DHHS Guidance on Individual’s Access to Their Health Data

Precision Medicine Initiative graphicThe U.S. Department of Health & Human Services Office for Civil Rights recently released new guidance on an individuals’ access to their health information – both acquiring copy of such information and providing such information to others, including entities interested in such information for research. The Health Insurance Portability and Accountability Act (HIPPA; Pub. L. No. 104-191) Privacy Rule “requires HIPAA covered entities (health plans and most health care providers) to provide individuals, upon request, with access to the protected health information (PHI) about them in one or more ‘designated records sets’ [see 45 C.F.R. § 501] maintained by or for the covered entity. This includes the right to inspect or obtain a copy, or both, of the PHI, as well as to direct the covered entity to transmit a copy to a designated person or entity of the individual’s choice.” HIPAA covered entities may require individuals to request access in writing, and may require verification of the identity of the individual requesting access, but such entities “may not impose unreasonable measures on an individual requesting access that serve as barriers to or unreasonably delay the individual from obtaining access.” This new guidance is part of a larger Precision Medicine Initiative to “pioneer a new model of patient-powered research that promises to accelerate biomedical discoveries and provide clinicians with new tools, knowledge, and therapies to select which treatments will work best for which patients.” For additional information, see the DHHS Individuals’ Right under HIPAA to Access their Health Information 45 CFR § 164.524 page.