Healthcare Information Security

HIPAA and Compliance News

ONC Releases Educational Videos on HIPAA Rights for Patients

The Office of the National Coordinator released videos to better clarify HIPAA rights for patients, ensuring individuals understand how to access their information.

By Elizabeth Snell

In an effort to better educate individuals on HIPAA rights for patients, the Office of the National Coordinator (ONC) released a series of videos that explain the rights patients have to access their health information.

ONC launches video series on HIPAA rights for patients

Additionally, ONC revealed a Patient Engagement Playbook, designed to help providers, practice staff, hospital staff better engage with patients through health information technology (health IT).

“Many people are not fully aware of their right to access their own medical records under the Health Insurance Portability and Accountability Act (HIPAA), including the right to access a copy when their health information is stored electronically,” ONC’s Chief Privacy Officer Lucia Savage, J.D., said in a statement. “The videos we released today highlight the basics for individuals to get access to their electronic health information and direct it where they wish, including to third party applications.”

ONC released a total of three videos, covering the following areas:

  • Individual's Rights under HIPAA to Access their Health Information
  • HIPAA Access Associated Fees and Timing
  • HIPAA Access and Third Parties

In terms of patient access to health information under HIPAA, ONC discusses in the video exactly how HIPAA access regulation works. For example, individuals have the right under HIPAA regulations to receive a copy of the PHI about them in one or more “designated record sets” maintained by or for the covered entity.

Whether information is electronic, or in physical form, individuals have the right to receive a copy of their own information, ONC maintained.

Furthermore, there are associated HIPAA access fees. While covered entities are encouraged to give individuals their information free of charge, they are allowed to calculate their own fees, even for ePHI requests, as long as it is within the limits of HIPAA’s Privacy Rule.

However, the charges must also fall under the HIPAA Privacy Rule’s “allowable costs,” which are are the charges associated with copying PHI. This can include paper supplies, toner, electronic media, labor for creating an explanation of health information, and postage. Allowable labor costs include photocopying paper records, scanning PHI into electronic format, converting the format of PHI, transferring data to a web-based portal, or mailing and emailing.

ONC also reviewed how information can be shared with third parties, including relatives, caregivers, or even be sent to a mobile device application, such as fitness trackers.

The Patient Engagement Playbook is meant to “help clinicians and other providers in sharing health information with their patients,” according to ONC. It includes best practice discussions and case studies of how clinicians and office staff can best utilize health IT to communicate with and engage with their patients.

“We must engage individuals in order to advance the safe and secure flow of health information,” ONC Chief Medical Officer Tom Mason, M.D., said in a statement. “The Playbook we’re releasing today provides clinicians with the resources they need to get the most out of their health IT and help patients put their electronic information to work to better manage their health.”

ONC has been recently been working to clarify HIPAA regulations when it comes to patient access. For example, it also released clarifications on HIPAA regulations regarding how much covered entities can charge individuals for copies of their own PHI under the patient right of access rule.

In addition, the Office for Civil Rights (OCR) released new HIPAA guidance in February, to review important points on individuals’ right of accessing their own health information.

“HIPAA’s right of access is critical to enabling individuals to take ownership of their health and well-being – but this core right is rendered meaningless when individuals cannot afford to pay the fees,” OCR Director Jocelyn Samuels explained in a blog post. “These new FAQs clarify that individuals can be charged only a reasonable, cost-based fee for the labor and supplies associated with making the copy, whether on paper or in electronic form.”  

Dig Deeper:


SIGN UP and gain free access to articles, white papers, webcasts and exclusive interviews on

HIPAA Compliance
Data Breaches

Our privacy policy

no, thanks