HIPAA is usually explained from the organisation’s side — safeguards to implement, penalties to avoid, agreements to sign. But the Privacy Rule also does something more personal: it hands every patient a set of enforceable rights over their own record. The right to see it and take a copy. The right to challenge what it says. The right to know who it was shared with. These are not aspirations; they come with citations, deadlines, and fee limits — and OCR runs an entire enforcement initiative around the first one alone. For healthtech teams, each right maps to something concrete you have to be able to do: export, correct, and account.
The Rights the Privacy Rule Grants
Seven rights make up the set. Three of them — access, amendment, and accounting — generate almost all of the operational work, so they get the deep treatment below. But the full list is worth seeing in one place, because security reviews and OCR audits check all of it:
| Right | Citation | Deadline |
|---|---|---|
| Access and copies of the record | 45 CFR 164.524 | 30 days (+30 extension) |
| Amendment of the record | 45 CFR 164.526 | 60 days (+30 extension) |
| Accounting of disclosures | 45 CFR 164.528 | 60 days (+30 extension) |
| Request restrictions on use and disclosure | 45 CFR 164.522(a) | — |
| Confidential communications | 45 CFR 164.522(b) | — |
| Notice of privacy practices | 45 CFR 164.520 | At first service / on request |
| Complain without retaliation | 45 CFR 164.530 | — |
The Right of Access
The anchor right: an individual may inspect and obtain a copy of their PHI in a designated record set — the medical and billing records, and anything else used to make decisions about them. Not the entire database, and not internal artifacts like quality reviews or psychotherapy notes; but everything that informed their care and billing, yes.
The mechanics are specific, and every one of them has been the subject of enforcement:
- Thirty days, with one 30-day extension if the individual is told in writing why and when. Not thirty days to acknowledge — thirty days to deliver.
- Form and format requested, if readily producible. For electronically held PHI that includes an electronic copy — and if the patient asks for email, even unencrypted email after a warning, you send it.
- Reasonable, cost-based fees only: labour for copying, supplies, postage. No retrieval fees, no discouragement pricing. HHS has floated $6.50 flat as a safe-harbour for electronic copies.
- No leverage games. Access cannot be withheld over unpaid bills, and identity verification cannot be engineered into an obstacle course.
- Third-party direction: the patient can direct the copy to anyone — another provider, an app, a lawyer.
In 2019 OCR announced it would treat access failures as a priority, and it has settled dozens of cases since — many against small practices, many triggered by one patient who simply never got their records. Settlements have run from a few thousand dollars to $240,000, and the fact pattern is monotonously consistent: a request, months of silence, a complaint, a settlement with a corrective action plan. Long before the initiative, Cignet Health earned the first civil money penalty in HIPAA history — $4.3 million — substantially for refusing 41 patients their records and then stonewalling the investigation. Access is the right regulators can verify with a calendar, which is exactly why they enforce it.
The Right to Amend
Patients can ask that inaccurate or incomplete PHI in the designated record set be corrected. The organisation has 60 days (one 30-day extension) to act — and, importantly, it may say no. A denial is legitimate if the record is accurate and complete as written, wasn’t created by the organisation (with an exception when the originator is gone), or isn’t part of the designated record set at all.
But denial is not the end of the process, and this is the part teams miss. The denial must be written and reasoned; the individual may then file a statement of disagreement, and that statement must travel with the disputed record in relevant future disclosures. If the amendment is accepted instead, the organisation must make it, notify the patient, and make reasonable efforts to inform others who hold the affected PHI — including business associates, which is why every BAA contains an amendment clause.
Read as a systems requirement: amendment is not a row update. It is a versioned correction with an audit trail, an attachment mechanism for disagreement statements, and a propagation path to downstream holders of the data. The right isn’t a right to rewrite history — it’s a right to be heard on the record, permanently.
The Accounting of Disclosures
The least-known of the big three: an individual may request a list of certain disclosures of their PHI made in the six years before the request — who received it, when, what was disclosed, and why. The response is due in 60 days (one 30-day extension), and the first accounting in any 12-month period must be free.
What makes this workable is the exclusion list. Routine disclosures for treatment, payment, and healthcare operations don’t have to be accounted for, nor do disclosures to the patient, disclosures under an authorization, or incidental ones. What remains is the exceptional traffic: disclosures required by law, to public health authorities, in judicial proceedings, to law enforcement, and for research.
The accounting right has a property the other two don’t: it can only be satisfied if the logging existed at the moment of disclosure, up to six years ago. An access request can be fulfilled from current data; an accounting request is a query against history. If disclosures to public health agencies, courts, or law enforcement flow out of your systems today with no structured record of recipient, date, scope, and purpose, the gap is already accumulating — and it becomes visible on the day a patient asks.
The Rights People Forget
Four more rights round out the set, and two contain traps:
- Requested restrictions. Patients may ask you to limit uses or disclosures of their PHI. You may generally decline — with one hard exception: if the patient paid for a service out of pocket in full and asks that it not be disclosed to their health plan, you must honour that. Systems that can’t flag a visit as restricted-from-payer fail this by architecture.
- Confidential communications. Reasonable requests to be contacted differently — a different number, a different address — must be accommodated. The abuse-victim scenario is the canonical reason; contact-preference flags are the implementation.
- Notice of privacy practices. The document describing how PHI is used and what these rights are — provided at first service, posted, and available on request.
- Complaints without retaliation. Internally and to HHS. Every Right of Access settlement started as one of these.
What This Means for Product Teams
If your platform serves covered entities, these rights flow into your product twice — through the BAA, which obligates you to support them, and through simple mechanics: your customer can only answer a patient in 30 days if your system can produce the data in less.
Access becomes an export pipeline
A complete, machine-readable export of everything you hold about one patient — spanning the designated record set, not just the primary table — with identity verification proportionate to risk and delivery the patient can actually use. If assembling that today means engineers writing ad-hoc SQL, the 30-day clock is already spending itself on your internal friction.
Amendment becomes versioned corrections
Correction workflows with history preserved, disagreement statements attachable to records, and propagation to integrations that received the old value. Overwrite-in-place fails the requirement in both directions: it destroys the audit trail and can’t carry the disagreement.
Accounting becomes a disclosure log
A structured event — recipient, date, data scope, purpose — emitted wherever PHI leaves the system outside treatment, payment, and operations. It’s the cheapest of the three to build and the only one that can’t be built retroactively.
Teams that already run GDPR data subject request workflows will recognise the shape — HIPAA’s versions are narrower but stricter on deadlines, and the two can share most of one pipeline.
Treats Requests as Tickets vs Builds Rights Into the Product
| Requests as tickets | Rights as product |
|---|---|
| ✗ Access requests live in someone’s inbox | ✓ Export is self-serve, or one click for staff |
| ✗ The 30-day clock is tracked from memory | ✓ Every request gets an SLA timer on intake |
| ✗ Corrections overwrite the old value | ✓ Amendments are versioned, disagreements attach |
| ✗ Disclosures reconstructed when asked | ✓ Logged at the moment they happen |
| ✗ Fees improvised per request | ✓ A documented, cost-based fee schedule |
| ✗ Verification hurdles that block patients | ✓ Identity checks proportionate to risk |
Final Thought
Patient rights are the one corner of HIPAA that arrives as inbound traffic from real people — not auditors, not customers, but individuals exercising a legal entitlement, with a regulator demonstrably willing to act on a single complaint. That makes them both the most human part of the law and the most operationally unforgiving: a risk analysis can be remediated quietly, but a missed 30-day deadline happened, datably, to a named person.
The test: request your own product’s patient export, time it, and check it against the designated record set. Then ask who received PHI from your systems last quarter outside treatment, payment, and operations — and whether the answer came from a log or from memory. Those two answers are your rights-readiness, measured.
Frequently Asked Questions
The Privacy Rule grants individuals the right to access and obtain copies of their health records; the right to request amendment of inaccurate or incomplete records; the right to an accounting of certain disclosures going back six years; the right to request restrictions on uses and disclosures; the right to confidential communications; the right to a notice of privacy practices; and the right to complain — to the organisation and to HHS — without retaliation.
Thirty calendar days from receipt, with one 30-day extension available if the individual is told in writing why and when to expect the records. The clock is generous by design and OCR enforces it literally — the Right of Access Initiative has produced dozens of settlements against organisations that simply took too long, many of them triggered by a single patient’s complaint.
Yes. A covered entity may deny an amendment if the record is accurate and complete as it stands, wasn’t created by the organisation, or isn’t part of the designated record set. But denial has its own process: it must be issued in writing within 60 days (one 30-day extension allowed), and the individual may file a statement of disagreement that must accompany the disputed record in future disclosures. Amendment is a right to be heard on the record, not a right to rewrite it.
It is a list, covering up to the six years before the request, of certain disclosures of a patient’s PHI — to whom, when, what, and why. Routine disclosures for treatment, payment, and healthcare operations are excluded, as are disclosures to the patient and those made under an authorization. What remains — disclosures required by law, to public health authorities, in legal proceedings, and similar — must be produced within 60 days, and the first accounting in any 12-month period must be free.
Only a reasonable, cost-based fee covering labour for copying, supplies, and postage — not retrieval fees, not per-page rates designed to discourage requests. For electronic copies of electronically held PHI, HHS has described a $6.50 flat fee as a safe-harbour option. Charging more, or using fees as a barrier, is one of the patterns the Right of Access Initiative was created to punish.