Know Your Rights
HIPAA and Your Rights to Your Health Information

November 2017
Digital Health

Download

En Español

What is HIPAA and why should I care?

HIPAA, also called the Health Insurance Portability and Accountability Act of 1996, is a federal law that aims to keep your health information private and safe.

This law sets rules for who is allowed to see your health information. It also gives you the right to get your own health information, and to send it to other people like your family or an app on your phone. This is called the “individual right of access.”

Talk Like a Pro

Knowing these terms may help you get your health information faster.

HIPAA: This law says how doctors, hospitals and other health care providers have to protect and share your personal health information.

Right of Access: This is part of HIPAA and gives patients the right to see and get a copy of their health information.

Protected Health Information (PHI): Created by your doctor or health insurance company, this includes things like your health status, health care history and payment history.

Access Request: This is a form patients sign to get their own health information.

HIPAA Authorization/Release Form: This form gives your provider permission to share your health information with another doctor; an insurance company; or someone else, like a spouse or child.

Chief Privacy Officer: This person at your doctor’s office or hospital is in charge of protecting your health information. Their name and phone number should be in the Notice of Privacy Practices you get when you fill out paperwork.

What health information do I have a right to get?

You have the right to see and get a copy of your own health information from most doctors, hospitals, pharmacies, nursing homes, and your health insurance plan.

You can get information like:

  • Medical records
  • Billing records
  • Insurance information
  • Lab test results (like x-rays)
  • Vaccine records
  • Visit notes from your doctor

You also have the right to an electronic copy of your records, if your doctor has your records in an electronic format or can easily make them digital.

What health information is off limits?

You cannot see or get information that is not used to make decisions about your care. For example, you cannot get information your doctor wrote that his employer uses to measure how good he is at his job. Also, your doctor can refuse your request to see notes about your mental health care.

Can I get my loved one’s health information?

For children, it depends on which state you live in and their age. HIPAA allows you to access health information for an elderly parent or other loved in certain situations. For example, in the case of a medical emergency, a provider can share important information with family or other caregivers if it’s in the best interest of the patient.

How do I get my health information?

  1. Ask if your doctor has an online “patient portal” where you can see and download your health information.

    or
  2. Fill out a form at your doctor’s office. Ask the receptionist for a “Request for Health Information” form. If you need help, talk to the medical records department in your doctor’s office or hospital.

How long will it take to get my information?

Doctors have to respond to your request within 30 days. If your doctor needs more time, she can have another 30 days but has to send you a letter noting that it is taking longer and telling you when you will get your information.

Can my request be denied?

Yes, but only in certain situations. For example, your doctor does not have to share information if he is worried that the information could endanger your life or physical safety, or someone else’s.

If your doctor refuses your request, she has to send you a letter within 30 days clearly explaining why and telling you how to file a complaint.

What if I have an unpaid bill?

Your doctor still has to give you your health information, even if you have an unpaid bill.

How much will it cost to get my information?

Usually using a patient portal is free to you. Doctors can charge a fee for copies of your health information to cover the cost of their time, supplies and postage, for example. Ask your doctor to tell you how much it will cost before you complete the form.

What if I cannot afford the fee?

If you cannot get your information for free from an online patient portal, you may want to ask for fewer pieces of information. For example, maybe you only need one test result to share with a new doctor. Usually this will cost less because your doctor’s office has to do less work.

How long do providers have to keep my records (on file)?

Most doctors keep medical records for 5–10 years. Laws about how long doctors and hospitals have to keep records depend on which state you live in, and whether the patient is a child.

I requested my information but did not get a response. What should I do?

Contact the Chief Privacy Officer in your doctor’s office; they should be able to help. You can also file a complaint with the federal Office for Civil Rights (OCR). You can email your complaint to OCRComplaint@hhs.gov or send it in online here: https://ocrportal.hhs.gov/ocr/cp/complaint_frontpage.jsf. Include your name, contact information, information about your doctor, and information about what happened.

Download this information

Back to Digital Health