HITECH Subtitle D - strengthened individual rights. ELECTRONIC ACCESS (Section 17937; 45 CFR 164.524): individuals have RIGHT TO ACCESS PHI in DESIGNATED RECORD SET + receive in ELECTRONIC FORMAT if maintained electronically (e.g. EHR); covered entity must respond within 30 days + 60-day extension if reasonable; reasonable fee for paper or electronic copy + electronic format must be readable + interoperable; right to designate third-party recipient + Right of Access Initiative is OCR enforcement priority. ACCOUNTING OF DISCLOSURES (Section 17935(c); 45 CFR 164.528): individuals have right to accounting of certain disclosures including TPO disclosures from EHR for 3 years (post-HITECH expansion); covered entity must respond within 60 days + provide list of disclosures + recipients + purposes. RESTRICTIONS ON DISCLOSURES TO HEALTH PLANS (Section 17935(a); 45 CFR 164.522(a)): patient has RIGHT TO REQUEST that covered entity not disclose PHI to a HEALTH PLAN about a healthcare item/service for which the individual has paid out of pocket in full; covered entity must comply with such request. SALE OF PHI PROHIBITION (Section 17935(d); 45 CFR 164.502(a)(5)): prohibition on the SALE of PHI by covered entity or BA except for specific permitted purposes including treatment + research + public health + reimbursement of medical record-acquisition costs + de-identified data + with patient authorization; remuneration in excess of permitted purposes prohibited. MARKETING + FUNDRAISING TIGHTENED (Sections 17935 + 17936; 45 CFR 164.501-514): tighter restrictions on marketing communications including authorization required if covered entity receives remuneration for the communication; fundraising communications must offer clear opt-out + cannot be conditioned on treatment or payment. MINIMUM NECESSARY STANDARD STRENGTHENED (Section 17935(b)): HHS to issue guidance on minimum necessary standard including limited data set + de-identification + research; ongoing OCR guidance + enforcement; covered entity must make reasonable efforts to limit PHI use/disclosure to minimum necessary. EDUCATION ON HEALTH INFORMATION PRIVACY (Section 17933): HHS + states + covered entity + BA workforce education + outreach + best practices + privacy-protective.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.