How Do I Handle A Patient's Request to Change His Medical Record?

Carolyn Buppert, NP, JD


March 03, 2005


A patient recently called, upset about something written in his medical record. He requested that a "faint odor of alcohol about him" be stricken from his record, a statement that I documented in my initial history and physical. This was an objective finding, with no other indications of a problem. My supervising physician documented that no part of the record would be stricken. The patient says he will sue. Does he have a case?

Response From the Expert

Carolyn Buppert, CRNP, JD 
Nurse practitioner and attorney who specializes in the legal issues affecting medical practices and nurse practitioners. She is the author of 5 books. Ms. Buppert counsels clients, and lectures extensively on reimbursement issues, how to avoid malpractice, and contract negotiation. She is also president of Better Life Health Care Systems, which contracts with businesses and educational institutions for nurse practitioner services. Through that company she serves as Director of Student Health at St. John's College in Annapolis, Maryland. Her Web site is <a href=""></a>


Here are some guidelines recommended for the practitioner to follow in a situation like this:

  • If the information in the patient's medical record is incomplete or inaccurate, you must amend it.

  • If the information in the patient's medical record is complete and accurate, you may deny a patient's request to amend his or her medical record. You must deny the patient's request in writing to the patient, within 60 days of the request, and you must state the basis for your denial. A copy of this letter should go into the patient's record.

    Your denial letter must include the following information:

    1. Notice of the individual's right to submit a written statement disagreeing with the denial;

    2. An explanation of the process: that is, how the individual may file such a statement;

    3. A statement that, if the individual does not submit a statement of disagreement, the individual may request that you provide the individual's request for amendment and the denial with any future disclosures of the protected health information that is the subject of the amendment; and

    4. A description of how the individual may complain to you, pursuant to the complaint procedures in your practice's patient privacy policies, or to the Secretary of Health and Human Services, through the Office of Civil Rights. The description must include the name or title and telephone number of the contact person in your office.

  • If the patient submits a statement of disagreement, you may prepare a written rebuttal. When you prepare a rebuttal, you must provide a copy to the patient. You must append the patient's request for an amendment, your denial of the request, the individual's statement of disagreement, if any, and your rebuttal, if any, to the patient's record.

  • If you agree to amend the record, you must make reasonable efforts to provide the amendment to persons or entities that the patient has identified as needing it, and to persons you know might rely on the information to the patient's detriment (ie, a rehabilitation counselor or an employer).

  • If the patient believes his privacy rights have been violated, he has a right to file a complaint against you with the US Office of Civil Rights.[1] (Filing instructions are available online.) If the Office of Civil Rights finds that you have violated the provisions of the federal patient privacy regulations, they can fine you an estimated $100. Also, individual states may have additional laws on confidentiality/privacy, in addition to the federal law.

The law covering this situation is found in federal regulations issued by the US Department of Health and Human Services (DHHS) at 42 CFR 164.526(a)(2).[2] The regulations evolved from the Health Insurance Portability and Accountability Act of 1996 (HIPAA) , in which Congress called for DHHS to promulgate rules aimed at improving "the efficiency and effectiveness of the health care system by encouraging the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information."[3]

Not every provider is subject to HIPAA regulations, but if your practice submits its bills electronically, then it is likely that you are obligated to follow these regulations. To determine whether you are subject to HIPAA , visit the Web site and click on "Am I a covered entity?"[1]


Comments on Medscape are moderated and should be professional in tone and on topic. You must declare any conflicts of interest related to your comments and responses. Please see our Commenting Guide for further information. We reserve the right to remove posts at our sole discretion.