Darrell Rebouche (Host): Today on Health on Point, presented by Willis-Knighton Health, we're diving into a part of healthcare that affects every patient, every visit, and every decision: your medical records. Most people know they exist, but few truly understand their rights when it comes to accessing, correcting, protecting, and sharing their health information.

Now, there are patient portals. There are all kind of things. What are your rights and responsibilities? Well, our guest today on Health on Point, Kim Norton, knows. She is the Director of Health Information Management. She is a registered health information administrator from Willis-Knighton Health. Kim, thank you for being with us.

Kimberly Norton: Thank you for having me

Host: What are the most common misconceptions people have when they approach you or your staff about their medical records?

Kimberly Norton: Well, one of the most common misconceptions is that patients think that they just outright own the rights to their medical record in total. But under HIPAA, that's not actually true. The facility, the provider, the clinic actually owns the right to the physical property of the medical record, meaning the paper form or the electronic format.

But the information that's within the paper, that's in the EMR, actually belongs to the patient. So actually, it's a joint ownership, I guess you could say, between the facility and the patient with the data belonging to the patient. And as far as access, just because an employee is hired or works within a facility does not mean that they will have access to a patient's record. All patients' information is highly confidential, and access is only given on a need-to-know basis.

Host: Okay. I want to clear that up a little bit. So, you have people who come to you and want to physically take their medical records and not leave some behind. They think they own them and they can just take them from the healthcare institution. And also, you have employers who want to access their employees' medical records and they think they can. Is that what you're saying?

Kimberly Norton: No. Just in general, patients think that if they know somebody that works at a hospital, for instance, "Well, I don't want them looking at my records." Well, they're not going to. They don't have access, that kind of thing. So yeah, just because someone works within a facility does not mean that they will have access to a patient's records. It's on a need-to-know basis.

Host: Very good distinction. I think that's a great reassurance for people. Just to clear that up, you think that there are some people who are concerned that maybe they have an ex or someone who can—because they work... All right. Well, no. Okay. To those of us who work in healthcare, that seems obvious. But I guess to the average person, it's not.

Kimberly Norton: Exactly. We do have those concerns when patients, they call up with those concerns. But to put it to rest, everyone does not have rights or access to your medical record.

Host: Well, that is very reassuring. So, this is a very broad question, but I'll ask it anyway. What are the patient's and the patient's family's legal rights to their medical records? How do you define those?

Kimberly Norton: Okay. Well, the patient's legal rights is that they have a right to view their documents, their records. They have the right to request copies. They have the right to make authorization for us to send copies to anyone of their choosing, whether it be a family friend, an attorney, another physician. They have those rights. They also have the rights to request amendments and corrections to their medical record. So, all of those things they have control of.

Host: How can people share this information or the portions of the information they want to share with either their family members or their other healthcare providers? There's got to be more than one mechanism for that.

Kimberly Norton: Oh, yes. There's several ways. The first way would be for the patient to fill out a medical record release form. They would take that form, fill it out, turn it in to the release of information department, and they can put on there any person that they choose, whoever. Like I said earlier, they can send it to an attorney. They can send it to their son that's a doctor in Minnesota. They can send it for other physicians. So, that's the first way, filling out a authorization form and designating who they would like to receive that information. If a patient has a portal, they can set up a proxy, and that proxy will have access themselves to log on to that patient's portal and review the information in its entirety. But that access has to be granted by the patient.

Then, there's a medical power of attorney. It's slightly different than a regular power of attorney. With the medical power of attorney, a person, an individual has the right to request the record. They have the right to request that the records be sent places. They also have the right to request amendments.

And then, I would say probably the most common way is for the patient just to receive a copy of the record themselves. And then, they can make a copy of it, as many copies as they would like, and they can give those copies to whomever they like. And that would probably be one of the most common ways to share.

Host: I do want to dive into that patient portal you briefly mentioned, and we'll certainly get to that in a few minutes. But when we're talking about people getting access to their medical records, taking them, disseminating them, I suspect a lot of people also are concerned about protecting their privacy. And it feels like that's going to be a challenge sometimes when you start getting all these copies out there in the universe. So, how does that play into the process?

Kimberly Norton: Once we've released a record to you, the patient, then the privacy on our part is kind of over. So what you do with it after that, after it's in your possession will remain on the patient, you know, whoever they give it to. We won't have any say so of who the patient gives it to after we've released it to them.

Host: So, that's when you make the transition from rights to responsibilities. They have the right to those medical records, but then once they access those medical records, they have the responsibility to make sure they manage them in a way that they're happy with.

Kimberly Norton: Right. Not to leave them at McDonald's or something like that, you know? Try to be careful.

Host: Let's not do that.

Kimberly Norton: Exactly.

Host: When a patient, a loved one, a family member passes away, that kind of changes the dynamic, doesn't it? So, when people respectfully ask for the medical records—for whatever reason they may be—for someone who has passed away, how is that different from asking for your own? And in under what circumstances do people ask for the medical records of a deceased loved one?

Kimberly Norton: Well, that's a good question. First off, whether alive or deceased, all medical information is strictly confidential. But in the event of a deceased relative, we usually work with the legal representative of the deceased, and that's usually the administrator of the estate or the executor that's listed on the death certificate. That individual will be able to work on the deceased's behalf, and they can request copies as well and request amendments. They can also authorize that records be sent to individuals of their choosing.

And we often get people who want records, sometimes they just want to know what happened or what all was wrong with mom, what was wrong with dad, or they may be consulting with lawyers, who knows. But those are really a lot of the reasons, and mostly is that they just want to know. They want to read for themselves what went on. Or maybe it's an issue, a genetic issue, and they're concerned that what mom had, they may one day get. So, that way, they'll have their parents' medical information. So, those are the reasons usually why people request records on the deceased.

Host: Trust me, once you get older, your family medical history becomes really, really important to you. So, you want to have access to that. You've mentioned a couple of times, correcting the medical record. So, I'm interested, how do people discover something that may be incorrect? How do they know it's incorrect? How do they verify that? What's their responsibility? What is the mechanism for correcting the medical record? And what is the health system's responsibility with respect to making sure those corrections are valid?

Kimberly Norton: This is something that we get quite often. Patients usually when they request to view their medical records, they've obtained a copy or if they've looked at it on the portal, they'll see something that's just not right. And it's not always something just really serious. It could be, "Well, the doctor said that my left arm was hurting, but it was actually my right," or, "My attorney needs my records. I was in an accident and the ER physician said I was in the driver's seat, but I was actually a passenger." Things of that nature.

So when they see those things and they need corrections, all they got to do is just contact the Health Information Management Department at any Willis-Knighton. And we can get a medical record amendment form out to them. They can either come and pick it up, we can email it to them, we can mail it to them, and they would fill that out. Once it's returned to us, we will review it. We will determine who will need to review it for corrections, meaning what physician, what clinician made the documentation or made the error.

So, we would at that time give it to them for review. They'll review it. And if they agree with the amendment, they'll make the appropriate changes and update the medical record. Now, the patient will be notified that the corrections have been made. They'll be given a new copy of the corrected document.

But regardless of the physician's decision, whether they agree to the amendment or they don't agree, that medical record form will remain a permanent part of the patient's medical record, meaning it's up for disclosure. So if there's a release for that particular account, that form will be released as well. And then, along with that, I can add that there is an appeal process. Let's say, for instance, you didn't get the answer that you wanted, the patient can do an appeal and it can be reviewed again. And all of these amendment forms do go through the compliance officer before signing off and we're scanning them into the permanent medical record.

Host: Kim, that is a lot. That is a lot. I have a really technical question for you. So once these amendments are made, is there like a track changes like you would see maybe in a Word document? I mean, do you see that here is the original information, and at the request of the patient or the family, and at the verification of these various people, these changes have been made. So, are the changes like an addendum to the record, or are they overwritten?

Kimberly Norton: Yes. Yes. Usually, it's an addendum to the record. The physician will make the appropriate changes on the document, just amending and letting us know what was correct and what he entered that was incorrect.

Host: Okay. You're listening to and watching Health on Point, presented by Willis-Knighton Health. I'm Darrell Rabouché, your host.

Our guest is Kim Norton. She is a registered health information administrator at Willis-Knighton Health. And we've promised to dive into digital records, patient portal. On everybody's phone or tablet now, there's a health app. I know insurance providers have apps. And now, patients have these portals, and I think the utilization rate of these patient portals is still growing. and just kinda give everybody an overview of what a patient portal is, How do you get it? How does it work? And how does it work to your advantage?

Kimberly Norton: Okay. Well, patient portals, apps, everything, like you said, everything has an app. You have an app to order food, you have an app to buy movie tickets. So quite, naturally, you would have one for healthcare. So, these apps and portals, patients can use them. It actually contains patient information. It's a great way for patients to track and see what's being written about them, what's going on with them, to see how their care is going, what the doctors are documenting.

And so, a lot of times what'll happen is patients will receive a notification of some sort, letting them know, "Hey, you've got something new that's been uploaded into your portal." And at that time, they can go on and check it out and see if it's accurate information. And if it's not, they can make the changes to get that corrected. And that is very important because what you don't want is a future mishap because you've got the wrong allergy listed. And you definitely don't want the information to be passed from provider to provider. And so, it's important for them to know what's going on, what's being said, and to make the appropriate changes. Go start the process to make the changes. And we are the keeper of the record. But it's important for them to be involved, and that kind of gives them the reason to be proactive in knowing how their records are being maintained.

Host: A football coach will tell you that to run any play successfully, the first thing you have to do is line up right, so you don't get called for a penalty, you don't get called for offsides. So to get access to that patient portal, the first thing you have to do is get that patient portal, right? So, you go to the app store, whichever operating system you're using, and you find out from your healthcare institution what the name of their patient portal is, because they're not all the same, right?

Kimberly Norton: Right. They're not all the same, and they can go to Willis-Knighton Health. And it'll have the instructions on how to get to the portal. And if they have any issues with that, they can call Release of the Information and they'll help them get set up with that. And like I said, the portal is great tools.

They can go on there and they can look at their medication list. If they forgot their appointment card, they lost it, they can go in there and see when their next appointment is. They can request refills. It's just all sorts of things. But that's the first step, get signed up to the portal. They can come on site to any campus. And they can be helped with the process as well if they're having issues.

Host: You got to get it on your phone or your tablet. And then, you got to get that login. And once you do that, I think you'll agree, Kim, you'll be amazed at what's there. Like you said, pop-up notifications about your appointments that are upcoming, verifications. "Hey, guess what? The pathologist read your biopsy." You can read it before you go to the doctor so you're better prepared, on and on and on. This is great stuff. So again, we'll go back to the privacy concerns. People are monitoring their health now using health apps. I mean, they can monitor your steps, your heartbeat, your respirations, even blood sugar now with continuous glucose monitoring, everything that's going on.

But this patient portal, it has all your stuff. So, how is that protected from someone digging through your phone and finding out something you may not want them to know?

Kimberly Norton: With that, you would need to make sure that you're securing all your electronic devices, your phones, your tablets, having passwords on there, not sharing your username and password, leave it lying around anywhere where someone could get it and possibly log on to your portal. But as far as the technical side, it's very secure on our side, but patients just need to be aware of the things, face recognition, anything to kind of lock down the whatever device that they're using.

Host: It goes back to our theme, rights and responsibilities, right? So, you have the right to all of these records, and you can get them right at your fingertips in the palm of your hand, but you also have a responsibility to yourself to maintain the privacy to the degree that you want to do , yeah? Wouldn't you?

Kimberly Norton: Absolutely.

Host: Okay. So now, we're talking about technology, and I know that electronic health records are ever-evolving, ever-expanding. The integration of those are working to the physician's benefit, but most importantly, to the patient's and their family's benefit. So, these technological advancements with respect to sharing information among providers, that's changed the life of what you do, and it continues to change. What do you see is coming down the pike?

Kimberly Norton: Well, we've come a very long way from tons of paper and files and storages and cabinets. And we still have storage. But with today's advances in electronic medical records, we now have the capability to transfer patient data between systems, and not only that, from provider to provider or to facility. And this makes continuation of care quicker because the doctor doesn't have to have the nurse call and say, "Hey, we need you to fax us the medical records on Miss Kim." You know? And then, you have to wait for the 10, 20 pages to come across, or better yet, maybe it's a volume of records that we have to have sent by a courier or even mailed.

Host: So now, doctors have that most up-to-date accurate information at their fingertips, which better helps the patient with continuation of care. There's no delay. And even when we're transporting patients from facility to facility, the hospital A is sending the patient to hospital B. And hospital B can already be reviewing the patient's data before the patients get there. So, it's really, really great.

So, let's talk a little bit about how your department is organized. I mean, you're the apex, but you have people at every hospital campus that Willis-Knighton Health owns and operates. And how many people are running with you? And when an average patient encounters someone in your department, who are they typically going to be talking with most frequently?

Kimberly Norton: Most frequently, the patients usually are there speaking with the Release of Information because everybody wants records for some reason. Well, I would say that would be the bulk of the calls. Now, we do have patients, they may call about concerns over something, a payment because of coding issues. But most of it would revolve around getting their own medical records or getting access to their medical records.

Host: So when people call, I guess they can call or drop by or maybe send an email. Do you have people, like, popping in, asking where medical records is, and just walking in the door and saying, "I want my medical records"? Well, how is that balance with respect to how things are being requested?

Kimberly Norton: Yes, that's often the issue, and we do have a different setup now. If a patient wants their medical records, they are directed to Admitting where they can sign in on a kiosk. And on that kiosk, they'll have the option to select that they want their medical records, and then a clerk will assist them with getting the authorization filled out and they can help them with the portal.

Host: So, don't roll up into Kim's office.

Kimberly Norton: No. I have had people in my office, if they want to speak to a supervisor. But most of the times, it's done by the front desk help.

Host: Kim, this has been so informative and so helpful. I'll ask you the general question: Is there anything that you want everybody to know that we haven't talked about yet today?

Kimberly Norton: Not really. Just know that we are working hard here to keep everyone's information safe. We are very particular about who we speak to and what we're saying. We're only giving out information on a need-to-know basis. And oftentimes, the most minimal information is given. So if someone comes in, if we've got a release for an operative report, that's all they're going to get. They're not going to get anything else. So, just know that we are working hard to keep their information secure, and we're doing our best to get everything out the door coded and validated and all those good things.

Host: What is your best advice for someone who is seeking their health information about the most efficient and effective way to get that done?

Kimberly Norton: The most efficient way would be to obtain a portal access. And then, that way, they can go on at any time of day to review. And you're constantly getting notified of the new data that's being uploaded. So, you can stay on top of it, and you don't have to wait for anyone to send you a file or mail you a file or put something on a disk. So, that would be the best thing for you to do, to get the portal access.

Host: We've talked about the portal three times because it's important. The portal is not the future, the portal is the present, and the portal is the thing that's going to make your life so much simpler. Kim Norton, Director of Health Information Management for Willis-Knighton Health, thank you so much for your time today. And thank you all for joining us for Health on Point, presented by Willis-Knighton Health.