What is the HIPAA 'right of access'?

• A. Individuals have the right to restrict disclosures but not access.
• B. Individuals have the right to access and obtain copies of their PHI held by covered entities.
• C. Only healthcare providers have access rights to PHI.
• D. Access is granted only for medical research.

Answer: (B)

The main idea being tested is that individuals have the right to access their own protected health information. Under HIPAA, a person may inspect and obtain copies of theirPHI that a covered entity maintains in a designated record set. You can request the information in the format you prefer, including an electronic copy if it’s readily producible, and the covered entity must respond within 30 days (with one possible 30-day extension) by providing the records or a written justification for denying access. The entity can charge a reasonable, cost-based fee that covers the cost of copying and sending the records, and any labor involved in fulfilling the request.

This right applies to information in the designated record set, but there are exceptions, such as psychotherapy notes or information compiled for use in legal actions, where access may be restricted. It’s separate from the right to request restrictions on disclosures, which is a different aspect of HIPAA.

So the statement that best captures the HIPAA right of access is that individuals have the right to access and obtain copies of their PHI held by covered entities.