A number of practices have been developed to help improve communications between patients and providers regarding the collection, use, and dissemination of health information. These practices make individuals more aware of their rights regarding their health records, the consent they give for using and disseminating health information, and the existence of electronic medical records. In the short term, greater patient awareness of data issues and their rights may create liabilities for the organization: better-informed patients are more likely to hold organizations responsible for protection of their health information. In the long term, however, organizations using these practices are more likely to evolve cultures that value the protection of health information and avoid potential liabilities, fostering more open and candid interactions between patients and providers and increasing the likelihood that relevant data will be available for patient care.

Some organizations have developed or adopted a patient bill of rights that outlines clearly the relationship between patient and provider; states the patient's rights to privacy and confidentiality; and outlines state and federal laws, regulations, and standards guaranteeing those rights. For example, it may describe a patient's right to view the audit trail related to a hospital stay or the procedures by which a patient may review the contents of his or her health record and correct information he or she believes is inaccurate.¹⁰ The name and telephone number of a contact person within the organization who is responsible for patient complaints with regard to privacy and security (e.g., an information security officer) is included for patients who believe that their rights have been violated. The patient bill of rights is coordinated with forms authorizing disclosure of individually identifiable health information to ensure compatibility between the two documents.

Disclosure authorization forms inform patients of the existence of the electronic health record and describes the policies and procedures in place