{
  "package" : "hl7.terminology@6.3.0",
  "definition" : "A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule 45 CFR Section 164.524 Access of individuals to protected health information https://www.govinfo.gov/app/details/CFR-2017-title45-vol1/CFR-2017-title45-vol1-sec164-524, which stipulates that an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set with exceptions stipulated in HIPAA Privacy Rule Section 164.524. Exceptions include psychotherapy notes and information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.\\r\\n\\r\\nIf an individual's request for access directs the covered entity to transmit the copy of protected health information directly to another person designated by the individual, the covered entity must provide the copy to the person designated by the individual. The individual's request must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy of protected health information.\\r\\n\\r\\nFor discussion on extent of right, grounds for denial, and documentation requirements see: HHS Individuals' Right under HIPAA to Access their Health Information 45 CFR Section 164.524 https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html and HHS FAQ on Right of Access vs. HIPAA Authorization https://www.hhs.gov/hipaa/for-professionals/faq/2041/why-depend-on-the-individuals-right/index.html\\r\\n\\r\\n*Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed under 45 CFR Section 164.5224 use \\\"HIPAAROA\\\" as the security label policy code.\\r\\n\\r\\nInformation disclosed under a HIPAA 42 CFR Section 164.524 no longer has the level of confidentiality protection afforded under the 45 CFR Section 164.506 - Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is considered the \\\"norm\\\", assign the HL7 Confidentiality code \\\"M\\\" (moderate), which may be protected under other laws such as the Federal Trade Commission privacy and security regulations.",
  "system" : "http://terminology.hl7.org/CodeSystem/v3-ActCode",
  "property" : [ {
    "_uri" : "http://hl7.org/fhir/concept-properties#status",
    "code" : "status",
    "valueCode" : "active"
  }, {
    "_uri" : "http://terminology.hl7.org/CodeSystem/utg-concept-properties#v3-internal-id",
    "code" : "internalId",
    "valueCode" : "24119"
  }, {
    "_uri" : "http://hl7.org/fhir/concept-properties#parent",
    "code" : "subsumedBy",
    "valueCode" : "_ActUSPrivacyLaw"
  } ],
  "codesystem" : "638964c5-6f49-5686-925e-fad50ec626e9",
  "concept_id" : "c215afdd-5ef4-5730-bbaa-7711afd861fc",
  "ancestors" : {
    "HIPAAROA" : 0,
    "_ActPolicyType" : 4,
    "_ActPrivacyLaw" : 2,
    "_ActUSPrivacyLaw" : 1,
    "_ActPrivacyPolicy" : 3
  },
  "id" : "84997f25-86f1-4818-84fe-3800003c20fb",
  "code" : "HIPAAROA",
  "display" : "HIPAA Right of Access",
  "version" : "9.0.0"
}