Patients have always had the right to access their PHI (post HIPAA). We wrote about the Privacy Rule sections that provide for this access in our Patient's Bill of Rights post. The HITECH Act expands this access under Section 13405, now allowing for treatment, payment and operations (TPO) usages to be disclosed for the past three years as well (i.e. provided that an EHR is in use).
Covered entities and business associates are well advised to have a well defined set of processes in place for providing this access, or they could quickly find themselves in "willful neglect" land. The engaged patient, one that is likely to significantly increase the demand for access, is not going away any time soon. As we discuss in this article, with the boomers retiring en masse you can be sure that this trend is likely to grow significantly.
To read the rest of the article subscribe to our FREE HITECH/HIPAA Compliance Newsletter. The archives can be found here.