Patients must be able to see and get copies of their records, and request amendments. In addition, a history of most disclosures must be made accessible to patients. Receiving patient consent before information is released. Patient authorization to disclose information must meet specific requirements. Health care providers who see patients are required to obtain patient consent before sharing their information for treatment, payment, and health care operations purposes.
Patients have the right to request restrictions on the uses and disclosures of their information.
Ensuring that consent is not coerced. Providers and health plans generally cannot condition treatment on a patient's agreement to disclose health information for non-routine uses. Providing recourse if privacy protections are violated. People have the right to complain to a covered provider or health plan, or to the Secretary, about violations of the provisions of this rule or the policies and procedures of the covered entity. Ensuring that health information is not used for non-health purposes.