In health information management, who holds the right to control the information within the health record according to federal and state laws?

• A. The patient
• B. The custodian
• C. The physician
• D. The insurer

Answer: (A)

The patient is the one who holds the right to control information in the health record. Under federal laws like HIPAA and related state privacy laws, individuals have rights that allow them to access their PHI, authorize who may see it, and limit or direct disclosures. The health information custodian—the organization that maintains the record—has the duty to protect and manage the record and to comply with the patient’s requests, but the authority over whether information can be released and to whom ultimately rests with the patient. Physicians and insurers may access or disclose information only as permitted by law or with the patient’s explicit authorization, for purposes such as treatment, payment, or health care operations. So the patient is the best answer because the rights to control and authorize disclosures stem from the individual whose information it is.