NRPM: Standards for Privacy of Individually Identifiable Health Information. ii. Notification of accepted requests.


In § 164.514(d)(3), we are proposing that covered plans or providers be required to notify the individual of the decision to provide access and of any steps necessary to fulfill the request. In addition we propose that the entity provide the information requested in the form or format requested if it is readily producible in such form or format. Finally, if the covered plan or provider accepts an individual’s request, it would be required to facilitate the process of inspection and copying.

For example, if the plan or provider will be making copies and sending them directly to the individual with an invoice for copying costs, then it would need to ensure that the individual is aware of this procedure in advance and then send the information within the 30-day time period. If the plan or provider has procedures that require the individual to inspect the health information on site, then in addition to notifying the individual of the procedure, the entity would need to ensure that there are representatives available during reasonable business hours at the usual business address who can assist with inspection and copying. If the plan or provider maintains health information electronically and the individual requests an electronic copy, the plan or provider would need to accommodate such request if possible.