Implementation

Treatment, payment, and health care operations (TPO), plus specified public-interest disclosures: public health reporting, abuse/neglect reporting, court orders/subpoenas meeting requirements, law enforcement in limited cases, serious threat to health or safety, and workers' compensation as required by law.

The minimum necessary standard limits PHI to what is needed for the purpose, but it does NOT apply to disclosures to another provider for treatment.

Within 30 calendar days of the request, with one possible 30-day extension if the patient is notified in writing of the reason; only a reasonable cost-based fee may be charged.

The patient has a right to request amendment; the practice must act within 60 days (one 30-day extension). If denied, give a written denial and allow the patient to file a statement of disagreement that is attached to the record.

Psychotherapy notes (a clinician's separately kept session notes) need specific patient authorization for most disclosures and are excluded from the patient's right of access; medication, diagnosis, and treatment summaries are not psychotherapy notes.

Notify affected individuals without unreasonable delay and no later than 60 days after discovery; for ≥500 residents of a state/jurisdiction, also notify HHS and prominent media within 60 days.