¡Gives patients the right to access their medical records and to know who accessed their health information ¡Restricts most disclosures of PHI to the minimum necessary ¡Establishes criminal and civil penalties for improper use or disclosure ¡Establishes new requirements for access to records by researchers