Your Rights as a Patient: Medical Records, Privacy, and Informed Consent
Patients generally have rights to access health records, receive information about treatment, make informed decisions, and expect protected health information to be handled according to law.
These protections are not identical in every situation. HIPAA establishes federal privacy and record-access rights for covered organizations, while informed-consent requirements often depend on state law, the treatment involved, and the patient’s ability to make decisions.
Requesting Your Medical Records
The HIPAA Privacy Rule generally gives patients the right to inspect or obtain copies of medical and billing records maintained by covered healthcare providers and health plans.
Records commonly available under this right include:
Clinical notes and test results
Diagnoses and medication histories
Treatment and discharge summaries
Imaging reports
Billing and payment records
Insurance claim information
A request can often be made through a patient portal or medical-records department. Ask for the records in the preferred available format, such as an electronic file or paper copy.
A covered organization generally must act on an access request within 30 calendar days. If it cannot respond within that period, it may take one additional extension of no more than 30 days, but it must provide a written explanation and expected completion date within the original period.
State law may require faster access.
Fees and Access Restrictions
A provider generally cannot refuse to supply records because the patient has not paid for medical treatment. It may charge a reasonable, cost-based fee for permitted copying, supplies, and postage.
It cannot charge under HIPAA for searching for or retrieving the records. Request an itemized explanation if a fee appears excessive.
Access rights have limited exceptions. For example, HIPAA generally does not provide a right to access psychotherapy notes kept separately from the regular medical record. Certain information prepared for legal proceedings may also be excluded.
Some access denials can be reviewed by another licensed healthcare professional. A denial should be provided in writing and explain any available review or complaint rights.
Correcting Inaccurate Information
Patients may ask a covered provider or health plan to amend inaccurate or incomplete information in a medical or billing record.
Submit the request in writing and identify:
The disputed entry
Why it is inaccurate or incomplete
The correction or additional information requested
Any supporting documents
A provider does not necessarily have to remove a professional opinion merely because the patient disagrees with it. A request may also be denied when the organization did not create the information or determines that the record is accurate and complete.
If an amendment is denied, the patient generally has the right to submit a statement of disagreement that is added to the record.
How HIPAA Protects Medical Privacy
HIPAA applies to covered health plans, healthcare clearinghouses, and most healthcare providers that conduct specified transactions electronically. It also applies to their business associates when those organizations handle protected health information on their behalf.
HIPAA does not cover every business that possesses health-related information. A fitness app, social-media platform, retailer, employer, or other company may hold health information without being a HIPAA-covered entity.
Covered providers and plans may use or disclose protected information without a separate authorization for purposes such as treatment, payment, and healthcare operations. Other disclosures may also be permitted or required by law, including certain public-health and safety activities.
Patients generally have the right to receive a Notice of Privacy Practices explaining how information may be used, their privacy rights, and how to make a complaint. Signing an acknowledgment normally confirms receipt of the notice; it does not mean the patient agreed to every possible disclosure.
Additional Privacy Requests
Depending on the circumstances, a patient may be able to:
Request communication through a particular address or phone number
Ask for restrictions on certain uses or disclosures
Request an accounting of specified disclosures
Authorize another person to receive records
Revoke an authorization for future disclosures
A covered provider does not have to accept every requested restriction. One important exception may apply when a patient pays for a service completely out of pocket and asks the provider not to disclose information about that service to a health plan for payment or healthcare operations. The provider generally must accept that request unless disclosure is legally required.
An accounting of disclosures does not include every occasion on which information was shared. Disclosures for treatment, payment, and healthcare operations are commonly excluded.
Understanding Informed Consent
Informed consent is more than signing a form. Before a patient agrees to a proposed treatment or procedure, the healthcare professional should provide enough information for a meaningful decision.
Depending on the situation and applicable law, that discussion may include:
The patient’s condition or diagnosis
The proposed treatment or procedure
Expected benefits
Material risks and possible complications
Reasonable alternatives
The likely consequences of declining treatment
An opportunity to ask questions
Requirements differ by state, and some procedures require written consent while others may be authorized verbally or through conduct. The professional responsible for obtaining consent may also vary.
A patient can ask for an interpreter, accessible communication, or a clearer explanation. Signing a form should not prevent the patient from asking additional questions.
The Right to Refuse or Withdraw Consent
An adult with decision-making capacity generally may refuse recommended treatment, even when the healthcare professional believes refusal is unwise. The provider may explain the risks and ask the patient to document the decision.
Consent can often be withdrawn before or during treatment, although stopping a procedure immediately may not always be medically safe. Withdrawal also does not erase charges for services already provided.
Different rules may apply when:
Emergency treatment is needed and the patient cannot consent
A court order authorizes treatment
Public-health law requires specific action
The patient lacks decision-making capacity
A parent, guardian, or healthcare agent is authorized to decide
The patient is a minor
Rules concerning minors, reproductive care, mental-health treatment, and substitute decision-makers differ substantially by state.
When Someone Else Acts for the Patient
A legally recognized personal representative may often exercise the patient’s HIPAA rights. This could be a healthcare agent, legal guardian, or another person authorized under state law.
Providers may request documentation establishing that authority. They may also limit a representative’s access in particular circumstances, including certain situations involving suspected abuse, neglect, or danger to the patient.
Parents usually have access to a minor child’s records, but exceptions can apply when a minor legally consents to care, receives confidential services authorized by state law, or a court or other authorized person directs the treatment.
Responding to a Privacy or Records Problem
Begin by contacting the provider’s medical-records department, privacy officer, or patient advocate. Describe the problem in writing and retain copies of requests, responses, bills, and delivery confirmations.
A complaint involving a HIPAA-covered entity or business associate may be filed with the U.S. Department of Health and Human Services Office for Civil Rights. Complaints generally must be filed within 180 days of when the person knew or should have known about the alleged violation, although that deadline may be extended for good cause.
HIPAA prohibits retaliation for filing a complaint or exercising protected rights.
Concerns involving medical treatment, informed consent, licensing, or professional conduct may instead fall under a state medical board, health department, facility regulator, or court. A serious injury or time-sensitive dispute may require advice from a qualified attorney.
Patients do not need to understand every medical or legal term to exercise their rights. They can request records, ask for explanations, question inaccuracies, and take time to understand proposed care when circumstances permit.
This article provides general information, not individualized medical or legal advice. Patient rights, consent standards, confidentiality rules, and complaint procedures vary by state, provider, treatment, and individual circumstances.
