The proposed rule would provide several basic rights for individuals with respect to protected health information about them. Individuals would have:
- The right to receive a written notice of information practices from health plans and providers. The notice must describe the types of uses and disclosures that the plan or provider would make with health information (not just those uses and disclosures that could lawfully be made). When plans and providers change their information practices, they would also have to update the notice. Plans and providers would be required to follow the information practices specified in their most current notice.
- The right to obtain access to protected health information about them, including a right to inspect and obtain a copy of the information.
- The right to request amendment or correction of protected health information that is inaccurate or incomplete.
- The right to receive an accounting of the instances where protected health information about them has been disclosed by a covered entity for purposes other than treatment, payment, or health care operations (subject to certain time-limited exceptions for disclosures to law enforcement and oversight agencies).