HIPAA Amendment Requests in Behavioral Health: The 60-Day Clock and the Note Nobody Should Overwrite

A former client writes in asking you to remove an alcohol use disorder diagnosis from their chart. Another disputes a note saying they left against medical advice. A third says a group note attributes something to them that another client said. Each of these is a request to amend protected health information under HIPAA, and each one starts a federal clock the moment it reaches your program, whether it lands at the front desk, in a therapist’s inbox or in a portal message.

Most behavioral health programs have a workable process for records requests. Far fewer have one for amendment requests, and the gap usually shows up the same way: a clinician who wants to be helpful opens the original note and edits it. That single act turns a routine privacy request into a record-integrity problem that a payer auditor, a surveyor or a court can find in the EHR audit trail.

The 60-Day Rule in One Paragraph

Under the HIPAA Privacy Rule’s right to amend (45 CFR 164.526), a behavioral health program that receives a request to amend protected health information must act on it no later than 60 days after receipt, either by making the amendment or by sending a written denial, and it may extend that deadline only once, by no more than 30 days, if it notifies the individual in writing within the original 60 days of the reason for the delay and the date it will complete its action. Accepting an amendment means appending or linking the correction to the affected record, not deleting or rewriting the original entry, and the program must make reasonable efforts to notify people the individual identifies and business associates who hold the information and may rely on it.

The full text sits in the electronic Code of Federal Regulations, and HHS summarizes the individual rights framework in its Summary of the HIPAA Privacy Rule. This post is operational guidance, not legal advice, and state law or payer contracts may impose stricter terms.

Why Amendment Requests Go Wrong in Behavioral Health

The rule is short. The failures come from staffing and record design. These are the patterns we see most often in program privacy files:

• No intake point: requests arrive by email, phone, letter and portal message, and nobody logs the receipt date that starts the 60-day clock.
• Clinician-level editing: the treating clinician “fixes” the note directly, which overwrites the original and leaves a modification stamp dated weeks after the service.
• Diagnosis disputes treated as clinical arguments: staff debate whether the diagnosis was right instead of applying the regulatory test of whether the record is accurate and complete.
• Psychotherapy notes confusion: programs either refuse every request by citing psychotherapy notes, or they treat separately kept process notes as ordinary chart content, and both mistakes create exposure.
• Missing denial elements: denial letters go out as a two-line email with none of the required content, so the individual has no path to disagree and the program has no defensible record.

What Accepting an Amendment Actually Requires

When the program agrees the information is inaccurate or incomplete, the rule asks for three things. First, identify the records in the designated record set that are affected and append or link the amendment to them. The original entry stays. In most EHRs that means a late-entry addendum or an amendment note tied to the original encounter, clearly dated on the day it was written and labeled as an amendment made at the client’s request.

Second, tell the individual in writing, within the deadline, that the amendment was accepted, and get their agreement to notify the relevant people. Third, make reasonable efforts to send the amendment to people the individual names as having received the information, and to persons, including business associates, that you know have the information and may have relied on it, or could foreseeably rely on it, to the individual’s detriment.

In practice, that third step is where the real work sits. A diagnosis that has been disputed and amended has usually already been sent to a payer on a claim, to a step-down provider on a referral, and possibly to a billing vendor. Your amendment file should show who received the original and what you sent them.

When You Can Deny, and What the Letter Must Say

The rule allows denial on limited grounds: the information was not created by your program (unless the originator is no longer available to act on the request), it is not part of the designated record set, it would not be available for inspection under the HIPAA right of access, or it is accurate and complete. That fourth ground carries most behavioral health denials. A clinician’s documented assessment of what they observed and concluded on a given date can be accurate and complete even when the client disagrees with it.

The psychotherapy notes ground is narrower than many programs assume. It applies only to notes that meet the Privacy Rule’s definition and are kept separate from the rest of the record. Progress notes, diagnoses, medication records, treatment plans and session start and stop times are not psychotherapy notes.

A denial must be written in plain language and must include the basis for the denial, the individual’s right to submit a written statement of disagreement and how to file it, a statement that if they do not submit one they can ask you to include the request and the denial with future disclosures of the information, and how to complain to your program and to the Secretary of HHS, including the name or title and phone number of your contact. HHS’s Office for Civil Rights complaint portal is the reference to give. If the client files a statement of disagreement, you may prepare a written rebuttal, must provide a copy of that rebuttal to them, and must then link the request, denial, statement and any rebuttal to the record so they travel with future disclosures.

The Inconvenient Truth About Audit Trails

Every modern EHR keeps an audit trail of who changed what and when. When a clinician edits a six-month-old progress note to remove a diagnosis, the claim that was paid on the original version now rests on documentation that no longer matches what was billed. If that chart is later pulled in a payer audit or a records subpoena, the reviewer sees a substantive change made long after the date of service with no amendment label and no request on file. That pattern looks like after-the-fact alteration even when the motive was to help the client.

A properly handled amendment produces the opposite picture: the original note unchanged, a dated amendment linked to it, the written request, the decision letter and a notification log. The client gets the correction they were entitled to, and the record stays defensible. If you are not sure your EHR can create a linked amendment without overwriting, test it this week on a training chart before a real request forces the question.

Build the Amendment File Today

You need a single owner and a short checklist, not a new system. Do these five things this week:

1. Name the owner in writing. The rule requires you to document the titles of the persons or offices responsible for receiving and processing amendment requests. Pull your privacy policy today and check that the title is there.
2. Create one intake log. Columns for receipt date, day 60, extension letter date if used, extended deadline, decision, decision letter date and notification sent. Put day 60 in the privacy officer’s calendar the day a request arrives.
3. Lock the edit path. Instruct clinical staff that amendment requests go to the privacy officer and are never resolved by editing a signed note. Confirm in your EHR which roles can modify signed documentation.
4. Draft the two template letters. One acceptance letter and one denial letter containing every required element above, reviewed by counsel once and reused.
5. Check your Notice of Privacy Practices. It must describe the right to amend. Confirm that the description and the contact listed match the process you just built.

Keep the request, your response, any statement of disagreement and rebuttal, and the notification log together. HIPAA documentation requirements call for retaining required documentation for six years, and your state’s record retention rules may run longer. Our HIPAA compliance checklist covers where this file sits alongside the rest of your privacy program.

Where Circa Behavioral Fits

Our compliance services team reviews individual-rights processes as part of privacy program assessments, and a fractional compliance officer can own the intake log, the deadline calendar and the letter templates so the 60-day clock never depends on a clinician remembering it. Call us at (888) 458-6619 to talk through your current process.

If a request is already sitting in an inbox, count from the date it was received, not the date someone noticed it. Past day 45 with no decision? Send the extension letter now. For help with a pending request, call (888) 458-6619.