Description
Amendment and Access Request Retention Log
HIPAA Privacy Rule — 45 CFR 164.524, 164.526, 164.530(j) | Editable Word Template
The HIPAA Privacy Rule gives individuals the right to access their protected health information and the right to request amendments to records they believe are inaccurate or incomplete. Covered entities are required to act on those requests within defined timeframes, document their responses, and retain that documentation for a minimum of six years under 45 CFR 164.530(j). The Amendment and Access Request Retention Log provides a structured record for tracking every request received, the action taken, and the outcome organized for both operational use and long-term retention.
Maintaining this log as a matter of routine practice gives covered entities an immediate reference point when an individual follows up on a prior request, a clear record if a complaint is filed with the HHS Office for Civil Rights, and the documentation needed to demonstrate that individual rights requests are being handled consistently and within the required timeframes.
What Is Included
- Pre-formatted log table with separate sections for access requests and amendment requests, with fields for request date, individual name, nature of the request, assigned staff member, response deadline, action taken, date of response, and outcome
- Access request section with status fields aligned to the 30-day response requirement and 30-day extension option under 45 CFR 164.524(b)(2), including fields for tracking whether access was granted, partially granted, or denied with reason
- Amendment request section with status fields aligned to the 60-day response requirement under 45 CFR 164.526(b)(2), including fields for tracking whether the amendment was accepted or denied and the basis for any denial
- Denial documentation reference field for linking to the written denial letter retained separately in the compliance file
- Appeal or complaint field for noting any follow-up from the individual, including complaints filed with HHS
- Retention reminder consistent with the six-year documentation requirement under 45 CFR 164.530(j)
- Instructions for use including guidance on response deadline calculation and cross-reference to the Record Retention Schedule
Who This Is For
Privacy officers, medical records managers, compliance staff, and practice administrators at covered entities who receive and respond to individual rights requests. Useful for organizations of any size that handle patient access or amendment requests on an ongoing basis and need a reliable method for tracking and retaining that activity.
Delivered as an editable Microsoft Word (.docx) file. Available immediately after purchase.
