Record amendment requests

How do we handle a patient's request to amend their medical record so the right author decides within the HIPAA timeline and the outcome and the patient's notice are recorded?

Treat the amendment as a decision with a clock and a record of its own. When a patient asks to amend their record, Callvu verifies the patient's identity, captures the request in writing with the record element and the reason, classifies it (a demographic correction, a clinical entry the organization created, a record the organization did not create, a record that is accurate and complete), routes it to the author or the health information management reviewer in the Decision Desk with the entry and the request and only the allowed outcomes, generates the acceptance (with the amendment linked to the record and the persons the patient names notified) or the written denial with the reasons and the patient's rights, and writes the outcome to the EHR inside the sixty-day timeline with the extension recorded where used.

In scopeComplex: multi-party handoffsCallvu moves: classify, decide, write back

Talk to an expert Try it in the sandbox

Last updated November 7, 2026.

The problem today

The patient asked to correct an allergy entry in March; the author left in April; the request was found in a shared inbox in August.

Today, without Callvu

A patient reads their record in the portal and finds something wrong: a medication they never took, an allergy that belongs to someone else, a family history they did not give. They ask for a correction. The request lands in an inbox at health information management, is forwarded to the clinician, and waits. The patient hears nothing, the timeline passes, and the entry keeps feeding clinical decisions.

The HIPAA Privacy Rule gives the patient the right to request an amendment and gives the organization sixty days to act, with one thirty-day extension on written notice. It sets what a denial must contain (the basis, the right to a statement of disagreement, the right to a complaint) and what an acceptance requires (the amendment linked to the record, the persons the patient names and those known to have the information told). The decision belongs to the author or a designated reviewer, not to the inbox.

An amendment request is a short case with a long consequence, and the clock starts when the request arrives.

How it runs

From the requestto the system of record.

A patient asks to amend their record through the portal, a form, a letter or a call. Callvu verifies the patient and opens the request with the date.

Patient: States what is wrong and why in writing, and receives the acceptance or the denial with their rights.
Health information management: Owns the request, routes it and records the outcome.
Clinician: Decides an amendment to an entry they authored, in the Decision Desk.
Callvu: Verifies, captures, classifies, routes, generates the notices, tracks the clock and writes back.

Capture and classify
The patient's identity is verified at the level the organization sets for record requests, the request is captured in writing with the record element, the date of the entry and the reason, and the request is classified: a demographic or administrative correction, a clinical entry authored in the organization, a record the organization did not create, a record that is not part of the designated record set, or an entry the author considers accurate and complete; the classification sets the reviewer and the clock.
Decide
The request goes to the author of the entry or the health information management reviewer in the Decision Desk with the entry, the request and the patient's reason, and only the allowed outcomes: accept and amend, accept in part, or deny on one of the permitted grounds (the organization did not create the record, the record is not available for inspection, the record is not in the designated record set, or the record is accurate and complete) with the reason stated.
Notify
On acceptance, the amendment is appended and linked to the affected entries (the original is never deleted), the patient is asked which persons should be told and agrees to the notification, and the persons the patient names and those the organization knows have the information are notified; on denial, the written denial is generated in plain language with the basis, the right to submit a statement of disagreement, the right to have the request and denial included in future disclosures, and how to complain to the organization and to the Secretary.
Write back
The request, the classification, the decision with who decided and when, the amendment or the denial, any statement of disagreement and any rebuttal are written to the EHR as part of the designated record set, and the dates against the sixty-day clock and any extension notice are recorded with the request.

Where it ends: The patient's request was decided by the right person inside the HIPAA timeline, the record was amended by appending or the denial carried the patient's rights, and the EHR holds the request, the outcome and the notifications. The Decision Trace shows the classification, the ground relied on and the decider; the Audit Trace shows the request date, the extension where used, the notices and the write.

Runtime enforcement

What is enforcedwhile the work runs.

The regulations preloaded in Callvu Studio and the bank's own policies, applied as steps that run, not lines in a binder. A step that breaks a rule does not run, so a completed run was compliant.

Regulations

HIPAA right to amend (45 CFR 164.526): A covered entity must permit an individual to request amendment of protected health information in a designated record set and must act on the request no later than sixty days after receipt, with one extension of up to thirty days if the individual is given written notice of the reasons and the date; it may deny only if the information was not created by the entity (unless the originator is no longer available), is not part of the designated record set, would not be available for inspection under 164.524, or is accurate and complete; an accepted amendment is linked to the record and the persons the individual identifies and those known to hold the information are notified; a denial must be in plain language and state the basis, the right to submit a statement of disagreement, the right to have the request and denial included in future disclosures, and the complaint procedures.
Documentation and retention (45 CFR 164.526(f) and 164.530(j)): The organization must document the titles of the persons responsible for receiving and processing amendment requests and retain the documentation, the statement of disagreement and any rebuttal for six years.
State medical record correction laws and the organization's documentation policy: Some states give shorter response periods or additional rights, and the organization's policy sets that corrections are made by addendum and never by deletion, with the original entry preserved and the amendment visible to downstream users.

Company policies

Every amendment request is captured in writing with the date; a verbal request is converted and confirmed.
The author decides an entry they created; health information management decides administrative and not-created records.
Amendments are appended and linked; nothing is deleted.
The EHR is the system of record for the request, the outcome and the notifications.

Controls

Identity verification for record requests.
Written capture with the record element and the reason.
Classification by record type and ground.
Decision Desk routing to the author with permitted outcomes only.
Notice generation with the required content.
Sixty-day clock with extension tracking and EHR write.

Clocks and deadlines

Response: Sixty days from receipt of the request.
Extension: One extension of up to thirty days, with written notice of the reason and the date before the first period ends.
Retention: The request, the decision and any statement of disagreement kept six years.

Documents and checks

The written request with the record element and the reason
The classification
The decision with the decider and the ground
The amendment appended or the denial letter
The notifications sent and the EHR record

In the Decision Trace

The classification and the reviewer chosen.
The ground accepted or relied on for denial.
The persons notified and why.

In the Audit Trace

The request date and the clock.
Any extension notice with time.
The decision, the notices and the EHR write with time.

The handoff

Between the front doorand the back office.

The front door

The portal, a form, a letter or a call; the patient states the request in writing on a verified screen.

The back office

Health information management routes and records; the clinician decides from the entry and the request, not from an inbox.

The Decision Desk

Every request goes to the author or the health information management reviewer in the Decision Desk with the entry and the request, and only accept, accept in part, or deny on a permitted ground with the reason.

Proof

In scope.Proof at scale, not one process at a time.

The kind of process Callvu runs in production for customers in this industry. Ask for a reference on this exact process. The results below are the industry's published proof; each claim code links to its record on agents.callvu.com.

23 hospitals in the Ministry of Health network run on Callvu.

Across Callvu customers

More than 1,000 processes are live across Callvu customers.

Across Callvu customers

Questions

What buyers ask next,answered plainly.

How long does the organization have?

Sixty days from receipt, with one thirty-day extension on written notice of the reason and the new date; the clock is on the request.

On what grounds can a request be denied?

Only the permitted ones: the organization did not create the record, it is not part of the designated record set, it would not be available for inspection, or it is accurate and complete; the denial states the basis and the patient's rights.

Is the original entry removed?

No. An accepted amendment is appended and linked to the entry; the original stays, and the people the patient names are told.

Related processes

Patient right of access requests Accounting of disclosures requests Requests to restrict disclosures Privacy complaints and incident intake Try it in the sandbox All healthcare processes

Bring this process, or the one that costs you most.

We build it against your policies and your systems, train your team and stay with you through launch. You are live in weeks.