Individual Rights and Access to Health Information
The rights inventory
Know each right, its deadline, and its exceptions. Access: provide the requested form and format, including electronic, and honor a direction to send a copy to a third party; 30 days with one 30-day extension; fees limited to reasonable, cost-based labor, supplies, and postage. Amendment: 60 days with one 30-day extension, defined denial categories, and a right to have the request and disagreement included in future disclosures. Accounting of disclosures: six-year lookback, 60 days, excluding TPO, disclosures to the individual, and authorized disclosures, with specific tracking carve-outs for certain electronic health record disclosures. Restrictions: the entity must agree when the individual asks to restrict disclosure to a health plan for an item or service paid in full out of pocket. Also: confidential communications requests, timely notice of privacy practices, and the right to complain without retaliation.
Traps
Mixing up 30-day and 60-day clocks; importing state per-page fee schedules; confusing unreviewable denials (psychotherapy notes, information compiled for legal proceedings) with reviewable safety denials that need a licensed reviewer. Remember personal representatives act for the individual, with narrow exceptions.
Rule of thumb
Access is the default; denial is the exception that must be justified and documented. Worked example: a patient requests records through the portal - deliver them electronically and do not substitute paper or impose a per-page copying charge.