A patient opens the portal after a visit and reads the note. It says "history of alcohol dependence." She has never had one; the line was carried forward from a template or another chart. She emails the office: "Please remove this from my record." The reply, written in good faith by a front desk that has heard it somewhere, is "we are not allowed to change medical records."
That reply is half right and completely wrong. The Privacy Rule does not let a practice erase history, and it does not let a patient dictate a diagnosis. But it does give every patient the right to ask for an amendment, and it gives the practice 60 days to answer in writing, a short list of reasons it may say no, and a set of obligations that follow either answer. The rule is 45 CFR 164.526. This article covers the request, the clock, the four grounds for denial, what to do when you accept, what to do when you refuse, and the two paragraphs that belong in your policy.
HIPAA Amendment Request Rules Under 45 CFR 164.526
The standard is one sentence: "An individual has the right to have a covered entity amend protected health information or a record about the individual in a designated record set for as long as the protected health information is maintained in the designated record set."
Three things follow from the wording. The right is to amend, which in this rule means append or link a correction, not delete. It applies only to the designated record set, the medical and billing records used to make decisions about the patient, so a quality-review file or an incident report is outside it. And the right lasts as long as the record does, which for most practices means years after the last visit.
What the Practice May Require Up Front
Under 164.526(b)(1), the practice "may require individuals to make requests for amendment in writing and to provide a reason to support a requested amendment, provided that it informs individuals in advance of such requirements." The place to inform them is the Notice of Privacy Practices. If the NPP says requests must be in writing with a reason, the office may hand the emailing patient a one-page form. If the NPP is silent, the email is the request and the clock is already running.
The Clock: 60 Days, One Extension
"The covered entity must act on the individual's request for an amendment no later than 60 days after receipt of such a request." Acting means one of two things: accept it in whole or in part and do what (c) requires, or deny it in whole or in part with a written denial that meets (d)(1). Silence is neither.
If the practice cannot finish in 60 days, (b)(2)(ii) allows an extension "by no more than 30 days," but only if the patient receives, inside the original 60 days, "a written statement of the reasons for the delay and the date by which the covered entity will complete its action." The rule adds that the practice "may have only one such extension." For comparison, the other two individual-rights clocks in the Privacy Rule:
| Request | Deadline to act | Extension | Section |
|---|---|---|---|
| Access to records | 30 days | One, up to 30 days, with written notice | 164.524(b)(2) |
| Amendment | 60 days | One, up to 30 days, with written notice | 164.526(b)(2) |
| Accounting of disclosures | 60 days | One, up to 30 days, with written notice | 164.528(c)(1) |
Sixty days is a ceiling. A wrong allergy or a wrong diagnosis is a patient-safety problem as much as a compliance one, and a clinician can usually decide in an afternoon whether the record is accurate.
The Four Grounds for Denial
164.526(a)(2) lets the practice deny a request only "if it determines that the protected health information or record that is the subject of the request:"
- "Was not created by the covered entity," unless the patient "provides a reasonable basis to believe that the originator of protected health information is no longer available to act on the requested amendment." A consult note from another practice is that practice's to amend. If that practice has closed, the ground disappears.
- "Is not part of the designated record set." Peer review minutes, for example.
- "Would not be available for inspection under § 164.524," which is the right of access section. Psychotherapy notes and information compiled for a legal proceeding are the main cases.
- "Is accurate and complete."
The fourth ground is where the clinical judgment lives, and it cuts both ways. A patient who disputes a diagnosis is not entitled to have it rewritten; if the physician reviews the chart and stands by it, the record is accurate and the denial is permitted. A patient who points out a carried-forward error, a wrong medication, or a lab value entered on the wrong chart is pointing at a record that is not accurate, and there is no ground to deny. "We do not change records" is not on the list.
If You Accept: Amend, Inform, Notify
Accepting triggers three duties under 164.526(c). First, make the amendment "by, at a minimum, identifying the records in the designated record set that are affected by the amendment and appending or otherwise providing a link to the location of the amendment." The original entry stays; an addendum is attached and the affected records are flagged. Most EHRs have an addendum function for exactly this.
Second, "timely inform the individual that the amendment is accepted" and ask the patient to identify the people who received the incorrect information and need the correction.
Third, "make reasonable efforts to inform and provide the amendment within a reasonable time" to two groups: the people the patient named, and "persons, including business associates, that the covered entity knows have the protected health information that is the subject of the amendment and that may have relied, or could foreseeably rely, on such information to the detriment of the individual." The referral specialist who got the note with the wrong history is in the second group whether or not the patient thinks of them.
If You Deny: The Letter, the Disagreement, the Rebuttal
A denial is a document, not a phone call. 164.526(d)(1) requires "a timely, written denial" in "plain language" containing four things:
- The basis for the denial, which must be one of the four grounds above.
- "The individual's right to submit a written statement disagreeing with the denial and how the individual may file such a statement."
- A statement that if the patient does not file a disagreement, the patient may ask the practice to include the request and the denial with any future disclosure of that information.
- How to complain to the practice under 164.530(d) and to the Secretary under 160.306, "including the name, or title, and telephone number of the contact person or office."
The statement of disagreement is the patient's permanent reply. Under (d)(2) the practice "must permit the individual to submit" one and "may reasonably limit the length." Under (d)(3) the practice may write a rebuttal, and if it does, it "must provide a copy to the individual." Then (d)(4) requires the practice to append or link all of it, the request, the denial, the disagreement, and any rebuttal, to the disputed record in the designated record set.
The consequence is in (d)(5): once a disagreement is on file, every later disclosure of that information must include the appended material or "an accurate summary." If the patient filed no disagreement but asked for the request and denial to travel with the record, those go along instead. The disputed line does not come out of the chart, but it never leaves without the patient's side attached.
Notices From Other Providers
164.526(e) closes the loop from the other direction. When another covered entity informs you that it amended a patient's record, you "must amend the protected health information in designated record sets" the same way, by appending or linking. A practice that receives a correction from a hospital and files it in the inbox without touching the chart has missed this one.
Documentation
The section's last paragraph, (f), requires the practice to "document the titles of the persons or offices responsible for receiving and processing requests for amendments" and to retain that documentation under 164.530(j), which sets a six-year retention. The denial letters, statements of disagreement, and rebuttals are all writings the rule requires, so 164.530(j)(1)(ii) keeps them for six years as well. The full retention picture is in HIPAA documentation requirements.
Why This Matters to OCR
OCR has spent several years demonstrating that individual-rights complaints from single patients reach small providers: a $70,000 civil money penalty against a dental practice for failure to provide timely access to patient records (October 17, 2024) and a $200,000 penalty against a university health system on the same ground (March 6, 2025). Amendment sits two sections away from access, uses the same 164.530(d) complaint route, and comes with a written-denial requirement that makes a missed deadline easy to prove. A practice that handles the request in writing, on time, with the four required elements, has almost nothing to fear. A practice that answers "we cannot change records" by email has written the complaint for the patient. If a complaint does arrive, the response process is in how to respond to a HIPAA complaint.
What to Write Into the Policy
- Intake. Requests in writing with a stated reason (as the NPP announces). Log the date received; calendar day 60 and, if used, the one 30-day extension.
- Owner. The title responsible for amendment requests, per 164.526(f). The clinician who authored the entry reviews accuracy; the privacy officer runs the process.
- Decision. Accept, partially accept, or deny on one of the four 164.526(a)(2) grounds, in writing, within the deadline. Clinical disagreement alone is a denial only when the record is reviewed and found accurate and complete.
- Acceptance steps. Addendum linked to every affected record; patient informed; patient asked whom to notify; business associates and other recipients who could rely on the error notified.
- Denial steps. Plain-language letter with the four required elements; statement of disagreement accepted (length limit stated); rebuttal copied to the patient; everything appended to the record; future disclosures carry the material.
- Inbound notices. Amendments received from other covered entities are appended within a set number of days.
- Retention. Six years for the request, the response, the disagreement, the rebuttal, and the policy.
The policy template library has the amendment policy and both letters pre-structured. Fill in the titles, attach the form, train the front desk that the answer to "please fix my record" is "please put it in writing, and you will hear back within 60 days," and the next portal message becomes routine.
---
FAQ
How long does a practice have to respond to a HIPAA amendment request?
60 days from receipt under 45 CFR 164.526(b)(2). One extension of up to 30 days is allowed if the patient receives a written statement of the reason and the completion date within the original 60 days.
Can a practice refuse to amend a medical record?
Yes, on four grounds only: the record was not created by the practice, it is not part of the designated record set, it would not be available for inspection under 164.524, or it is accurate and complete. The denial must be in writing and in plain language.
Does amending a record mean deleting the original entry?
No. 164.526(c)(1) requires the practice to identify the affected records and append or link the amendment. The original entry stays in the chart with the correction attached.
What is a statement of disagreement?
A written statement the patient may file after a denial, explaining why they disagree. The practice must accept it, may write a rebuttal (with a copy to the patient), must append everything to the record, and must include it with future disclosures of that information.
Do we have to tell other providers about an amendment?
Yes. When an amendment is accepted, the practice must make reasonable efforts to inform the people the patient identifies and anyone, including business associates, known to hold the information who may have relied on it to the patient's detriment.
Conclusion
An amendment request is a paperwork problem with a deadline, and the paperwork is short once the templates exist. One Guy Consulting's Full-Scope plan includes the amendment policy, the acceptance and denial letters, and the statement-of-disagreement procedure, with consulting time for the request that does not fit the template. Start with a free 30-minute compliance review. No obligation, no pressure.
Sources
- 45 CFR 164.526 (amendment of protected health information)
- 45 CFR 164.524 (access of individuals to PHI)
- 45 CFR 164.501 (designated record set definition)
- 45 CFR 164.530 (administrative requirements, documentation retention)
Related Reading