NHCIP notifies the recipient. Access opens only after consent is granted, and the request is fully audit-logged.