Guide

Amendment requests: agree, deny, or annotate

Summary

When a patient asks you to change their record, HIPAA gives you three moves, not one: agree and amend, deny with a written reason, or — if they disagree with your denial — let them file a statement you attach to the chart. An amendment is never a deletion; you add a correction and keep the original. You have sixty days to respond, and denials must be in writing on specific grounds.

By Gale Editorial · Updated 2026-07-26. Every figure cited to a dated source. How we write.

The amendment right — and why it is never a deletion

A HIPAA amendment request is a patient asking you to correct or add to their protected health information in the designated record set — the records you use to make decisions about them. The right does not let a patient force a change to accurate information, and it is not a deletion: you never erase the original entry 1Ref 1HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the amendment right is one of the individual rights the Privacy Rule grants patients over their protected health information.2Ref 2Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The amendment mechanics in 45 CFR Part 164 — the 60-day clock, the four grounds for denial, and the statement-of-disagreement process that attaches disputes to the record.. An amendment adds a correction; the record keeps its history.

This is a cousin of the right of access — the same designated record set defines both — but a distinct right 3Ref 3HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.The designated record set and right of access, used here to define the scope of amendable records and one of the denial grounds.. Access is about getting a copy of what is in the chart; amendment is about disputing what the chart says. Because the record is a legal document, the answer to a valid amendment is layering a correction on top, not rewriting the past.

Your three moves: agree, deny, or annotate

Every amendment request resolves to one of three responses, and the rule expects you to pick deliberately. You can agree and make the amendment; you can deny it, in writing, on one of four specific grounds; or, when you deny, the patient can file a statement of disagreement that you attach to the record. Note the third is not really your move — it is the patient's response to your denial, and you must accommodate it.

You may require the request in writing and ask for a reason, as long as you tell patients about that requirement in advance. Beyond that, the choice is agree, deny, or annotate — and each has its own follow-through the rule spells out.

When you agree: correct without overwriting

When you agree — the information really is wrong or incomplete — make the amendment by adding a dated correction that links to the disputed entry, not by overwriting it. Then tell the patient you made it, and make reasonable efforts to inform the people the patient names and anyone you know is relying on the flawed information, so the correction actually reaches them.

If a business associate — your EHR vendor, a prior billing service, an outside records system — also holds the record, the amendment should propagate there too; your business associate agreement and your own follow-up are what make that happen 4Ref 4HHS Office for Civil Rights (2026).Business Associates.That where a business associate also holds the record, an amendment should propagate to it, and reasonable efforts must reach those who rely on the information.. An amendment that lives in only one copy of a record spread across several systems has not really been made.

When you deny: the four grounds

You may deny an amendment, and denying an accurate record is not obstruction — it is the rule working as designed. Four grounds justify a denial: you did not create the information (unless its originator is no longer available), the information is not part of the designated record set, it would not be available to the patient under the access right, or it is already accurate and complete 2Ref 2Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The amendment mechanics in 45 CFR Part 164 — the 60-day clock, the four grounds for denial, and the statement-of-disagreement process that attaches disputes to the record.. Any other reason is not a valid denial.

A denial has to be in writing and in plain language. It must state the basis for the denial, tell the patient they may submit a statement of disagreement, and explain how to complain — both to your practice and to HHS. A denial that skips these elements is a procedural violation even if the underlying decision to deny was correct.

The statement of disagreement and your rebuttal

If you deny, the patient can submit a statement of disagreement — their written account of why they think the record is wrong. You may write a rebuttal and must give the patient a copy. From then on, the amendment request, your denial, the statement, and any rebuttal are appended to or linked with the disputed record, and they travel with it in future disclosures 2Ref 2Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The amendment mechanics in 45 CFR Part 164 — the 60-day clock, the four grounds for denial, and the statement-of-disagreement process that attaches disputes to the record..

Because the materials travel with the record, they follow it into a later disclosure — a response to the subpoena, or to law enforcement requests — so a future reader sees the dispute, not just your original entry. You may reasonably limit the length of a statement of disagreement, but you cannot refuse to attach one after a denial.

Who can ask, the clock, and getting it wrong

A patient can request an amendment, and so can the personal representative who controls their record — a parent for most minor records, a guardian, a healthcare agent 5Ref 5HHS Office for Civil Rights (2026).Personal Representatives.That a personal representative may request an amendment on the individual's behalf and is treated as the individual.. You have sixty days to act, with one thirty-day extension if you notify the patient in writing of the reason and a completion date. Calendar the deadline the day the request lands, because a silent, blown clock is itself a violation.

Botched individual-rights responses are exactly what OCR has pursued in very small practices, not only large systems, and its access enforcement has kept individual rights under a bright light 6Ref 6HHS Office for Civil Rights (2026).HIPAA Compliance and Enforcement.That OCR enforces individual-rights obligations, including against very small practices, and has kept individual rights under active enforcement attention.. Handling amendments as routine, documented work — a template denial letter, a place in the chart for the statement of disagreement, a tickler for the sixty days — is what keeps a one-person practice on the right side of this rule.

Common questions

No. A HIPAA amendment never means deletion. Even when you agree the information is wrong, you correct it by adding a dated addendum that links to the original entry — you do not erase the original. The medical record is a legal document, and its history has to remain intact. If you agree, the correction stands alongside the original; if you deny, the patient's disagreement attaches instead.

Four. You did not create the information and its originator is still available to handle the request; the information is not part of the designated record set; it would not be available to the patient under the right of access; or it is already accurate and complete. A denial has to rest on one of these, be in writing and plain language, and tell the patient how to respond.

Sixty days from the request, with one thirty-day extension if you give the patient a written reason and a completion date. Whether you agree or deny, the response has to come inside that window. Missing the clock — going silent — is itself a failure to honor the right, so calendar the deadline the moment the request arrives and treat it as a hard date.

When you deny an amendment, the patient may submit a written statement of disagreement explaining why they believe the record is wrong. You can write a rebuttal and must give them a copy. The request, your denial, their statement, and your rebuttal then attach to the disputed record and are included whenever that record is later disclosed, so the dispute follows the chart.

They can request it, but you are not required to change an entry that is accurate and complete — that is a valid ground for denial. A patient can dispute a diagnosis, and you can decline to alter it while still honoring their right to file a statement of disagreement. Amendment corrects errors of fact; it does not compel you to adopt the patient's clinical opinion.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.HHS Office for Civil Rights (2026). Summary of the HIPAA Privacy Rule. U.S. Department of Health and Human Services. linkThat the amendment right is one of the individual rights the Privacy Rule grants patients over their protected health information.
2.Office of the Federal Register (2026). 45 CFR Part 164 — Security and Privacy. eCFR. link ✓The amendment mechanics in 45 CFR Part 164 — the 60-day clock, the four grounds for denial, and the statement-of-disagreement process that attaches disputes to the record.
3.HHS Office for Civil Rights (2026). Individuals' Right under HIPAA to Access their Health Information. U.S. Department of Health and Human Services. linkThe designated record set and right of access, used here to define the scope of amendable records and one of the denial grounds.
4.HHS Office for Civil Rights (2026). Business Associates. U.S. Department of Health and Human Services. linkThat where a business associate also holds the record, an amendment should propagate to it, and reasonable efforts must reach those who rely on the information.
5.HHS Office for Civil Rights (2026). Personal Representatives. U.S. Department of Health and Human Services. linkThat a personal representative may request an amendment on the individual's behalf and is treated as the individual.
6.HHS Office for Civil Rights (2026). HIPAA Compliance and Enforcement. U.S. Department of Health and Human Services. linkThat OCR enforces individual-rights obligations, including against very small practices, and has kept individual rights under active enforcement attention.

https://www.gale.care/for-providers/hip-amendment-requests · 6 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers