What individual rights does the Privacy Rule provide? And are these relevant to research subjects?

The Privacy Rule gives all individuals, and hence research subjects, a number of new rights. Items 3, 4 and 6 are of particular relevance to research. Under HIPAA everybody can:

  1. Request access to their health care information
  2. Request that their health care information be amended
  3. Receive, upon request, an accounting of all disclosures of their medical information, if they haven't specifically authorized the disclosures (or another exception does not apply)
  4. Revoke authorization for the use/disclosure of identifiable health information, to the extent the researchers have not already relied on it.
  5. Request alternative means or places of being contacted (e.g. home vs. work)
  6. Request restrictions on uses or disclosures (but a covered entity or researcher is not required to agree).

FAQ Topic: