NRPM: Standards for Privacy of Individually Identifiable Health Information. 7. Individual rights.


We are proposing to establish several basic rights for individuals with respect to their protected health information. We propose that individuals be able to obtain access to protected health information about them, which would include a right to inspect and obtain a copy of such information. See proposed § 164.514. The right of access would extend to an accounting of disclosures of the protected health information for purposes other than treatment, payment, and health care operations. See proposed § 164.515.

In § 164.512, we also propose that individuals have a right to receive a written notice of information practices from covered entities. While the primary purpose of this notice would be to inform individuals about the uses and disclosures that a covered entity would intend to make with the information, the notice also would serve to limit the activities of the covered entity -- an otherwise lawful use or disclosure that does not appear in the entity’s notice would not be permitted. The covered entity’s uses and disclosures could be stated in broad terms, but an entity would not be able to make a use or disclosure that is not included in its notice. The covered entity could modify its notice at any time and apply revised practices to existing and new information held by the covered entity.

In addition, we propose that individuals have the right to request amendment or correction of protected health information that is inaccurate or incomplete. See proposed §164.516. We are proposing procedural requirements and deadlines to implement each of these individual rights.