NIST Privacy Framework, Control-PCT.DM-P3

Correct inaccurate or incomplete personal data on request without undue delay, and pass the correction on to recipients the data were disclosed to.

Correct personal data on a data subject's written application where it is incomplete, incorrect, misleading, excessive or irrelevant to the purpose it is held for, without obliterating the pre-amendment text of the document, or give written reasons for refusing and tell the data subject of the right to complain to the Information Commissioner within twenty-eight days.

Correct inaccurate, incomplete, ambiguous, outdated or unlawfully processed personal data on request and pass the correction on to every recipient within thirty days.

Correct or update a data subject's personal data within twenty business days of the request, and block the data under review while you do.

Correct inaccurate, incomplete, misleading or out-of-date personal data on request, free of charge and without excessive delay, and pass the correction on to every other data controller or third party the data were disclosed to in the year before the request.

Let a natural person, or their representative, insert information in their own EHR through the electronic health data access services or applications linked to them, keep that information clearly distinguishable as inserted by the natural person or the representative, and do not let them directly alter electronic health data and related information inserted by health professionals (Article 5).

Enable a natural person to easily request online, through the electronic health data access services, the rectification of their personal electronic health data in accordance with Article 16 of Regulation (EU) 2016/679, and where appropriate verify the accuracy of the information with a relevant health professional (Article 6).

Correct inaccurate or incomplete personal data on demand, and update your records without undue delay.

Give a data subject access to, and let them rectify, their personal data on written request, unless a refusal ground under the Act applies.

Amend personal data on a data subject's application where it is incomplete, incorrect, misleading, excessive, or irrelevant to the purpose it is held for.

If you are the Health Service Executive, provide access to an Electronic Health Record to the patient, an appropriate person and a provider treating the patient, let a patient request rectification, and make information about each access available to the patient free of charge and without delay (Sections 13 and 15).

Determine within 30 days of a rectification request whether the personal data is inaccurate, correct it where it is, and give notice to the individual and to everyone the data was disclosed to in the preceding twelve months.

Correct an error or omission in an individual's personal information when satisfied on reasonable grounds that a correction request should be implemented, send the corrected information to each organization it was disclosed to during the previous year, and annotate the information with the correction requested when you make none.

As a data processor, keep personal data secure in the same way, update or correct it as the controller instructs within five business days, and adopt an internal manual of policies and procedures for handling consultations and claims.

Delete Personal Data once the purpose it was collected for is satisfied, or hold it in a form that does not allow the Data Subject to be identified, and correct any error immediately on being told of it or becoming aware of it.