May a participant in a health risk assessment later request an amendment to or a restriction of the assessment information?
RESPONSE: Information created and maintained by a covered entity (e.g., healthcare provider, health plan), is subject to the HIPAA Privacy Rule which allows a patient to request an amendment and/or a restriction of access to his or her protected health information, as well as exercise all other privacy rights.
