Under the Final Rule, a Covered Entity (CE) is required to abide by an individual’s request to restrict the disclosure of PHI to a health plan if the individual, or someone on behalf of the individual, has paid the CE in full. The new regulations also provide that if an individual requests an electronic copy of their PHI, then a CE must provide access to that information in electronic form, if it is readily producible in that form. So a CE will have to produce PHI in an electronic format if it maintains records electronically (as it is considered readily reproducible in this circumstance). Further, under the Final Rule, if an individual directs a CE, in a signed writing, to electronically transmit a copy of the PHI to another person designated by that individual, then the CE must transmit the PHI electronically to that party. Additionally, HIPAA now permits a CE only one 30-day extension to respond to a request for access. Finally, the new regulations streamline individuals’ ability to authorize the use of their health information for research purposes and make it easier for parents and others to give permission to share proof of a child’s immunizations with a school.
Taken in part from : Miller & Martin, PLLC 3/8/2013