Patients and families
Individual-rights requests
Log and track HIPAA individual-rights requests (access, amendment, accounting of disclosures, restriction, portability, deletion), watch the response deadline, and export the record from the same row.
Individual-rights requests (Patients > Individual-rights requests) is the practice’s log of requests under the HIPAA Privacy Rule. Families can also file them from the portal’s Requests tab, and those land here.
Request types
- Access: a copy of the health information you hold.
- Amendment: correct something in the record.
- Accounting of disclosures: who the information was shared with.
- Restriction: limit how the information is used or shared.
- Portability: a copy of their data in a portable format.
- Deletion: delete information (subject to retention obligations).
Logging a request
Create: patient, request type, description, and the date received. Sefton sets the response deadline and shows Overdue when it passes.
Fulfilling it
Each row has a Record export action: it downloads the patient’s full record (sessions, goals, claims, documents) and logs the disclosure in the patient’s audit record, which is the evidence for an accounting of disclosures. Mark the request complete with a note when you have responded.
Retention
Requests and their outcomes are kept with the practice’s compliance records and appear in the audit logs under Settings > Compliance.
Frequently asked questions
Does the request page fulfil the request?
It logs it, tracks the deadline, and gives you the export action for access and portability requests. Amendment, restriction, and deletion are decisions you make in the record; the log documents what you did and when.
What is the response deadline?
HIPAA gives 30 days to respond to an access request, with one 30-day extension if you tell the individual why. Sefton computes the due date from the request date.