The Privacy Rule grants to patients, subjects and participants in research the following rights regarding their protected health information (PHI):

1. A right not to have PHI used in research unless Privacy Rule requirements are satisfied.
2. A right, upon request, to an accounting of disclosures of PHI, except for disclosures permitted by a signed authorization.
3. A right to revoke an authorization for use or disclosure of PHI for research purposes, to the extent researchers have not already relied on the authorization.
4. A right to file complaints with a covered entity and with the federal Department of Health and Human Services.