San Antonio VA South Texas Healthcare System medical records

Individuals generally may inspect and obtain their protected health information in a designated record set, subject to the rule's exceptions. A covered entity must act within 30 days after receiving an access request; one extension of up to 30 days is permitted if it gives a written reason and completion date within the initial period.

For a breach of unsecured protected health information affecting 500 or more individuals, a covered entity must notify the HHS Secretary without unreasonable delay and no later than 60 calendar days after discovery, subject to law-enforcement delay under § 164.412.

Individuals may request amendment of their protected health information in a designated record set. A covered entity must act within 60 days after receipt; one extension of up to 30 days is permitted if it gives a written reason and completion date within the initial period.