HIPAA provides for the following patient rights:
- Right of Notice
- Patients have the right to know why PHI is being collected and to whom it may be disclosed.
- Right of Access
- Patients may access their own PHI upon request.
- Patients may obtain an electronic copy of their PHI if maintained electronically. If the electronic PHI is not readily producible in the requested format, the covered entity must provide a copy of the PHI in another readable electronic form, such as a PDF, rather than a hard copy. Covered entities must respond to all requests within 30 days unless the covered entity is granted a one-time 30-day extension.
- Right to Accounting of Disclosures
- Patients have a right to know to whom PHI was disclosed.
- Right to Amend
- Patients may request a change to their PHI.
- Right to Request Restrictions
- Patients may request that PHI be withheld from specific parties.
- Patients have the right to restrict disclosures to a health plan concerning treatment when the patient has paid for the treatment entirely out-of-pocket.
Patients may have additional rights under state law.