- Shipped
- August 27, 2026 at 6:22 AM UTC
- Author
- Kamo
- Commit
- d44ea69
Previewing a summary recorded a disclosure naming the recipient — so a patient asking who has their record under §164.528 would be told it went to somebody who never received it. The bytes go no further than the records officer's screen. Over-reporting an accounting is the safe direction in general, but a false sentence to the person the accounting exists for is not a rounding error. The PHI ACCESS row is still written for a preview, which is what the original call was defending against: preview must not become a quiet route to reading a chart summary. Access and disclosure are different ledgers answering different questions — "who looked" and "who has a copy" — and conflating them is what produced this. Three tests: releasing records one, previewing records none, and previewing still audits the read.