HIPAA: Provider Responsibilities

Patients have rights under the privacy rule that providers considered a covered entity must honor. These rights are also described in the Notice of Privacy Practices providers must give every new patient or patients that ask for it, which explains how a patient’s health information may be shared and what their rights are.

Right to access protected health information (PHI)

Patients have the right to inspect and get a copy of their PHI. (45 CFR §164.524)

Right to amend PHI

If a patient thinks something is wrong or missing from their file, they have the right to ask their provider to fix it, as long as the file is maintained by the covered entity. (45 CFR §164.526)

Right to request alternative confidential communications

Patients have the right to ask providers to contact at different places or in a different way. For example, they can ask to have a nurse call them on their cell phone or at their office instead of their home phone or to send mail in an envelope instead of on a postcard. The provider must accommodate reasonable requests. (45 CFR §164.522(b)(1))

Right to limit using and disclosing PHI

Patients have the right to ask a provider to limit how their PHI is used or shared for treatment, payment, and healthcare operations. Providers are not required to agree to all requests, but providers must agree to limit disclosure of PHI to a health plan if the disclosure is for payment or healthcare operations and the disclosure relates to a healthcare item or service which the patient has paid the provider in full out of pocket. (45 CFR §164.522(a)(1))

Right to receive accounting of disclosures

Patients have a right to get a list of who has seen their health information, if the information was not directly related to their care (treatment, payment, and/or healthcare operations). By law, PHI can be used and shared for certain disclosures to health oversight agencies or law enforcement, even if that has not been authorized by the patient. Examples of disclosures that must be tracked include public health activities like reporting immunizations or birth and death certificates; reports about victims of abuse, neglect, and domestic violence; information used for organ or tissue donation; and other disclosures required by law. (45 CFR §164.528)

Right to receive Notice of Privacy Practices

Providers must give every new patient or patients that ask for it a Notice of Privacy Practices detailing how they use and share PHI, and the provider must make a reasonable effort to get an acknowledgement from the patient that they have received the notice. Additionally, providers must give existing patients a Notice of Privacy Practices every three years or any time there are significant changes.

The notice explains how someone's health information may be shared for routine purposes such as treatment, healthcare operations, and billing. It details situations where data must be legally shared without a patient's permission such as for public health reporting, to law enforcement, or to prevent a serious threat to safety). It lists a patient's rights, including their ability to request copies of their records, request changes to incorrect information, and limit who can see information. And it explains exactly how to file a complaint if someone believes their privacy rights have been violated. (45 CFR §164.520)

Right to file a complaint

The provider must have a contact person as well as a process for patients to make complaints about the provider’s policies and procedures covered by the Notice of Privacy Practices. (45 CFR §164.530(d)(1))

Right to breach notification

Providers must notify patients, typically within 60 days, if their data has been breached. They must also Notify the U.S. Department of Health and Human Services

• Within 60 days if the breach affects 500 or more people
• Within 60 days after the end of the calendar year if the breach affects fewer than 500 people (45 CFR §§ 164.400-414)

Other rights

The provider or staff may not intimidate, threaten, coerce, discriminate against, or take any other retaliatory action against a patient who exercises any of the above rights. (45 CFR §164.530(g))