HIPAA Rights: Your Control Over Health Information

Right to Access Your Records:

• Request copies from any provider; they must respond within 30 days
• They can charge a reasonable fee but cannot refuse access
• You can request records in electronic format

Right to Corrections:

• Request corrections to errors; provider must respond within 60 days
• If refused, you can submit a statement of disagreement

Right to Know Who Has Your Data:

• Request an "accounting of disclosures" covering the previous 6 years

Right to Restrict Sharing:

• If you pay entirely out of pocket, you can prevent the provider from sharing that info with your insurer

Breach Notification:

• Organizations must notify you within 60 days if your health data is compromised

Access Rights:

Your healthcare providers and health plans must give you copies of your health information in most cases. This includes:

• Medical records
• Billing records
• Any other records used to make decisions about your care

What You Can Request:

• Specific portions of your record
• Your entire medical record
• Records in electronic format (if available)
• Records sent directly to someone you designate

Provider Response Requirements:

• Must provide access within 30 days (60 days if records are off-site)
• Can charge reasonable cost-based fees for copying
• Cannot deny access except in very limited circumstances
• Must provide records in the format you request if readily available

Accounting of Disclosures:

You can request a list of who your information was shared with, including:

• When it was shared
• Who received it
• Why it was shared
• What information was shared

Communication Preferences:

• You can ask to be contacted in a specific way (home phone vs. cell phone)
• You can ask to be contacted at a specific location
• Providers must accommodate reasonable requests

Mental Health Records:

• Often have additional state law protections
• May require special consent for sharing
• Psychotherapy notes have extra protections under HIPAA

Substance Abuse Treatment:

• Federal regulations provide additional privacy protections
• Generally requires patient consent for any disclosure
• Protected even from law enforcement in most cases

Genetic Information:

• Cannot be used by health insurers for underwriting (under GINA)
• Special protections in employment contexts

Not Covered Entities:

• Employers (except when providing healthcare)
• Life insurers
• Schools (except health clinics)
• Many mobile health apps
• Fitness trackers and wellness programs (unless connected to healthcare)

File with HHS Office for Civil Rights if:

• A covered entity denies you access to your records
• You suspect your health information was used or shared inappropriately
• A covered entity doesn't respond to your requests within required timeframes
• You believe there was a data breach that wasn't properly reported

How to File:

• Online: hhs.gov/ocr/complaints
• Phone: 1-800-368-1019
• Must file within 180 days of when you knew about the violation

Pro Tips:

• Keep copies of all requests you make
• Follow up in writing if you don't get responses
• Know that you have rights even if providers seem reluctant to comply
• Your rights apply to all covered entities, not just your doctor