Standards for Privacy of Individually Identifiable Health Information. Final Privacy Rule Preamble.. Section 164.524 - Access of Individuals to Protected Health Information


As set forth in this section, covered entities must provide individuals with access to inspect and obtain a copy of protected health information about them in designated record sets, for so long as the protected health information is maintained in the designated record sets. This includes such information in a business associate's designated record set that is not a duplicate of the information held by the health care provider or health plan for so long as the information is maintained. Where the request is denied in whole or in part, the covered entity must provide the individual with a written statement of the basis for the denial and a description of how the individual may complain to the covered entity pursuant to the complaint procedures established in § 164.530 or to the Secretary pursuant to the procedures established in § 160.306 of this subpart. In certain cases, the covered entity must provide the individual the opportunity to have another health care professional review the denial. Pursuant to public comment, we estimate that each disclosure will contain 31 pages and that 150,000 disclosures will be made on an annual basis at three minutes per disclosure for a total burden of 7,500 hours. Refer to section V.E. for detailed discussion related to the costs associated with meeting these requirements.