records, and continues to do so. What can we do?

ANSWER:            Regulatory and accreditation standards make it clear that medical records should only be used to document objective clinical information relative to a patient’s care. Inappropriate editorial statements in a patient’s medical record that are used to be critical of the patient, other providers, or even the hospital itself do not advance the care of a patient and may create increased legal risks to everyone involved in that patient’s care.

A physician who has a complaint or concern regarding the care being provided by any other individual should be advised that the medical record is not the proper forum for addressing those concerns and should then be directed to the appropriate medical staff or administrative channels to report them.   Most times, providing this education and counseling to the physician is sufficient to resolve the issue.  However, if the inappropriate entries continue, then the matter should be referred for review under the medical staff’s Professionalism Policy or Code of Conduct.

Be sure to join Barbara Blackmond and Ian Donaldson for The Complete Course for Medical Staff Leaders, where we will cover practical, real-world approaches to managing unprofessional behaviors that can frustrate even the most experienced medical staff leaders.