May a covered entity accept standing requests from individuals to access their PHI or to have their PHI sent to a third party of their choice?
Yes, and covered entities should have processes in place that [...]
Under HIPAA, when can a family member of an individual access the individual’s PHI from a health care provider or health plan?
This guidance remains in effect only to the extent that [...]
If an individual requests access from a clinical laboratory to a test report on the individual, is the laboratory required to interpret the test results for the individual?
This guidance remains in effect only to the extent that [...]
Is a clinical laboratory required to provide an individual with access to a test report that is not yet complete?
No. For purposes of the HIPAA Privacy Rule, clinical laboratory [...]
If an individual’s physician orders a test from a clinical laboratory that may take multiple steps or a series of tests to complete, at what point does the test report become part of the laboratory’s designated record set to which an individual has a right of access?
For purposes of the HIPAA Privacy Rule, clinical laboratory test [...]
Is a health care provider permitted to deny an individual’s request for access because the individual has not paid for health care services provided to the individual?
No. A covered entity may charge an individual that has [...]
Does an individual have a right under HIPAA to access their health information in human readable form?
Yes. In general, a covered entity must provide an individual [...]
Do individuals have a right under HIPAA to have a covered entity establish a direct connection between the covered entity’s system and the individual’s app or device in order to provide the individuals with access to their PHI?
Whether PHI is “readily producible” for purposes of providing access [...]
Do individuals have a right under HIPAA to have their PHI downloaded on portable media that they provide?
Whether PHI is “readily producible” for purposes of providing access [...]
Is a covered entity responsible if it complies with an individual’s access request to receive PHI in an unsecure manner (e.g., unencrypted e-mail) and the information is intercepted while in transit?
This guidance remains in effect only to the extent that [...]