45 CFR 164.524 — HIPAA Privacy Rule: Access of Individuals to Protected Health Information

What this rule requires your agency to do

• 1Provide a timely, written denial in plain language stating the basis, any applicable review rights and how to exercise them, and how to complain to the entity or the Secretary; give access to any other requested PHI not subject to a ground for denial (§ 164.524(d)(1)-(2)).(45 CFR 164.524 — HIPAA Privacy Rule: Access of Individuals to Protected Health Information)
• 2Act on an access request no later than 30 days after receipt, with at most one 30-day extension supported by a written statement of reasons and the completion date (§ 164.524(b)(2)).(45 CFR 164.524 — HIPAA Privacy Rule: Access of Individuals to Protected Health Information)
• 3Provide access in the form and format requested if readily producible; if PHI is maintained electronically and an electronic copy is requested, provide it in the electronic form and format requested if readily producible, or as otherwise agreed (§ 164.524(c)(2)).(45 CFR 164.524 — HIPAA Privacy Rule: Access of Individuals to Protected Health Information)
• 4When the individual's written, signed request directs it, transmit a copy of the PHI directly to another person clearly designated by the individual (§ 164.524(c)(3)(ii)).(45 CFR 164.524 — HIPAA Privacy Rule: Access of Individuals to Protected Health Information)
• 5Limit any fee for a copy, summary, or explanation to a reasonable, cost-based fee covering only labor for copying, supplies for media, postage, and preparation of an agreed summary or explanation (§ 164.524(c)(4)).(45 CFR 164.524 — HIPAA Privacy Rule: Access of Individuals to Protected Health Information)
• 6Grant individuals a right to inspect and obtain a copy of their PHI in a designated record set for as long as it is maintained, except psychotherapy notes and information compiled for litigation (§ 164.524(a)(1)).(45 CFR 164.524 — HIPAA Privacy Rule: Access of Individuals to Protected Health Information)
• 7Deny access without review only on the enumerated unreviewable grounds, and where a reviewable ground applies, provide the individual a right to have the denial reviewed by a licensed health care professional who did not participate in the original decision (§ 164.524(a)(2), (a)(3), (a)(4)).(45 CFR 164.524 — HIPAA Privacy Rule: Access of Individuals to Protected Health Information)
• 8Document the designated record sets subject to access and the titles of persons or offices responsible for receiving and processing access requests, and retain the documentation as required by § 164.530(j) (§ 164.524(e)).(45 CFR 164.524 — HIPAA Privacy Rule: Access of Individuals to Protected Health Information)