The Department of Health and Human Services gave itself some wiggle room to make determinations on the applicability of those terms in relation to the regulation. The right to know who has accessed one's medical record. Accounting of disclosures of protected health information Only the first right is not conditional. The others can be limited by such things as anticipation of litigation, physician or institution choice, clinical research trial involvement, the provider's assessment of how knowing the information might impact the patient, assessment of accuracy of the requested amendment to the record, and government-imposed delays due to government investigations. Individuals are not given the right to sue those who violate their right to privacy.
Violators are subject to sanctions when patients complain and violations are discovered.
Patients are not personally compensated. The Institute of Medicine has reported that deidentified data can sometimes be easily reidentified when cross-matched with data in other public databases. Otherwise patients are forever monitoring whether the various staff of the various providers and facilities are remembering NOT to send in information on the patient or the patient's family. The burden must instead be on the providers to ask for and check for patient consent prior to sending data anywhere. Parents may not be allowed to have access to the medical record information of their minor children, and children may be able to receive treatment without parent consent or knowledge.