Access to PHI

Your Rights Under HIPAA

By law, you or your legal representative has the right to view and/or get copies of your protected health information from health care providers who treat you, or by health plans that pay for your care. You also have the right to have a provider or plan send copies of your information to a third party that you choose, such as other providers who treat you, a family member, a researcher, or a mobile “app” you use to manage your personal health information. This includes:

• Medical and billing records (except psychotherapy notes)
• Information related to your enrollment in health plans
• Claims and case management records
• Any other records that contain information that doctors or health plans use to make decisions about you or others

Your providers and plans should have an easy process for you to ask for your health information, and you should be able to ask for it at a time and place that’s convenient for you. You may have to fill out a health information “request” form, and pay a reasonable, cost-based fee for copies. Your providers or plans must tell you about the fee when you make the request. The fee can only be for the labor to make the copies, copying supplies, and postage (if needed). In most cases, you shouldn’t be charged for viewing, searching, downloading, or sending your information through an electronic portal.

Generally, you can get your information on paper or electronically. If your providers or plans store your information electronically, they generally must give you electronic copies unless there are security concerns. However, you do have a right to get your records through unencrypted email if you prefer.

You have the right to get your information as quickly as possible, but it may take up to 30 days to fill the request.

For more information, visit hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html