This statement outlines the policy principles for the protection, confidentiality and security of health information, and ultimately the consumer's right to privacy. These principles apply to all parties in the health industry, whether public, private or a combination thereof, as well as any other entity that has access to or is interested in access to a consumer's health information. These uses demonstrate the value of the information, why the consumer's right to privacy must be protected and why the consumer's written consent must be sought.
Consent is continual and the consumer has a right to deny consent at anytime.
The health information custodian receiving the information shall assume non-consent to disclose the information until expressed written consent is obtained from the consumer. The health information custodian must ensure the health information, shared with or in the custody of third parties, remains private by the use of contractual terms and conditions. Because the consumer's health information is of commercial, financial, social, and intellectual value to other parties, the consumer's written consent must be sought for primary and secondary uses. The following twelve principles deal with the use, collection, storage, disclosure, disposal and access of health information, including copying as well as misdirected reception. The technology or medium by which the information is collected, stored and disseminated does not negate the fact that the information given by a consumer belongs to the consumer and therefore is the consumer's property.