Does the HIPAA Privacy Rule require that covered entities provide patients with access to oral information?

Answer:

No. The Privacy Rule requires covered entities to provide individuals with access to protected health information about themselves that is contained in their “designated record sets.” The term “record” in the term “designated record set” does not include oral information; rather, it connotes information that has been recorded in some manner.

The Rule does not require covered entities to tape or digitally record oral communications, nor retain digitally or tape recorded information after transcription. But if such records are maintained and used to make decisions about the individual, they may meet the definition of “designated record set.” For example, a health plan is not required to provide a member access to tapes of a telephone “advice line” interaction if the tape is maintained only for customer service review and not to make decisions about the member.

Date Created: 12/20/2002