HIPAA is the main federal law in the United States that protects the privacy of your medical information, and it gives you real, usable rights over your own records: to see them, to get copies, to ask for corrections, and to know the rules about who may view them. You do not need to be a lawyer, or to quote the law, to use these rights — in most cases you simply ask your provider’s office, or its designated privacy contact, and they take it from there. This article explains those rights in plain language, in general terms.
Key Takeaways
- HIPAA — the Health Insurance Portability and Accountability Act — sets national rules for how health care providers, health plans, and the organisations that work for them must handle your health information.
- You generally have the right to see your medical records and to get copies, in paper or electronic form, and to have a copy sent to someone you choose.
- If you believe something in your record is wrong or incomplete, you can ask for it to be corrected; if the provider disagrees, you can usually have your disagreement noted in the record.
- Your information may be used and shared for your treatment, for payment, and for running the service without asking you each time; most other uses generally need your written permission.
- If you believe your privacy has not been respected, you can raise it with the provider and complain to the U.S. Department of Health and Human Services — exercising that right is itself protected.
- Rules and procedures change, and details vary by setting. For current specifics, your provider’s privacy officer and the HHS website are the right sources.
What HIPAA Is, in Plain Terms
HIPAA has several parts; the part patients meet most often is its Privacy Rule, which covers what is called “protected health information” — health information that identifies you, held by organisations the law covers. Those covered organisations include most health care providers, health insurance plans, and the companies that handle information on their behalf. They must safeguard your information, use and share only what is appropriate, and respect the rights described below.
Two limits keep the picture honest. First, HIPAA binds the organisations it covers — it does not govern every piece of health-related information everywhere. Information you share yourself, for example in an app or with a service that is not a covered organisation, may sit under different rules or none, so it is worth thinking before sharing records outside your care team. Second, HIPAA protects your information from being shared without regard to the rules — it never stops you from seeing, copying, or sharing your own information as you wish. Our pillar guide to navigating breast cancer care sets these rights within the wider business of records, referrals, and dealing with the system.
Your Rights Over Your Own Records
The rights below are the ones patients use most. The descriptions are general — your provider’s notice of privacy practices, a document you are usually offered early in care, sets out how they work at that organisation.
| Your right, in general terms | What it means | The usual first step |
|---|---|---|
| See and copy your records | You can generally inspect your medical records and request a copy, paper or electronic. A reasonable, cost-based fee for copies may apply in some cases. | Ask the provider’s office or medical records department; a form or written request may be used. |
| Direct a copy to someone else | You can generally ask for a copy to be sent to a person or organisation you name — another doctor, for example. | Make the request in writing, naming exactly who should receive it. |
| Ask for a correction | If you believe a record is wrong or incomplete, you can ask for an amendment. If the provider declines, you can generally have a note of your disagreement kept with the record. | Put the request in writing, identifying the entry and the change you are asking for. |
| Know who has received your information | For certain disclosures outside treatment, payment, and everyday operations, you can generally ask for an accounting of who your information was shared with. | Ask the provider’s privacy contact how to request this. |
| Be told if your information is involved in a breach | If unsecured information is breached in a way the rules cover, the organisation generally must notify you. | Watch for the notification and follow its advice; keep the letter with your records. |
Who May See Your Information
Most sharing that happens in ordinary care does not need your signature each time. Providers may generally use and share your information to treat you (including coordinating between the doctors and nurses involved in your care), to obtain payment, and to run their own operations, such as quality review. This ordinary sharing is what makes referrals, shared records within a care team, and billing work at all.
Beyond that, the general picture is:
- Family and people you involve. Providers can generally share relevant information with family members or others you identify as involved in your care, when you agree or do not object — and you can say who you do and do not want included. If you want a partner or adult child to receive information freely, tell the team and ask what they need from you to note that.
- Uses that need your written permission. Most uses outside treatment, payment, and operations — marketing is the common example — generally require your signed authorisation, which you can also generally take back in writing.
- Sharing the law requires or allows regardless. There are specific situations — certain legal requirements, serious safety concerns, public health activities, and similar — where sharing is required or permitted without your permission. These are defined situations, not a general licence, and your provider’s privacy notice describes them in more detail.
If you are ever unsure why someone has your information, asking is reasonable and normal. Knowing which members of the wider team do what — explained in our guide to medical, surgical, and radiation oncology — also helps you understand why records move between the people treating you.
If Something Goes Wrong
If you believe your information was used or shared in a way the rules do not allow — or that a right described here was refused without a proper reason — you have a route to follow. Start with the provider: raise it with the office or its privacy officer, in writing if you can, and keep a copy with dates. Many problems turn out to be misunderstandings or fixable errors, and a clear, written question is the fastest way to resolve them.
If you are not satisfied, you may complain to the U.S. Department of Health and Human Services, whose Office for Civil Rights handles HIPAA complaints; its website explains how complaints are made and what information to include. Filing a complaint is your right, and a provider may not treat you worse for having done so. Because procedures and timeframes are set by HHS and can change, check its website for the current specifics rather than relying on any summary — including this one. Support staff at your centre, including the support services team, can also help you find the right office to contact.
Questions to Ask Your Provider’s Office
- How do I request a copy of my medical records, and can I have them electronically?
- Who is your privacy officer, and how do I contact them with a question about my information?
- I believe an entry in my record is wrong. How do I request a correction?
- I would like my partner to be able to receive information about my care. What do you need from me to allow that?
- Can I have a copy of your notice of privacy practices to take home?
Frequently Asked Questions
Can I see everything in my medical record?
Generally, you have the right to see and copy your records held by a covered provider, with a small number of specific exceptions that the provider would need to explain. If a request is refused in whole or in part, ask for the reason in writing and, if you disagree, ask the privacy officer how the decision can be reviewed.
Can I have my records sent to another doctor, or to myself electronically?
Generally, yes. You can usually request your copy in electronic form where the records are held electronically, and you can ask for a copy to be sent directly to a person or organisation you name. A written request naming the destination clearly is the usual way to arrange it.
Can my family see my medical records?
Not automatically. Providers can generally share information with family or others involved in your care when you agree or do not object, and you control who is included. Access to your full record, though, is yours to grant — if you want a family member to have copies, tell the provider and ask what authorisation they need from you.
What if my provider refuses to correct something I believe is wrong?
Ask for the refusal in writing with the reason. Even where a provider declines to change a record, you generally have the right to submit a statement of disagreement that is kept with the record, so that anyone reading it later sees your position alongside the entry. Your provider’s privacy officer can explain the exact steps at that organisation.
Does HIPAA stop my employer from seeing my medical information?
In general terms, your provider may not hand your information to your employer without your permission, outside specific situations defined in the rules. HIPAA itself mainly governs providers, health plans, and their business partners rather than employers directly, and other laws may also apply to workplace situations — for anything specific to your job, your provider’s privacy officer or HHS’s published guidance is the right place to check.
Related Articles
- Navigating Breast Cancer Care: A Complete Guide
- Support Services Through Your Cancer Center: What to Ask About
- Medical Oncology vs Surgical Oncology vs Radiation Oncology
This article is for general educational purposes only and is not medical, legal, or financial advice. It does not replace professional care. Talk to your doctor or care team about your own situation. If you think you may have a medical emergency, call 911.