Ohio Rev. Code § 3798.03: Duty of covered entities.

(A) Subject to division (B) of this section, a covered entity shall do both of the following:

(1) If an individual's protected health information is maintained by the covered entity in a designated record set, provide the individual or the individual's personal representative with access to that information in a manner consistent with 45 C.F.R. 164.524;

(2) Implement and maintain appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information in a manner consistent with 45 C.F.R. 164.530(c).

(B) If a covered entity is a hybrid entity, this section applies only to the health care component of the covered entity.