Designated reviewing official

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

The reviewer handles defined denials

45 CFR 164.524 limits this review route to the specified endangerment or substantial-harm grounds. It does not turn every access dispute into a clinical review. The intake record should classify the ground before assigning the reviewer.

The covered entity first determines whether the denial is reviewable under paragraph (a)(3), unreviewable under paragraph (a)(2), or outside the denial framework. Reviewable situations include specified licensed-professional determinations involving danger to life or physical safety, references to another person where access is reasonably likely to cause substantial harm to that person, and certain personal-representative requests where access is reasonably likely to cause substantial harm to the individual or another person. The exact regulatory text and facts matter. General concern, discomfort, or anticipated emotional upset alone is not a substitute for a listed ground.

Intake staff should capture the original decision-maker, provision used, records affected, facts considered, and accessible remainder. If the individual asks for review, promptly route the case while continuing any production that can proceed. The reviewer decides the specified denial, not unrelated billing disputes, state-law questions, or record-correction requests.

Independence and licensure are required

Verify current professional licensure, absence from the original decision, availability, conflicts, and authority to decide the review. HHS access guidance distinguishes reviewable from unreviewable denials. An executive title or privacy role alone does not meet the licensed-professional requirement.

Independence needs a documented conflict check. A clinical supervisor who directed the original denial, advised the original decision-maker, or supplied the decisive assessment may lack the required separation. The roster should show license type and status, jurisdictions, relevant expertise, coverage dates, and who may act when the primary reviewer is unavailable. A contracted professional can support the function when the arrangement preserves authority, confidentiality, independence, and timely access to the complete packet.

Build a case-level review packet

Give the reviewing official enough evidence to make a fresh determination: the individual's request and review request, responsive-record inventory, withheld passages, applicable ground, original rationale, relevant clinical context, and records scheduled for partial release. Mark assumptions and missing evidence. Avoid a one-line referral that merely asks the reviewer to endorse the first decision.

The determination should identify the material reviewed, the governing ground, the conclusion for each withheld item, and any conditions or narrower scope. The privacy office then sends the required written notice and implements the determination. A decision granting access is incomplete until the records are produced; a decision sustaining only part of the denial requires a revised production and revised explanation.

Example across review requests

Four people request review this quarter. Three cases reach an independent licensed reviewer and receive written outcomes; one is assigned to the original decision-maker. Valid review completion is 3 of 4 requests. The fourth must be reassigned.

Assume one of the three valid reviews overturns a denial for 18 pages, one narrows a denial from 12 pages to two passages, and one sustains a denial for a single note. The compliance dashboard should show three completed determinations, two determinations requiring additional access, and one sustained denial. It should also show whether the 28 newly releasable pages were actually delivered. Review completion and outcome implementation are separate controls.

Reviewing-official checklist

• Confirm that the original ground is one of the reviewable grounds in the rule.
• Verify the reviewer's active professional license, expertise, availability, and authority.
• Document that the reviewer did not participate in the original denial.
• Provide the request, records, rationale, relevant context, and partial-access inventory.
• Obtain a record-specific determination within a reasonable period.
• Give the individual written notice of the determination.
• Produce any newly accessible PHI and update the production manifest.
• Retain the conflict check, packet, decision, notice, and delivery evidence.

Owner controls

Maintain a reviewer roster, conflict check, referral date, evidence packet, determination date, notice, and implementation proof. Measure outcome implementation separately from review completion, especially when the decision grants partial or full access.

Test after staffing changes, leaves, and acquisitions to ensure a qualified independent reviewer remains available. Track referrals awaiting assignment, age of open reviews, overturn and narrowing rates, notices sent, and access delivered after favorable decisions. A high rate of overturned broad denials may indicate the initial decision process needs narrower criteria or stronger training.