PART II. INDIVIDUAL'S RIGHTS
[§323C-11] Inspection and copying of protected health information.
(a) For the purposes of this section only, "entity" means a health care provider, health plan, employer, health care data organization, insurer, or educational institution.(b) At the request in writing of an individual and except as provided in subsection (c), an entity shall permit an individual who is the subject of protected health information or the individual's designee, to inspect and copy protected health information concerning the individual, including records created under section 323C-12, that the entity maintains. The entity shall adopt appropriate procedures to be followed for the inspection or copying and may require an individual to pay reasonable costs associated with the inspection or copying.
(c) Unless ordered by a court of competent jurisdiction, an entity is not required to permit the inspection or copying of protected health information if any of the following conditions are met:
(1) The entity determines that the disclosure of the information could reasonably be expected to endanger the life or physical safety of, or cause substantial mental harm to, the individual who is the subject of the record;
(2) The information identifies, or could reasonably lead to the identification of, a person who provided information under a promise of confidentiality concerning the individual who is the subject of the information unless the confidential source can be protected by redaction or other similar means;
(3) The information is protected from discovery as provided in section 624-25.5; or
(4) The information was collected for or during a clinical trial monitored by an institutional review board, the trial is not complete, and the researcher reasonably believes that access would harm the conduct of the trial.
(d) If an entity denies a request for inspection or copying pursuant to subsection (c), the entity shall inform the individual in writing of:
(1) The reasons for the denial of the request for inspection or copying;
(2) Any procedures for further review of the denial; and
(3) The individual's right to file with the entity a concise statement setting forth the request for inspection or copying.
(e) If an individual has filed a statement under subsection (d)(3), the entity in any subsequent disclosure of the portion of the information requested under subsection (b) shall include:
(1) A copy of the individual's statement; and
(2) A concise statement of the reasons for denying the request for inspection or copying.
(f) An entity shall permit the inspection and copying under subsection (b) of any reasonably segregable portion of a record after deletion of any portion that is exempt under subsection (c).
(g) An entity shall comply with or deny, in accordance with subsection (d), a request for inspection or copying of protected health information under this section not later than thirty days after the date on which the entity or agent receives the request.
(h) An agent of an entity shall not be required to provide for the inspection and copying of protected health information, except where:
(1) The protected health information is retained by the agent; and
(2) The agent has received in writing a request from the entity involved to fulfill the requirements of this section, at which time this information shall be provided to the individual. The agent shall comply with subsection (g) with respect to any such information.
(i) The entity shall afford at least one level of appeal by parties not involved in the original decision.
(j) This section shall not be construed to require that an entity described in subsection (a) conduct a formal, informal, or other hearing or proceeding concerning a request for inspection or copying of protected health information.
(k) If an entity denies an individual's request for copying pursuant to subsection (c), or if an individual so requests, the entity shall permit the inspection or copying of the requested protected health information by the individual's designated representative, upon presentation of a proper authorization signed by the individual, unless it is patently clear that doing so would defeat the purpose for which the entity originally denied the individual's request for inspection and copying. [L 1999, c 87, pt of §2]