Brad Thomas is a former patient at Alabama General Hospital. He came to the HIM Department today and asked for a list of people who have requested his medical records over the past 10 years. He also wants to know what was released. Which is the appropriate response to Brad's request?
Under the HIPAA Privacy Rule, individuals have the right to request an accounting of disclosures of their medical records made by covered entities in the past 6 years but not beyond. Therefore, the appropriate response to Brad's request is to provide him with information on records released over the past 6 years.
Can someone explain why it would be 6 years?