What Are My Rights to My Own Medical Records?
Under HIPAA you have five distinct rights in your own medical record: to inspect it and get a copy, to receive that copy in the form and format you ask for when the provider can readily produce it that way, to have a copy sent to a third party you name, to request a correction, and to find out who else your information has been disclosed to. Each of the first two carries a clock. A provider has 30 days to act on an access request and may take one 30-day extension with written notice. An amendment request gets 60 days, with the same one extension. If you need to complain to the HHS Office for Civil Rights, you generally have 180 days from when you knew about the problem. These rights apply to covered entities — health plans, most providers, clearinghouses — and their business associates, and to nobody else.
What does the right of access actually cover?
The designated record set — the records used to make decisions about you — rather than literally every document with your name on it.
In practice that is broad. Clinical records, billing records, and, importantly, the outside records another provider sent that have become part of the set. It is not limited to what the provider personally wrote.
Two things sit outside it. Psychotherapy notes that a mental health professional maintains separately from the medical record are excluded, and so is information compiled in anticipation of or for use in a legal proceeding. That first exclusion is narrower than providers sometimes apply it — it covers a therapist’s separately kept process notes, not your diagnoses, medications, treatment plan, session dates, or billing, all of which remain ordinary chart material you are entitled to. Where the lines actually fall is in when a doctor can refuse your records.
Can I get it in the format I want?
Yes, when the provider can readily produce it that way.
If they hold the record electronically and can give you an electronic copy without unreasonable effort, they have to. You can also direct a copy to a third party you name — a new specialist, a family member, an attorney — rather than receiving it yourself and forwarding it on.
Ask specifically. “Electronic” can mean a readable PDF or a structured export built for another system to ingest, and if you do not say which, you may open the file and find markup instead of a chart. The practical version of this is in getting your records online.
What are the deadlines?
Thirty days for access, sixty for a correction, and one thirty-day extension available on each — but only with written notice telling you why.
Several states set shorter deadlines than HIPAA does, and where they do, the shorter one applies. Nobody at the records desk will volunteer this. It is worth a search for your own state’s rule before you accept a long timeline as normal.
In practice the failure mode is almost never refusal. It is silence — the request misfiled, routed to a department that does not handle it, or lost when the person holding it left. Which is why the useful habit is following up at three weeks rather than at thirty days. A request that has quietly gone missing is far easier to resurrect before the deadline than to argue about afterward.
What are my rights if they say no?
A denial has to be in writing, has to state its basis, and in most cases has to tell you how to challenge it.
Access denials divide into two kinds. Unreviewable ones — psychotherapy notes, legal-proceeding material — are final. Reviewable ones rest on a licensed professional’s judgment that release is reasonably likely to endanger someone’s life or physical safety, and those you can require a second licensed professional to review. That safety ground is narrow and explicitly does not cover a worry that the information will upset you.
Amendment denials work differently. If a provider refuses to correct something, you can file a statement of disagreement that becomes a permanent part of the record and travels with the disputed entry — so every future reader sees your correction beside the original. That is covered in correcting an error in your record.
Can I find out who’s seen my records?
You can request an accounting of disclosures, and you should know going in that it is narrower than the name suggests.
It covers disclosures a provider made in the six years before you ask. What it specifically excludes is disclosures made to carry out treatment, payment, and health care operations — which is the overwhelming majority of the times your information moves anywhere. It is not an access log. It will not tell you which staff member opened your chart.
We would rather say that plainly than let you spend two weeks discovering it. This is the weakest of the five rights for most people, it is still occasionally the right tool, and knowing its shape before you ask saves the disappointment.
What are these rights not?
They are not a right to sue, not a right to have a record deleted, and not a right to control what a clinician recorded as their professional opinion.
HIPAA gives individuals no private right of action. You cannot sue a provider under it. Enforcement runs through the HHS Office for Civil Rights, and penalties collected there go to the government rather than to you — which matters, because people sometimes pursue a HIPAA complaint expecting compensation and lose months finding out otherwise. How that process actually works is in filing a HIPAA complaint.
Amendment covers information that is inaccurate or incomplete. It does not let you delete a diagnosis you disagree with or remove an assessment you found unfair. Facts are amendable; opinions are answerable. That distinction is frustrating and it is also the thing that keeps a medical record worth anything.
None of this is legal advice — it is the shape of the rights, so you know which one you are actually exercising. Our own approach to handling your information is on our HIPAA and security page.
Organized.health helps you organize your health information. It does not provide medical advice, diagnosis, or treatment. Always talk to a qualified healthcare provider about your care.
Related: How do I get copies of my medical records? · Can a doctor refuse to give me my medical records? · How do I file a HIPAA complaint?
