Under the HIPAA Privacy Rule, an individual has the right to access the designated record set maintained by a covered entity. The access is broad, with very few limitations on what the individual has the right to access. Since HIPAA was implemented, there has been an ongoing delineation between covered entities that allow employees who are also patients to directly access their medical records versus requiring any access as a patient be done through the same means as nonemployee patients.