Patient Rights

Practice Obligations

Right to Notice of Privacy Policies

Provide “adequate notice” of privacy practices.

Right to Request Privacy Protection

• Restrictions on use and disclosure
• Confidential Communications

• No obligation for covered entity to agree, but if it does, it must except for certain exceptions, abide.
• Providers must accommodate “reasonable requests” to receive communication of PHI by alternative means or alternate locations.
• Covered entities can condition the provision of Confidential Communications on the provision of payment information and the specification of an alternative address or other method of contract.

Right of Access to PHI

Practice must be able to distinguish thee categories relevant to the individual’s right of access:

• The categories of PHI that are not subject to access by the individual:
• The circumstances under which individual access can be denied without review; and
• The circumstances under which individual access can be denied, subject to review by a health professional.

Practice must take action within 30 days of request when PHI is on-site, and within 60 days when PHI is off-site. One 30-day extension is permitted.

Right to Amend to PHI

Within 60 days of an amendment request.

Practice must act on the request or provide a written explanation ofr denying the request. One 30-day extension is available.

Right to an Accounting of Disclosures of PHI

Practice has 60 days to respond to a request for an accounting, with a 30-day extension permitted.