This guidance remains in effect only to the extent that it is consistent with the court’s order in Ciox Health, LLC v. Azar, No. 18-cv-0040 (D.D.C. January 23, 2020), which may be found at https://ecf.dcd.uscourts.gov/cgi-bin/show_public_doc?2018cv0040-51. More information about the order is available at https://www.hhs.gov/hipaa/court-order-right-of-access/index.html. Any provision within this guidance that has been vacated by the Ciox Health decision is rescinded.
The Privacy Rule gives you, with few exceptions, the right to inspect, review, and receive a copy of your medical records and billing records that are held by health plans and health care providers covered by the Privacy Rule.
Only you or your personal representative has the right to access your records.
A health care provider or health plan may send copies of your records to another provider or health plan only as needed for treatment or payment or with your permission.
The Privacy Rule does not require the health care provider or health plan to share information with other providers or plans.
HIPAA gives you important rights to access your medical record and to keep your information private.
A provider cannot deny you a copy of your records because you have not paid for the services you have received.
However, a provider may charge for the reasonable costs for copying and mailing the records. The provider cannot charge you a fee for searching for or retrieving your records.
You do not have the right to access a provider’s psychotherapy notes.
Psychotherapy notes are notes that a mental health professional takes during a conversation with a patient. They are kept separate from the patient’s medical and billing records. HIPAA also does not allow the provider to make most disclosures about psychotherapy notes about you without your authorization.
If you think the information in your medical or billing record is incorrect, you can request a change, or amendment, to your record. The health care provider or health plan must respond to your request. If it created the information, it must amend inaccurate or incomplete information.
If the provider or plan does not agree to your request, you have the right to submit a statement of disagreement that the provider or plan must add to your record.
See 45 C.F.R. §§ 164.508, 164.524 and 164.526, and OCR's Frequently Asked Questions.
