NIST Privacy Framework, Communicate-PCM.AW-P4

Give a personal data subject, once a calendar year and free of charge, information about the transmission of their personal data to third parties, under Article 12.

Tell a data subject which public and private entities you shared their data with, let them object to processing carried out under a consent exemption where it violates this law, and let them revoke consent at any time through a free and easy procedure.

Give a natural person information, including through automatic notifications, on any access to their personal electronic health data through the health professional access service obtained in the context of healthcare, including access provided in accordance with Article 11(5), free of charge and without delay through the electronic health data access services, available for at least three years from each date of access and stating at least the healthcare provider or other individuals who accessed the data, the date and time of access and which data were accessed (Article 9(1) and (2)).

If you are the Health Service Executive, provide access to an Electronic Health Record to the patient, an appropriate person and a provider treating the patient, let a patient request rectification, and make information about each access available to the patient free of charge and without delay (Sections 13 and 15).

Pass on any rectification, erasure or restriction to every recipient the data were disclosed to, unless that is impossible or disproportionately difficult, and tell the data subject who those recipients are on request.

Give a Maryland consumer a means to confirm whether you process their personal data, access it, correct it, delete it, receive a portable copy, and obtain a list of third-party categories it was disclosed to.

Provide a Minnesota consumer, on request, a list of the specific third parties you disclosed their personal data to, not merely categories of third parties.

Give a Nevada consumer the right to access their consumer health data, obtain a list of third parties it was disclosed to, stop its collection, sharing, or sale, and delete it.

On a registered person's request, disclose what personal data has been accessed, when, by whom, the purpose, manner and duration of access, how long the data will be stored, and whether any profiling or automated decision-making process is being applied to it.

Give a Vermont consumer access, correction, deletion, portability, opt-out of targeted advertising and sale, a profiling explanation and reevaluation right for housing decisions, and a list of third parties their data was sold to.

Maintain a registry of every database you disclose to third parties, covering its legal basis, its contents, who receives it, retention periods and everyone who accessed it, and produce that registry to ANTAI on request.

Before disclosing personal data to a requester, identify the requester and the purpose, notify the data subject, and record how long the requester will hold the data and how it will be destroyed, unless the data subject has consented.