What are Patients' Rights with PHI?

In this lesson, we'll go over patients' rights under HIPAA, what information requires authorization, when patient authorization is not required, and real-world examples you may encounter in practice.

Covered Entities and Patients' Rights

All covered entities (health plans, healthcare clearinghouses, and healthcare providers transmitting PHI electronically) are required to provide individuals a Notice of Privacy Practices upon request. This notice describes how medical information may be used and disclosed, as well as the process for filing complaints.

Patients have several key rights regarding their Protected Health Information (PHI), including:

• Record Inspection: The right to inspect and obtain copies of their medical records within 30 days.
• Record Corrections: The right to request corrections or additions if they believe information is inaccurate or incomplete.
• Communication Restrictions: The right to ask for restrictions on how their health information is shared or communicated.
• Accounting of Disclosures: The right to request an accounting of disclosures made outside of routine treatment, payment, and healthcare operations.

Patient Authorization Requirements

Patient authorization is necessary to disclose an individual's personal health information outside of routine healthcare operations, but written authorization is not required in order to treat the patient.

Sharing PHI Without Patient Authorization

There are specific legal exceptions where covered entities may disclose PHI without prior written authorization from the patient or parent:

• Workers' Compensation & Public Health: Information can be disclosed as required for workers' compensation claims or valid public health reporting.
• Imminent Danger & Abuse Reporting: Providers may alert law enforcement or official agencies if there is an imminent danger to the patient or others, or if abuse is suspected. Reporting suspected abuse can save a child's or adult's life.
• School Healthcare Disclosures: Covered healthcare providers may disclose PHI about students to school nurses or school physicians for treatment purposes without written authorization from the parent or student (e.g., a primary care doctor discussing medication management directly with a school nurse).