1. Purpose

To ensure individuals can exercise their HIPAA rights of access, amendment, accounting of disclosures, restriction, confidential communication and complaint, including where research records are involved.

2. Scope

Applies to all requests from individuals or their personal representatives regarding protected health information held by Quillbrook, including research records in a designated record set.

3. Responsibilities

• HIPAA Privacy Officer: Receives, logs and decides requests, and maintains the accounting of disclosures log.
• Principal Investigator: Advises whether access must be temporarily suspended while a blinded trial is in progress.
• Office & Facilities Administrator: Routes incoming requests to the Privacy Officer the day they are received.
• All Workforce Members: Direct individuals to the Privacy Officer and never refuse, delay or decide a rights request informally.

4. Definitions

Designated record set

Medical and billing records and other records used by the covered entity to make decisions about individuals.

Personal representative

A person with authority under applicable law to act on behalf of an individual in making health care decisions.

Accounting of disclosures

The list an individual may request of disclosures of their PHI that are not excluded from accounting, generally covering the six years before the request.

Restriction

A requested limitation on the use or disclosure of PHI, which must be granted where the individual pays out of pocket in full and asks that the disclosure to a health plan be withheld.

5. Procedure

1. Log every rights request on the day it is received, with the individual's name, the right invoked, the date received and the response deadline.
2. Verify the identity of the requester, and the legal authority of any personal representative, before disclosing or acting.
3. For an access request, provide access to PHI in the designated record set within thirty calendar days, with a single thirty-day extension permitted if the individual is notified in writing of the reason and the new date.
4. Provide the records in the form and format requested where readily producible, including an electronic copy, and charge only a reasonable, cost-based fee.
5. Where research records are in a designated record set and the study is blinded, the individual's access may be temporarily suspended for the duration of the trial if they agreed to the suspension when consenting and were told access would be reinstated on completion; document this basis.
6. Apply other permitted denials narrowly, such as psychotherapy notes or information compiled for legal proceedings, and provide a written denial that explains the basis and the right to review by a licensed professional who was not involved in the decision.
7. For an amendment request, respond within sixty calendar days, with a single thirty-day extension on written notice; if accepted, amend the record, identify the affected records and notify persons the individual identifies and those known to have relied on the information.
8. If an amendment is denied, provide a written denial stating the basis, the individual's right to submit a statement of disagreement, and how to complain; retain the request, denial, statement of disagreement and any rebuttal with the record.
9. Maintain an accounting of disclosures log that records the date, the recipient's name and address, a description of the PHI disclosed and the purpose, for every disclosure subject to accounting, including research disclosures made under a waiver of authorisation.
10. Provide the accounting within sixty calendar days of request, covering up to six years before the request, free of charge once in any twelve-month period.
11. For research disclosures of the PHI of fifty or more individuals under a waiver, a multi-study listing may be provided as permitted by the Privacy Rule, with an offer to assist in identifying specific studies.
12. Grant or deny requested restrictions in writing, and always grant a restriction on disclosure to a health plan where the individual has paid out of pocket in full for the service.
13. Accommodate reasonable requests for confidential communication by alternative means or at an alternative location without requiring a reason.
14. Accept complaints without requiring a specific form, log them, investigate with the Privacy Officer, respond in writing, and never retaliate against a complainant.
15. Retain all requests, responses, denials and the accounting log for at least six years from creation or last effective date.

6. References

• 45 CFR 164.524 — Access of individuals to protected health information
• 45 CFR 164.526 — Amendment of protected health information
• 45 CFR 164.528 — Accounting of disclosures of protected health information
• 45 CFR 164.522 — Rights to request privacy protection for PHI
• 45 CFR 164.530 — Administrative requirements
• HIP-001 HIPAA Privacy Rule in Research

7. Revision History

• v2.0 · Jun 12, 2023 — Added blinded-trial access suspension guidance.
• v2.2 · Nov 17, 2025 — Clarified accounting of research disclosures under waivers.