The patient rights beyond access

A clinic that has learned to answer records requests on time can believe it has patient rights handled. It does not. Right of access is the famous one, the most-enforced obligation in HIPAA, and it deserves the attention. But a parent has five more rights, and three of them carry the same kind of clock, and one of them is a request you cannot refuse even though you may refuse most.

These five are quieter than access, and less enforced, which is exactly why clinics miss them. A request arrives, nobody recognizes it as a right with a deadline, and it gets handled as if it were an ordinary piece of mail. Here is each one, and the trap inside it.

Amendment

A parent can ask you to amend something in their child’s record they believe is wrong or incomplete (45 CFR 164.526). You have 60 days to act. You do not have to agree the record is wrong: you may deny the request on specific grounds, chiefly that you did not create the information, that it is not part of the record you would give them access to, or that it is already accurate and complete. But a denial is a process, not a shrug. It has to be in writing, and the parent then has the right to submit a written statement of disagreement, which travels with the record on future disclosures.

The trap is treating an amendment request as an argument to win rather than a process to run. You can stand by the record. You still have to run the process, in writing, inside 60 days.

Accounting of disclosures

A parent can ask for an accounting of where their child’s PHI has gone: a list of disclosures your clinic made in the six years before the request (45 CFR 164.528). The right sounds enormous until you see the carve-outs. Disclosures for treatment, payment, and health care operations are excluded, as are disclosures back to the individual and disclosures the individual authorized. What is left is the unusual stuff: disclosures to public health authorities, to law enforcement, in response to a subpoena, the reportable events outside normal care.

You have 60 days, and the first accounting in any 12-month period is free. The clinic that cannot produce an accounting is usually the clinic that never logged those disclosures in the first place, which is its own problem surfacing.

Restrictions

A parent can ask you to restrict how you use or disclose their child’s information (45 CFR 164.522(a)). Most of the time, you are allowed to say no. You can decline a requested restriction, as long as you decline it rather than agreeing and then ignoring it.

There is one you cannot refuse. If a family pays you in full, out of pocket, for a service, and asks you not to disclose that service to their health plan, you must agree, unless the disclosure is required by law (45 CFR 164.522(a)(1)(vi)). Most restriction requests you may refuse. One, you must grant.

And this one has a purely operational trap that has drawn fines: the clinic says yes, then its billing system automatically submits the claim to the plan anyway, because nobody stopped it. Agreeing to the restriction is half the obligation. Making sure your billing actually honors it is the other half.

“Most restriction requests you may refuse. One, you must grant.”

Confidential communications

A parent can ask to be contacted a particular way: by text and not a call, at a work address and not home, at a different number entirely (45 CFR 164.522(b)). A provider must accommodate reasonable requests for alternative means or locations, and you may not require the parent to explain why.

In ABA this is not a formality. Custody disputes, domestic-safety situations, and separated households make the default contact method a genuine risk, and the parent making the request often cannot say so out loud. The rule is built for exactly that: accommodate the reasonable request, do not interrogate the reason.

The Notice of Privacy Practices

The Notice is the document that tells families all of the above exists (45 CFR 164.520): plain language, an effective date, provided no later than the first time you deliver service, and listing the rights on this page. The part clinics forget is maintenance, because a Notice that describes a clinic you no longer are is not a compliant Notice, it is a stale one, and you keep it current by issuing a new dated version rather than silently editing the live copy. The full treatment is in The Notice of Privacy Practices: a promise that has to stay current.

How these die

From obscurity. Access is famous enough that a clinic at least fears it. These five are quiet, so the amendment request gets argued with instead of processed, the out-of-pocket restriction gets a verbal yes and an automated claim, the accounting cannot be produced because nothing was ever logged, and the Notice gets written once and never touched again. None of these failures looks dramatic. Each is a right a parent can complain about, and each complaint lands in the same place access complaints do.

The bottom line

Access is the loud right, but a parent has six, and the other five each need an owner. Three of them run on a clock, amendment and accounting on 60 days, and access on 30. One restriction you cannot refuse, and your billing system has to know it. One request you must honor without asking why. And one Notice that has to stay current and provable, not written once and forgotten. Treat each of these as a request with a deadline rather than a piece of mail, and the quiet rights stop being the ones that surprise you.