Making HIPAA Work for Consumers: Teaching How and Why to Access Health Records

By Mary Butler

The old proverb “Give a man a fish, and you feed him for a day; Teach a man to fish, and you feed him for a lifetime” rings true for consumers and the release of their health information. With laws like HIPAA and the advent of patient portals, it has never been easier for consumers to access their personal health information. But in order to reap the many benefits that come with this information, many consumers first need instruction on how to use tools like HIPAA and portals to land their records. This is where health information management (HIM) comes in.

Take for example Children’s Health System of Texas (formerly Children’s Medical Center), who five years ago participated in a pilot project where the families of children with sickle cell disease were given iPhones equipped with a personal health record (PHR) app. The pilot project, sponsored by the Office of the National Coordinator for Health IT (ONC), focused on families that lived at a distance from Children’s Health—a population for whom the need to share health information with multiple providers is paramount.

The HIM team at Children’s Health, which was responsible for implementing and overseeing the program, said some of the most tangible results of the pilot included an increase in patient satisfaction scores and improvement in medication adherence. The PHR was programmed to send medication reminders to patients and families—a key to managing symptoms of the disease. Failure to manage medications can lead to a sickle cell crisis, which includes excruciating, immobilizing pain.

“In the first few months, patient satisfaction with their ability to access their data rose from 43 percent to 100 percent and I think that’s huge,” says Michelle Basco, RHIA, an HIM training consultant at Children’s Health.

Perhaps more importantly, giving patients and families such immediate and thorough access to needed health information gave them peace of mind when interacting with providers. And as with any other health condition, when patients can see their information and better understand it they are in a better position to advocate for themselves. For example, when family members want access to a record that’s unavailable—such as an immunization or a specific test result—they contact Basco and she pushes it to the PHR.

The mother of one sickle cell patient told Basco that when she was finally able to get records on her phone and showed it to another provider, she felt “a sense of credibility,” Basco says. “She loved that she had this information on her phone and it gave her more of a sense of control.”

This mother is experiencing the benefits of being an engaged patient—a reality that AHIMA has been working to replicate by emphasizing patient engagement as a strategic pillar of the association. One of AHIMA’s stated goals is to “connect consumers to their health information.”

As part of this goal, AHIMA aims to “partner with others to directly reach consumers; educate consumers and ensure they understand their rights relative to accessing health information; [and] become recognized as the ‘trusted voice’ across the health information environment.”

The task of educating consumers on their right to health information often falls to HIM professionals. Consumer access to information has become a hot topic in the healthcare industry, with ONC recently stepping up their consumer-facing advocacy efforts. At the end of 2016, ONC launched a series of blog posts and accompanying fact sheets it hoped would clarify the rights and prohibitions granted by HIPAA for both consumers and release of information/HIM professionals. ONC officials were quoted in the material saying that HIPAA is often mistakenly blamed for slowing up information exchange and preventing patients from accessing their medical information—and that some providers were still not sharing personal health information (PHI) due to their healthcare organization’s policies and procedures, even if the sharing was permitted under HIPAA. And just this past December, the Office for Civil Rights (OCR) released a new fact sheet helping patients understand why their information is being collected as well as re-emphasizing ways patients have access to their own electronic data. 

AHIMA is also playing a role in pushing HIM professionals into more comprehensive patient engagement activities. During the spring of 2017, AHIMA’s Privacy and Security Practice Council has plans to develop a form that will educate patients in plain language on their rights and allow them to sign and authorize the release of information to approved parties. This will be an accompaniment to the required HIPAA form—helping people understand what the form is, who it goes to, where it comes from, and what it does. The group expects the form to be finished in July.

HIM professionals now have more resources available with which to engage and educate patients, although those resources might come with limitations. And with more patients gaining access to care through insurance exchanges and other reforms, HIM is poised to make a huge impact on the patient experience.

HIPAA Fact Sheets Help Consumers, Providers

It’s not uncommon for consumers to be confused about how HIPAA actually applies to them. For example, HIM Consultant Becky Buegel, RHIA, CHP, CDIP, CHC, says she’s seen consumer-facing articles erroneously assert that employers violate their workers’ HIPAA rights if they share personal medical information about someone with colleagues. While this may indeed be unethical, it’s not strictly a HIPAA violation, since HIPAA only applies to covered entities, such as hospitals, physicians, health plans, and clearinghouses.

To help clear up HIPAA misconceptions, the Office of the National Coordinator for Health IT (ONC) and the Office for Civil Rights (OCR) late last year released a series of blog posts and fact sheets “explaining how providers are permitted to share electronic protected health information (PHI) with public health agencies without obtaining an individual’s written authorization,” wrote Lucia Savage, JD, then the chief privacy officer at ONC, and Matthew Penn, JD, director, Public Health Law Program, Centers for Disease Control and Prevention (CDC), in a December blog post.

The fact sheets cover scenarios in which health information is collected or shared to monitor, prevent, and track disease and vital statistics, such as birth and death records. There’s also a fact sheet outlining the reasons electronic health information is exchanged to support healthcare operations. Some of those purposes include: conducting quality assessment and improvement activities, developing clinical guidelines, care coordination and management planning, and training and credentialing activities.

These fact sheets follow the mid-year release of ONC’s Patient Engagement Playbook, a tool targeted to providers. The Playbook is a compilation of best practices surrounding release of information, patient portal enrollment, and tips for navigating state and federal regulations over caregiver or proxy access to patient information. To read the ONC blog post and fact sheets, visit For the Patient Engagement Playbook, visit

Barriers to Patient Engagement 

For all of the recent advances in patient portals, PHRs, mobile health apps, and electronic health records (EHRs), there are still substantial chunks of the patient population who are not as involved in their own healthcare decisions as they could be.

Laura Abel, RHIT, the HIM program director for ECPI-University Online Campus’s Internet-based program, has previously worked in long-term care, mental health, and prisons. There are several patient populations that still need more education and outreach about their rights, Abel says. One of these populations is senior citizens.

“The older population really is not aware of what they can do [to access information]. They’re not tech savvy most of the time and might not have the opportunity to go on a computer and do the portal. They would have to know, first of all, that it’s available, and that they could designate someone to help them with that process—especially if they don’t have a computer,” Abel says.

Not only is it hard to reach seniors on an outpatient basis, it can also be difficult in nursing homes and assisted living facilities. These providers don’t necessarily hire many people with HIM backgrounds, so there can be confusion about what information can be released and to whom it can be released.

To overcome the challenges of educating seniors, Becky Buegel, RHIA, CHP, CDIP, CHC, who runs her own HIM consulting company called A*S*K, has been working with her state association, the Arizona Health Information Management Association (AzHIMA), on strategies focused on this population.

Buegel says AzHIMA has asked college students working on their professional practice experience to design PowerPoint templates outlining all of the rights patients are granted under HIPAA. The hope is that they will turn the PowerPoint templates into presentations they can take “on the road” to senior living and retirement communities.

“We have to be very careful since we can’t offer medical advice—we can’t tell them what to do with medical care, but we can say ‘Here’s how you can talk to your doctor. Here’s how to ask questions. Make sure your doctor knows about your medications,’” Buegel says.

Providers too often fail seniors when it comes to preparing them for end of life decision making and providing information, Buegel says. For example, hospitals are required by law to inquire whether a patient has an advance directive, but when faced with questions about the difference between advance directives and durable power of attorney for healthcare, providers too often hand patients a pamphlet and leave it at that. This is just another area where HIM professionals are the experts, and where they should intervene in order to provide patients with facts and support, especially since laws and terminology can vary by state.

While many patients have gotten the message that they do have access to their information, there’s still confusion about what they have access to, says LeAnne Bouma, RHIA, director of release of information at Sanford Health, in Sioux Falls, SD.

“The biggest challenge we deal with is the belief that because it’s electronic we can push a button and it’s there and done—that somebody can walk in the door and say: ‘I want a copy of my records,’ and we can push that button and have the records right at that moment,” Bouma says. “We still have to verify that this is truly the patient, this is truly their record, this is the information they want, and pull that together.”

And it’s not just patients who are confused about what can be released—insurance companies, attorneys, and other requesters can come to HIM departments with a set of expectations that don’t match reality. 

For instance, Buegel says that once when she worked as a privacy officer at a hospital, the radiology department was implementing a digitized imaging system that would also do automated appointment scheduling. “Someone from the company selling this product was telling the radiology people that IT at that hospital, by virtue of this new system, was going to be the keeper of the record and they were in control of all of this. I hit the roof,” Buegel says. “It was like, ‘Come on, what makes you think that IT should be releasing anything related to a patient record.’”

Common Misconceptions About ROI

The following is a list of common misconceptions consumers have about accessing their health records, according to AHIMA’s HIM experts.

  • HIM is a 24/7 operation where record requests can happen at any moment. (Fact: While the patient portal is accessible around the clock, in-person requests by consumers for records typically can only take place during posted ROI/HIM hours.)
  • All health information is electronic and easily accessible. (Fact: This is not the case in many facilities, where the patient record is composed of information collected from various health IT systems, devices, and areas.)
  • Electronic and paper health information is easily exchanged between different healthcare organizations and physicians. (Fact: Interoperability is a major problem for healthcare, one that makes it difficult to exchange health records between disparate systems and providers.)
  • The EHR typically can produce an easy-to-read printout of records. (Fact: They usually cannot; printing issues are common in terms of producing a human-readable copy of information.)
  • A patient can get their complete medical record after discharge/on the way out of the doctor’s office. (Fact: It’s a common challenge to get timely information from some physicians—who don’t get documentation done until after discharge, for example, meaning a patient can’t leave a visit with a full write-up.)
  • Accessing the patient portal or requesting one’s “medical records” gets a person their complete record—every piece of paper/document. (Fact: This is not what happens and is not realistic—which should be stressed by HIM to patients/consumers when the opportunity presents itself. Also, despite the law sometimes physicians are reluctant to give patients copies, or the front desk/ROI staff might not know what they are allowed to give and when to consumers.)
  • It is cheap and easy to provide copies of records, so they should be free. (Fact: There are cost implications to creating a copy of a medical record, which can get quite large in some cases. Facility policy and state law usually dictate how much providers can charge for records.)

Best Practices for Patient Engagement

There’s broad agreement among HIM professionals that they can and should take leadership roles in their organizations to spearhead patient engagement efforts. They are the ones, after all, responsible for implementing EHRs, managing patient portals, overseeing release of information, protecting patient privacy, and making amendments to records when an error is found. However, due to the nature of their work, they are often hidden from a patient’s view. Patients are most likely to learn about EHRs and patient portals from their primary care physician or from their physician’s front office staff. 

“If you’re in an office setting, you’re going to get the information from the clerk because HIM professionals—unfortunately or fortunately—work either in the office manager role or in the billing area just keeping the whole office going. There isn’t a lot of opportunity for the HIM professionals specifically to engage in an office situation,” Abel says.

The best way to reach more patients then, according to Abel, is approaching them when they’ve been admitted to the hospital. Abel has seen this strategy used when her students have done internships in hospitals, and the HIM students introduce patients to their portal. Students would go into patient rooms equipped with written instructions as well as an iPad to help walk a patient through the login process. This is a good option for hospitals that don’t have the budget to dedicate a full-time staff member to patient advocacy or patient engagement.

Building on the lessons learned from their pilot project with ONC, the HIM staff at Children’s Health have been very proactive in getting their patients and families set up with their patient portals and PHRs. One thing they learned from the pilot, Basco says, is that while some families don’t have access to a computer almost all of them at least have access to a smartphone. Now every single time a patient asks for any kind of record, someone from HIM asks if they would be interested in getting a PHR and having all of their information available electronically.

“It’s important to meet with your patient and have the conversation. As an HIM professional it might make sense and be logical to us [to use a PHR], but sometimes [patients] don’t always see that. We need to explain the benefits. More than that, they just need to know how to do it. It’s just not that intuitive,” Basco says. “It’s really helpful to get their hands on a demonstration of the PHR—to see where to click to message the provider, get test results, make an appointment. That’s really important. You’re going to learn and they’ll learn along with you.”

But Basco and her team don’t just wait for patients to come to them to start the PHR enrollment process, they go directly to the patients wherever they are. The HIM department regularly sends the members of its small staff into lobbies and waiting rooms—anywhere families have downtime—to recruit more PHR subscribers. Basco and her team also give presentations to other departments about the portal and trained a group of volunteers from people throughout the organization on the portal and PHR.

When Children’s Health acquired a new 39-bed facility last year, the HIM department made a concerted effort to get patients there enrolled in the portal. The average length of stay in that facility is 21 days, which results in a health record that’s quite large and unwieldy for parents to take with them wherever they go. So the HIM department runs a report each week to determine which patients of that clinic are not enrolled in the portal—they then call the patients who are not signed up to see if they are interested. Pretty soon, clinical staff started approaching HIM staff because their patients wanted to sign up once they found out about it.

“Since it’s such a small facility, all the same parents sit in the same cafeterias and waiting areas and they talk. So they approached us. It was wonderful—we didn’t have to be the only advocates because other people experienced the benefits and promoted it as well,” Basco says.

Mary Butler ( is associate editor at the Journal of AHIMA.

Article citation:
Butler, Mary. "Making HIPAA Work for Consumers: Teaching How and Why to Access Health Records" Journal of AHIMA 88, no.3 (March 2017): 14-17.