On the specific issue of disclosure and accountability:

• Before a provider initiates a transfer of personal health information, affected patients should fully understand the policies in place and the possible uses of that information. The Health Information Environment is premised on a model of patient authorization and control. Patients must be able to: choose whether or not to participate in sharing personally identifiable information; exercise their rights under HIPAA; control who has access to their records (whether in whole or in part); see who has accessed their information; review, contribute to and amend their records (without unreasonable fees); receive paper or electronic copies of their information; and reliably and securely share all or portions of their records among institutions. Once patient consent has been granted for a certain type of information access, however, information should be able to be accessed freely in a trusted environment.
• Information elements central to network functioning, such as identifiers, authorizations and permissions, access histories, and location entries, must be presented in easily understood terms and formats to patients and other authorized users for their review and possible correction.
• Patients must be able to gain access to any of their information available across the national network, consistent with HIPAA.