HIPAA Right of Amendment: How to Correct Errors in Your Medical Records

Right to Request Amendment

The HIPAA right of amendment lets you ask a covered entity—such as a doctor, hospital, or health plan—to correct or add to your Protected Health Information (PHI) in its designated record set. This right supports your patient privacy rights and ensures your medical record reflects accurate facts and clinically relevant context.

You can request a medical record correction when entries are wrong, incomplete, or misleading. Typical targets include demographics, medication lists, allergies, test results, diagnostic codes, and discharge summaries. You cannot force a provider to change a clinical judgment, but you may add clarifying information so the record fairly represents your perspective.

• What you can amend: factual errors, missing details, outdated information.
• What you generally cannot amend: psychotherapy notes and records compiled for legal actions (not available for inspection), or accurate and complete entries.
• How amendments work: the original entry stays; an addendum or link is appended to preserve integrity and traceability.

Procedure for Requesting Amendment

Follow a clear Amendment Request Process to help your healthcare provider comply efficiently. Most organizations accept requests through a portal form or a written letter to the Privacy Officer or Health Information Management department.

Step-by-step

• Identify the specific records: dates of service, facility, and exact entries to change.
• State what is wrong and propose precise corrections or additions.
• Explain why your correction is accurate, attaching supporting documents (e.g., lab results, prescriptions, legal name change).
• Include identifiers: full name, date of birth, address, phone, and medical record or member number if available.
• Sign and date the request; keep copies and proof of delivery.
• Optionally list third parties who should be notified (specialists, health plans, pharmacies) if your amendment is approved.

Providers may require requests in writing and may ask for a reason. Supplying clear, concise facts improves Healthcare Provider Compliance and speeds review.

Provider's Response Time

The provider must act on your request within 60 days. If more time is needed, it may take one 30-day extension, but must notify you in writing before day 60 with the reason and a new deadline. “Acting” means approving the amendment, partially approving, or issuing a written denial.

Delays for internal routing or record retrieval do not pause the clock. If the provider needs clarification, respond promptly while noting that the timeline continues to run.

Approval of Amendment

If approved, the organization must amend the record by identifying the affected entries and appending or linking your correction so future users see the accurate information. You will receive written confirmation of the action taken.

On approval, the provider must make reasonable efforts to notify others who rely on the information. With your agreement, it will send updates to the people and entities you identify, meeting Third-Party Notification Requirements and promoting consistent care across systems.

• Your EHR entry is updated without deleting the original text.
• You are informed when the amendment is completed.
• Relevant business associates and downstream systems may also receive the update as appropriate.

Denial of Amendment

A provider may deny your request if it did not create the information (and the originator is available to amend), the data is not part of the designated record set, the information is not subject to access (such as psychotherapy notes), or the record is accurate and complete.

Denials must be in writing and include the basis for denial, how to submit a Statement of Disagreement, how to request that your original amendment request and the denial accompany future disclosures, and how to file a complaint. Keep the statement concise and factual; the provider may prepare a rebuttal. For future disclosures, the provider must include your statement (or a summary) along with any rebuttal so readers see both perspectives.

Documentation of Amendment

Covered entities must maintain documentation of amendment requests, approvals, denials, statements of disagreement, and rebuttals. This recordkeeping supports Healthcare Provider Compliance and audit readiness.

Practical tips for you

• Keep a file with your request, proof of submission, the provider’s decision, any Statement of Disagreement, and names of third parties to notify.
• Track dates to monitor the 60-day timeline and any 30-day extension.
• After approval, verify that key partners (for example, your health plan or pharmacy) received the update.

Notification to Third Parties

When an amendment is approved, the provider must make reasonable efforts to inform third parties that are likely to rely on the corrected PHI and that you identify in writing. This may include referring clinicians, hospitals, health plans, pharmacies, labs, billing services, and health information exchanges.

Recipients who receive the amendment should update their copies to prevent outdated information from affecting your care, coverage, or billing. Clear Third-Party Notification Requirements help ensure that corrected data follows you across the healthcare ecosystem.

Conclusion

The HIPAA right of amendment empowers you to correct errors, add missing context, and improve the reliability of your medical record. Use a precise request, watch the response timeline, and, if needed, submit a succinct Statement of Disagreement. When approved, ensure appropriate third parties are notified so your Medical Record Correction is reflected everywhere it matters.

FAQs

What is the HIPAA right of amendment?

It is your right under HIPAA to request that a covered entity amend PHI in its designated record set when it is inaccurate or incomplete. The amendment is added to the record (the original entry remains), and the provider must make reasonable efforts to share the correction with others who rely on that information.

How long do providers have to respond to amendment requests?

Providers must act within 60 days. They may take one additional 30-day extension if they send you written notice before the initial deadline explaining the reason and providing a new date.

What happens if a request for amendment is denied?

You will receive a written denial explaining why. You may submit a Statement of Disagreement, and the provider may write a rebuttal. For future disclosures, the provider must include your statement (or a summary) with the disputed information, or—if you choose—attach your original request and the denial so recipients see the context.