FAQ 369 Does the HIPAA Privacy Rule require that covered entities provide patients with access to oral information?
The is guidance related to the right of access to oral information under the HIPAA Privacy Rule
Final
Issued by: Office for Civil Rights (OCR)
Does the HIPAA Privacy Rule require that covered entities provide patients with access to oral information?
Answer:
No. The Privacy Rule requires covered entities to provide individuals with access to protected health information about themselves that is contained in their “designated record sets.” The term “record” in the term “designated record set” does not include oral information; rather, it connotes information that has been recorded in some manner.
The Rule does not require covered entities to tape or digitally record oral communications, nor retain digitally or tape recorded information after transcription. But if such records are maintained and used to make decisions about the individual, they may meet the definition of “designated record set.” For example, a health plan is not required to provide a member access to tapes of a telephone “advice line” interaction if the tape is maintained only for customer service review and not to make decisions about the member.
HHS is committed to making its websites and documents accessible to the widest possible audience, including individuals with disabilities. We are in the process of retroactively making some documents accessible. If you need assistance accessing an accessible version of this document, please reach out to the guidance@hhs.gov.
DISCLAIMER: The contents of this database lack the force and effect of law, except as authorized by law (including Medicare Advantage Rate Announcements and Advance Notices) or as specifically incorporated into a contract. The Department may not cite, use, or rely on any guidance that is not posted on the guidance repository, except to establish historical facts.