HIPAA provides for the following patient rights:
- Right of Notice
- Patients have the right to know why PHI is being collected and to whom it may be disclosed.
- Right of Access
- Patients may access their own PHI upon request.
- Patients may obtain an electronic copy of their PHI, if the PHI is maintained electronically. If the electronic PHI is not readily producible in the requested format, the covered entity must provide a copy of the PHI in another readable electronic form, such as a PDF, rather than a hard copy.
- Covered entities must respond to all requests within 30 days, unless the covered entity is granted a one-time 30-day extension.
- Right to Accounting of Disclosures
- Patients have a right to know to whom PHI is disclosed.
- Right to Amend
- Patients may request a change to their PHI.
- Right to Request Restrictions
- Patients may request that PHI be withheld from specific parties.
- Patients have the right to restrict disclosures to a health plan concerning treatment when the patients have paid for the treatment entirely out-of-pocket.
Patients may have additional rights under state law.
