HIPAA provides patients with several rights, all described in our Notice of Privacy Practices. The Health Information Management Department and Health Information Release Services Department both work with our HIPAA Privacy Office, clinical departments, and physicians to facilitate requests related to patient rights under HIPAA. Patients have the right to:
An individual has the right to request access to their PHI that is maintained in a Designated Record Set. Such right of access may be for inspection in person or to obtain a copy.
Access may be provided electronically through the ‘Patient Portal’.
Individuals may also request access through our Health Information Release Services Department (HIRS). To obtain a copy, the Individual may be asked to complete the Request for Access to Protected Health Information by Individual Patients form.
HIRS-F0001 Request for Access to Protected Health Information by Individual Patients – WUSM Form
HIRS-F0002 Request for Access to Protected Health Information by Individual Patients – WUPI Form
An individual has the right to request an accounting of certain types of Disclosures made of their PHI including Uses or Disclosures by or to our Business Associates. This does not include Uses or Disclosures for the purpose of Treatment, Payment, or Health Care Operations or Disclosures made pursuant to an Authorization.
Business Units/Departments are responsible for reporting Disclosures to the HIPAA Privacy Office using the Accounting of Disclosure of Protected Health Information Electronic Log.
Individuals may request an Accounting of Disclosure from the HIPAA Privacy Office by completing the Request for Accounting of Disclosures of Protected Health Information form.
HPF-001 Request for Accounting of Disclosures of Protected Health Information – WUSM Form
HPF-002 Request for Accounting of Disclosures of Protected Health Information – WUPI Form
An individual has the right to request an Amendment of their PHI maintained in our Designated Record Set.
Individuals may request an Amendment through our Health Information Management Department (HIM). Individuals will be asked to complete the Request for Amendment of Protected Health Information form.
HPF-004 Request for Amendment of Protected Health Information – WUSM Form
HPF-005 Request for Amendment of Protected Health Information – WUPI Form
An Individual has the right to request a copy of their protected health information be transmitted directly to another person designated by the Individual. The Individual’s request must be in writing, signed by the Individual, and clearly identify the designated person and where to send the copy of protected health information. Individuals will be asked to complete the Authorization for Release of Protected Health Information form.
HIRS-F0003 Authorization for Release of Protected Health Information – WUSM Form
HIRS-F0004 Authorization for Release of Protected Health Information – WUPI Form
Washington University Workforce Members who communicate PHI are responsible for ensuring that the communication is appropriate and reasonably designed to protect the PHI to the greatest extent possible without interfering with the intended purpose of the communication. Individuals may complete the Washington University Patient Communication form to designate options for providing communication of PHI.
Individuals have the right to receive a Notice that contains information concerning the Uses and Disclosures of PHI. The Notice also informs the Individual of their rights with respect to their PHI, WU’s duties, how to contact WU, and how the individual may make a complaint.
The Notice of Privacy Practices should be prominently displayed for all Individuals to see and read. Individuals should be provided a copy upon request. The Notice of Privacy Practices is available on the Washington University Physicians Web site in electronic format and also available in other languages.
Individuals have the right to request restrictions on the Use or Disclosure of their PHI for purposes of Treatment, Payment, or Health Care Operations, on Disclosures made to persons involved in the Individual’s care, or on prior authorized research data. WU is required to receive the request but is not required to agree to any requested restriction(s) from an Individual. Individuals must complete and submit the Request for Restrictions on Use or Disclosure of Protected Health Information form to the HIPAA Privacy Office for review.
Individuals may request for alternative means or alternate locations to receive confidential communication(s) of their Protected Health Information. WU will accept for review and accommodate reasonable written requests from Individuals. WU may condition accommodating a request on its receipt of information as to how the Individual will handle Payment if any, and specification of an alternate address or other methods of contact. Individuals must complete and submit the Request for Alternate Method of Confidential Communications form to the HIPAA Privacy Office for review.
Individuals may request that their Protected Health Information not be Disclosed to their health plan or health insurance provider if, the Disclosure is not required by law and the Individual or someone on their behalf, pays in full for the service or health item out-of-pocket at the time of service. Individuals must complete and submit the Request for Restrictions on Use or Disclosure of Protected Health Information to a Health Plan for Services Paid in Full Out of Pocket form prior to health services being rendered.
WU must agree with the request if the Disclosure is not required by law and the health information pertains solely to a health item or service for which the Individual (or someone on their behalf) has paid WU in full at the time the service was provided.
Affected Individuals will be notified of a Breach by the HIPAA Privacy Office. The HIPAA Privacy Office will keep an electronic log detailing any Breach to be submitted to HHS annually.
Business Associates also must communicate any Breach of PHI to Washington University and may be required to perform notification to affected Individual(s).
If an Individual believes their privacy rights are being denied or that their health information is not being protected, they may file a complaint with the WU HIPAA Privacy Officer.
314-747-4975 | Toll Free: 866-747-4975 | hipaa@wustl.edu
They may also file a complaint with the Secretary of the Department of Health and Human Services (HHS), Office for Civil rights.