A hospital enforces the Code of Fair Information Practices. What practice applies to a patient requesting their medical records from a web portal?

Use Limitation restricts how collected data may be used beyond its original purpose, which governs the organization's internal data handling rather than a patient's right to access their own records.

Individual Participation is the Fair Information Practice principle that gives data subjects the right to know what records are held about them, to access those records, and to request corrections. A patient requesting their own medical records from a portal is exercising exactly this right of access and participation in the management of their personal data.

Purpose Specification requires that the reason for collecting personal data be clearly defined at the time of collection, which is a disclosure obligation on the organization, not a patient access right.

Collection Limitation restricts the amount and type of personal data that can be gathered in the first place, addressing data minimization during collection rather than a patient's ability to retrieve existing records.