Many state and local public health departments are covered entities under the Health Insurance Portability and Accountability Act (HIPAA) and must provide individuals with access to their protected health information. However, covered entities that are unfamiliar with a key provision of the Health Information Technology for Economic and Clinical Health (HITECH) Act, and its implications for the use of written authorizations to release protected health information to a third party, may be in jeopardy of violating the right of access.