May a covered entity accept standing requests from individuals to access their PHI or to have their PHI sent to a third party of their choice?

Yes, and covered entities should have processes in place that enable individuals to receive access to their PHI, including to direct a copy of their PHI to a third party of their choice, on a standing, regular basis, without requiring individuals to repeat their requests for access every time a copy of their PHI is to be sent or otherwise made accessible. Further, covered entities should take advantage of technology and tools that automate such regular access.

Posted in: HIPAA
Content created by Office for Civil Rights (OCR)
Content last reviewed on June 24, 2016