Trust, privacy and the record · 4 of 4
When a patient asks
A patient asks for their records, or asks you to delete them. Here is who they ask, and why the answer is you.
This question has a clean answer and it is worth knowing before someone asks it at your front desk.
They ask you, not Mesio
Your practice is the covered entity. You hold the relationship with the patient and you own the record. Mesio is a business associate, holding a copy on your behalf and acting on your instruction.
So a patient exercising their rights over their record exercises them with your practice, through whatever process you already have. Mesio does not have a separate relationship with your patients and will not act on a patient's instruction directly, which is the correct answer rather than an unhelpful one. A vendor that would take instructions about your record from someone who is not you would be a problem.
What you can ask Mesio for
Your copy. Everything Mesio holds for a given patient can be produced for you on request through support, and the request itself is recorded whether or not it succeeds.
In most cases it is not what you need. The record you would hand a patient lives in your practice management system, which is where your notes were filed. Mesio's copy matters when you want to see exactly what Mesio holds rather than what was written back.
Deletion
You can have a patient's information removed, and there are two shapes to it depending on what you need.
The ordinary path removes the patient from use immediately and completes the permanent deletion after a delay of about a month. That gap exists on purpose, so an erasure requested in error can be reversed before it becomes irreversible.
There is also an immediate and permanent path, restricted to a practice owner. It removes the visits, the notes, the audio and the stored files, and it deliberately reaches archived material too, on the grounds that an erasure which skips the archive is not an erasure.
Deletion leaves its own footprint, and should. The record goes, the audit entry that it went stays. You need to be able to demonstrate that you honored a request, which is impossible if honoring it erased the evidence.
Staff accounts are a separate thing
A team member leaving and asking for their own account to be removed is a different request. Removing someone's login and profile does not remove patient information, which the practice remains obliged to keep.