When the Department of Health Care Services (DHS) receives a complaint from a recipient indicating that a Medi-Cal provider is not complying with the Health Insurance Portability and Accountability Act (HIPAA) Privacy regulations, DHS will send a letter to the provider restating their obligation to comply with all the HIPAA Privacy regulations, particularly with access to records.

The HIPAA Privacy Rule mandates that individuals have the right to request access to inspect and obtain a copy of their own Protected Health Information (PHI) for as long as such PHI is maintained. The Privacy Rule also lists other specific rights guaranteed to patients of covered providers.

A signed Provider Agreement Form (DHS 6208) specifies that a provider agrees to be compliant with all federal laws and regulations governing Medicaid providers. If a provider engages in one of the HIPAA covered transactions, such as electronic billing, the HIPAA Privacy Rule is applicable. As a Medi-Cal provider governed by federal regulations, recipients must be given access to their medical records upon request in order to remain in compliance with the law. In addition to this federal regulation, California law also requires providers to give patients access to their medical records. See California Health and Safety Code, Section 123100 et seq. for more information.

DHS will refer any privacy complaint to other regulatory agencies that have authority in this area. This explanation is an attempt to clarify the relationship between providers and DHS with regard to HIPAA Privacy regulations. If there are further questions regarding this matter, contact Roberta M. Ward, Senior Counsel and Privacy Officer, at (916) 440-7750.

If you cannot view the MS Word or PDF (Portable Document Format) documents correctly, please visit the Web Tool Box to link to a download site for the appropriate reader.