To amend a medical record under HIPAA, you send the provider a written request identifying the specific error and explaining why it’s wrong; the provider then has 60 days to grant the change, deny it on one of four narrow grounds, or notify you of a single 30-day extension.1eCFR. 45 CFR 164.526 – Amendment of Protected Health Information An amendment does not erase the original entry. The mistaken text stays in the file, and the correction is added alongside it with a date and the identity of whoever made the change, so the full history of your care remains intact.
What Counts as a Correctable Error
Amendments exist to fix objective inaccuracies and omissions. A wrong diagnosis code, a medication dosage recorded incorrectly, a lab result filed under the wrong patient, a resolved condition still listed as active, a documented allergy that never made it into your chart — all of these are the kind of thing the amendment process is built for.
What you cannot do is use an amendment to strip out a clinician’s judgment because you disagree with it. If your doctor documented a diagnosis you believe was wrong, the provider can deny the request as long as the record is “accurate and complete” in reflecting the clinical assessment made at the time.1eCFR. 45 CFR 164.526 – Amendment of Protected Health Information The dividing line runs between facts (“I was never prescribed that drug”) and opinions (“that diagnosis wasn’t warranted”). Facts get amended. Opinions get contested through a statement of disagreement, covered below.
Which Records You Can Amend
Your amendment rights reach only what HIPAA calls the designated record set: your medical and billing records held by a provider, and the enrollment, payment, and claims records held by a health plan, along with any other records a provider or plan uses to make decisions about you.2eCFR. 45 CFR 164.501 – Definitions Internal quality review or peer review documents kept separate and never used for treatment decisions generally sit outside that definition.
Psychotherapy notes are a notable boundary. These are a therapist’s private session notes kept apart from the rest of your chart, and HIPAA excludes them from the patient right of access. Because a provider can deny an amendment for any record you can’t inspect, psychotherapy notes are effectively off-limits.1eCFR. 45 CFR 164.526 – Amendment of Protected Health Information Treatment summaries, medication lists, and diagnostic information in your main chart are still available for amendment even when they relate to mental health care.
How to Submit the Request
The request has to be in writing. Most providers offer a form, but a letter or a secure patient portal message works too. Name the specific information you want changed, explain why it’s wrong or incomplete, and point to where in your records the error appears. Vague requests are easy to reject; the more precise the request, the harder a denial becomes to justify.1eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
Attach supporting documentation when you have it. A corrected lab report, a letter from another physician, or pharmacy records showing the correct medication all strengthen the request. The provider is allowed to require a reason for the change, but only if they told you about that requirement in advance.
How the Correction Is Actually Made
Nothing gets deleted, overwritten, or made unreadable. On paper, the standard practice is a single line through the incorrect text so it remains legible, with the corrected information written nearby, dated, initialed or signed, and accompanied by the reason for the change.3Noridian Medicare. Documentation Guidelines for Amended Records Electronic records follow the same principle: the original entry stays, and the correction is appended or linked with a timestamp, the identity of who made it, and a reason.
So an accepted amendment leaves your chart showing both versions and a clear note about why the change happened. That’s the point. The record has to be reliable evidence of what was known when, and preserving the original protects both the patient and the provider.
The 60-Day Deadline
A provider must act on your request within 60 days of receiving it. One 30-day extension is allowed, but only if the provider notifies you in writing before the original 60 days expire, gives you the reason for the delay, and tells you when they’ll respond. No second extension is available.1eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
Simple corrections like a misspelled name or a wrong date of birth often happen much faster in practice. The 60 days is an outer boundary. If a few weeks have passed without a response, a follow-up call that references your written request and the date you submitted it usually moves things.
The Four Grounds for Denial
A provider can refuse your request only on one of these grounds:
- They didn’t create the record. If the information came from another provider, such as a specialist’s report or an outside lab result, they can direct you to the original source. The exception is when that original source is no longer available to act.
- The information isn’t in the designated record set. Records kept outside the files used for treatment decisions or billing aren’t subject to amendment.
- The record isn’t available for your inspection. Psychotherapy notes are the main example; anything you can’t access under HIPAA can’t be amended through this process.
- The record is accurate and complete as written. If the provider determines the existing entry is correct, they can deny the change.
Those four are the only grounds.1eCFR. 45 CFR 164.526 – Amendment of Protected Health Information Inconvenience isn’t one. Any denial must be in writing, use plain language, and state the specific basis.
If Your Request Is Denied
You can submit a written statement of disagreement explaining why you believe the record is wrong. The provider must accept it and permanently attach it to the disputed record, together with your original request, the denial, and any rebuttal the provider chooses to write.1eCFR. 45 CFR 164.526 – Amendment of Protected Health Information The provider can set a reasonable length limit on your statement, but cannot refuse to include it.
This matters more than it looks. Whenever the provider later shares the disputed information with another entity, your statement of disagreement (or an accurate summary of it) has to travel with it. Even if the underlying record doesn’t change, anyone who sees the information also sees that you contested it and why. If the provider writes a rebuttal, they must give you a copy.
Filing a Complaint with HHS
When a provider ignores your request, blows the deadline without a proper extension notice, or issues a denial that doesn’t meet the written-explanation requirements, you can file a complaint with the Office for Civil Rights at the U.S. Department of Health and Human Services. The complaint has to be filed within 180 days of when you became aware of the violation, though OCR can extend that for good cause.4eCFR. 45 CFR 160.306 – Complaints to the Secretary
Complaints can go through the OCR Complaint Portal online, by email to OCRComplaint@hhs.gov, or by mail. Name the provider, describe what happened, and explain how and when your rights were violated.5HHS.gov. How to File a Health Information Privacy or Security Complaint The written denial letter, if you received one, is your strongest supporting document, so keep a copy. Providers who ignore amendment rights face federal penalties, and mentioning that you know how to file an OCR complaint can be surprisingly effective when a response is overdue.6Office of the Law Revision Counsel. 42 USC 1320d-5 – General Penalty for Failure to Comply with Requirements and Standards
Errors in Records Your Provider Didn’t Create
This is where many amendment requests stall. If the mistake sits in a specialist’s note, an outside lab report, or hospital records forwarded to your primary care doctor, the current holder can send you back to the original source, and that’s a legitimate denial.1eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
The exception kicks in when the original source is no longer available: the practice closed, the physician retired, the lab shut down. If you can give a reasonable basis for believing the originator cannot act on the request, the current provider loses the ability to point elsewhere. Document why the original source is unavailable when you submit the request.
What Happens When an Amendment Is Accepted
Acceptance triggers more than one change. The provider has to identify every affected record in the designated record set and append or link the correction. They must tell you the amendment was made. You then get to identify other people and organizations that received the wrong information and need to know about the correction.1eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
The provider must then make reasonable efforts to share the corrected information with the people you named and with any business associates or other entities the provider knows have the wrong version and might rely on it to your detriment. If an incorrect allergy was sent to your pharmacy, the provider should notify the pharmacy. Think through where the bad information may have traveled, and name those recipients when the amendment is granted.
Requests on Behalf of Someone Who Has Died
HIPAA protects a deceased person’s health information for 50 years after the date of death. During that window, the personal representative of the estate — typically an executor or administrator under state law — can exercise the same amendment rights the patient would have had.7HHS.gov. Health Information of Deceased Individuals The same process, the same timeline, and the same four grounds for denial apply. You’ll need documentation of your legal authority to act for the estate.