A. An individual has the following rights:

1. Except as otherwise provided in state or federal law, to opt out of having the individual’s individually identifiable health information accessible through a health information organization pursuant to section 36-3803.

2. To request a copy of the individual’s individually identifiable health information that is accessible through the health information organization in accordance with the health insurance portability and accountability act (45 C.F.R. § 164.524). The health information organization may provide this right directly or may require health care providers or other persons participating in the health information organization to provide this access to individuals. Charges for copies are governed by section 12-2295.

3. To request the amendment of incorrect individually identifiable health information accessible through the health information organization.

4. To request a list of the persons who have accessed the individual’s individually identifiable health information through the health information organization for a period of at least three years before the individual’s request. This list must be provided to the individual within thirty days after the individual’s request.

5. To be notified, pursuant to section 18-552 and Title 45 of the Code of Federal Regulations, Part 164, subpart D, of a breach at the health information organization that affects the individual’s individually identifiable health information.

B. If an individual does not have the capacity to make health care decisions, the individual’s health care decision maker may exercise all individual rights in this chapter on behalf of the individual.