Your Medical Records: Are They All In One Place?

In the US, patients have the right to request and receive copies of their medical records under federal privacy laws, such as HIPAA, and state laws. However, there are some exceptions, and the process may vary depending on the state and the healthcare provider. For example, in New York, physicians and hospitals are required to maintain patient records for at least six years from the last visit, but there is no guarantee that childhood immunization records will be available after a certain number of years. To access medical records, individuals may need to submit a written request, provide identification, and pay associated fees. In some cases, medical records can be accessed through online patient portals, which often require two-factor authentication. It's important to note that psychotherapy notes are generally not accessible to patients and are kept separate from medical and billing records.

How to request medical records

In general, the process of requesting medical records is straightforward. However, the specific steps may vary depending on the healthcare provider and the location. Here is a step-by-step guide on how to request your medical records:

Check the healthcare provider's online patient portal:

Many healthcare providers offer online patient portals, which are secure websites where patients can access various services, such as making appointments, contacting their provider, and viewing lab results. Some providers may allow patients to download their medical records directly from the patient portal. It is worth checking if your healthcare provider offers this option.

Contact the healthcare provider:

If the medical records are not available through the patient portal, the next step is to contact the healthcare provider directly. This can often be done through their website, by email, or by phone. They should be able to provide information on the process for requesting medical records, including any required forms or documentation.

Fill out the required forms and provide identification:

In most cases, you will need to complete an authorization form to request the release of your medical records. This form will typically require information such as the type of records requested and the dates of your visits. Some providers may also require you to provide a copy of a valid photo ID, such as a passport or driver's license.

Specify the format and delivery method:

When requesting medical records, you may need to specify whether you want a physical or digital copy. Additionally, confirm with the provider how you would like to receive the records, such as by mail, email, or in person.

Inquire about any associated costs:

Obtaining medical records may incur fees, so it is important to ask the healthcare provider about any costs beforehand. The fees may vary depending on the number of copies and the format of the records.

Requesting records on behalf of another individual:

If you are requesting medical records on behalf of someone else, such as a minor or a deceased relative, additional steps and documentation may be required. In most cases, you must have legal authority or be a personal representative to access another individual's medical records. This could include having a medical power of attorney or being a health care proxy.

It is important to note that the process may vary depending on your location and the specific policies of the healthcare provider. Always contact the provider directly for the most accurate and up-to-date information on requesting medical records.

Online patient portals

In the US, many healthcare providers now offer online patient portals. These are secure websites that give patients 24-hour access to their personal health information. Patients can use a secure username and password to log in and view their health records, including test results, billing, and prescriptions. They can also make appointments, contact their provider, and even receive diagnosis and treatment options for minor issues.

To access a patient portal, you will first need to set up an account and prove your identity. You can then log in and view your health information. If you need records from another service, such as a hospital or dentist, that has not been sent to your GP, you may need to contact that service directly. In the US, under the HIPAA Privacy Rule, your healthcare provider must give you access to your record within 30 days of your request. However, you do not have the right to access a provider's psychotherapy notes without their authorization.

In the UK, patients can view their GP health record using the NHS App or by logging into their account on the NHS website. As with US patient portals, you will need to create an account and verify your identity before you can access your records. If you need to access older information, you may need to request that your GP surgery makes it available online.

It is important to note that patient portals are not meant for urgent issues. If you have a time-sensitive request, it is recommended that you contact your provider's office directly.

Fees for obtaining records

Fees for obtaining medical records vary depending on the state, the format of the records, and the purpose of the request. In the US, the Health Insurance Portability and Accountability Act (HIPAA) provides a baseline for pricing, and each state may have its own specific legislation regarding fees.

Some states, like Arizona, do not have specific copying fees but require fees to be cost-based. In contrast, other states, like Alabama, charge a flat fee per page for the first set of pages and a lower fee for each additional page. For example, Alabama charges $1 per page for the first 25 pages, 50 cents per page for each additional page, and a $5 search fee. On the other hand, Arizona charges a $15 search fee, 50 cents per page for the first 25 pages, 25 cents per page for pages 26 and beyond, and allows a reasonable retrieval fee for off-site records.

Some states, like Rhode Island, waive fees if the records are necessary for supporting an appeal under the Social Security Act, while others, like California, provide one free copy of medical records to patients or their representatives.

It is important to note that fees may also apply for transmitting records to a third party, and there may be additional charges for postage, shipping, and delivery of the requested records.

If you are requesting your health record, it is recommended to ask your provider about the cost beforehand and decide whether you will obtain the copy yourself or have the provider do it. Additionally, you can check your provider's online patient portal, as some health information may be available there.

Restrictions on record access

In the United States, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) defines "individually identifiable health information" and outlines the privacy rules that protect the security of individuals' identifiable health information. Under HIPAA, individuals have the right to access their Protected Health Information (PHI) as long as it is maintained by a covered entity or a business associate of the entity. This includes medical and billing records maintained by a healthcare provider, as well as payment and insurance information.

However, there are some restrictions and exceptions to this right to access. Firstly, individuals do not have the right to access a provider's psychotherapy notes. These are notes taken by a mental health professional during conversations with a patient and are kept separate from the patient's medical and billing records. Additionally, while parents or guardians are typically the personal representatives for their children's medical records, some states treat teenagers under 18 as adults and restrict parental access to certain healthcare information about their teenage children.

Furthermore, there may be situations where an individual's personal representative is unable to obtain copies of all or part of the individual's records due to state or other laws. For example, employers, insurance companies, and certain other entities are partially exempt from the Texas Medical Records Privacy Act.

In terms of the process of accessing records, the HIPAA Privacy Rule allows covered entities to require that individuals request access in writing and verify their identity. However, entities cannot impose unreasonable measures that delay or hinder an individual's access to their records. There may be costs associated with obtaining health records, including labour for copying, and these costs should not include search and retrieval fees.

Additionally, while HIPAA generally protects the privacy of medical records, there are situations where government agencies may access this information. Section 215 of the Patriot Act, for instance, allows the FBI Director to obtain medical records through a court order for investigations related to international terrorism or clandestine intelligence activities.

Amending records

In the UK, patients can request access to their medical records and have the right to request amendments. Clinicians often receive requests from patients regarding information contained in their medical records, ranging from disputes about the accuracy of a clinical diagnosis to entries made in the wrong patient's notes.

If a patient identifies an error in their medical records, they can request an amendment. The patient must first view their medical records, which can be done online via the NHS App or website, or by requesting a printed or digital copy from their GP surgery. Once the error has been identified, the patient can contact the medical practice to request an amendment.

In the US, patients also have the right to request amendments to their healthcare records under the HIPAA Privacy Rule. Practitioners have the right to determine if changes will be made and must respond to the patient within 60 days. If the request is denied, the practitioner must provide a written response, including the reason for the denial, and advise the patient of their right to submit a reply disagreeing with the denial.

It is important to note that if inaccurate information has been in the records for a long time, it may not be appropriate to simply amend it, as decisions may have been made based on that information. In such cases, it is recommended to add an addendum to the records, clearly stating the inaccuracy and providing a date. Any amendments to medical records should be evident in the audit trail, and it is important to inform other individuals who received the original record to avoid detrimental reliance on the outdated information.

Frequently asked questions