If the patient asks for a restriction on the disclosure, the covered entity is not required to agree to the restriction. In the original draft of the medical privacy regulations, direct marketers' access to patient records was limited. But heavy lobbying by the corporations paid off and they now have access for marketing purposes. Patients can opt out of the marketing provision only after being contacted at least once. The burden is on the patient to contact each marketer that sends information.
Patients have the right to inspect, copy, amend, and receive an accounting of disclosures.
However, the accounting will not include activities related to treatment, payment, health care operations, national security, intelligence, correctional institutions, or disclosures prior to the compliance date. The Bush Administration has the authority to improve the regs.