Who is responsible for amendment of protected health information in an electronic health information exchange environment?
The HIPAA Privacy Rule designates a covered entity as the responsible party for acting on an amendment request. However, a health information organization (HIO), acting as a business associate of the covered entity, may be required by its business associate contract to perform certain functions related to amendments, such as informing other participants in the HIO’s health information exchange who are known to have the individual’s information, of the amendment. See 45 C.F.R. § 164.504(e)(2)(i)(F).
