The person who is the subject of protected health information, with specific rights under HIPAA including access to records, amendments, and accounting of disclosures.
Under HIPAA, an "individual" is the person who is the subject of protected health information. This is typically a patient, health plan member, or other person whose health data is maintained by a covered entity. HIPAA centers the individual as the primary beneficiary of its protections, granting them specific rights over their health information that covered entities must honor. The individual concept is foundational to HIPAA's framework because the entire regulatory structure is designed to protect individual privacy while enabling the healthcare system to function effectively.
HIPAA grants individuals several important rights regarding their health information. The right of access allows individuals to inspect and obtain a copy of their PHI in their designated record set. The right to amend permits individuals to request corrections to inaccurate or incomplete information. The right to an accounting of disclosures requires covered entities to provide a record of certain disclosures of PHI. The right to request restrictions allows individuals to ask that certain uses or disclosures be limited. The right to confidential communications enables individuals to request that communications about their health information be made through specific channels. The right to receive a Notice of Privacy Practices ensures individuals are informed about how their PHI will be used and protected.
HIPAA also recognizes that individuals may have personal representatives who can exercise their rights on their behalf. This includes parents or guardians of minor children (with certain exceptions for adolescents), persons with legal authority to make healthcare decisions for incapacitated adults (such as holders of healthcare power of attorney), and executors or administrators of deceased individuals' estates. Covered entities must verify the identity and authority of personal representatives before granting access to PHI, and they must be aware of state laws that may limit or expand personal representative authority in certain situations, such as cases involving abuse, neglect, or endangerment.