Access to Protected Health Information, v1.0

Specifies that a covered entity must have policies and procedures to ensure that an individual has a right of access, in a timely manner, to inspect and obtain a copy of protected health information about the individual, subject to certain restrictions and limitations.
An indivdual's rights to access his/her PHI must be allowed by an organization's policies and procedures, subject to certain conditions and restrictions, as described in the referenced citation.
Due to the complexity of the rule as originally written, the assessor must use the full text of the citation section to perform this assessment.

Assessment Step

1
Individual Access to PHI (IndividualAccesstoPHI)
Does the covered entity have policies and procedures to ensure that an individual has a right of access, in a timely manner, to inspect and obtain a copy of protected health information about the individual in a designated record set, except for Psychotherapy notes, information for use in, a civil, criminal, or administrative action or proceeding, information exempted or excepted (such as by a covered entity that is a correctional institution), information that is reasonably likely to endanger the life or physical safety or cause substantial harm to the individual or another person, and other restrictions as provided in the referenced citation?
Artifact
A1
Provide evidence (e.g. organizational policies, procedures, compliance/assessment reports, etc.) that support the assessor's response to this assessment step.

Conformance Criteria (1)

Provide Access to PHI
The covered entity must have policies and procedures to ensure that an individual has a right of access, in a timely manner, to inspect and obtain a copy of protected health information about the individual in a designated record set, except for Psychotherapy notes, information for use in, a civil, criminal, or administrative action or proceeding, information exempted or excepted (such as by a covered entity that is a correctional institution), information that is reasonably likely to endanger the life or physical safety or cause substantial harm to the individual or another person, and other restrictions as provided in the referenced citation.
Citation
HIPAA-Privacy-Rule
45 CFR Section 164.524