Who can access my medical records without my permission

Information in medical records is considered highly private and sensitive. But are there ever instances where a doctor may share patient information without their permission? It depends, but generally only under extraordinary circumstances.

Medical ethics rules, state laws, and the federal law known as the Health Insurance Portability and Accountability Act (HIPAA), generally require doctors and their staff to keep patients' medical records confidential unless the patient allows the doctor's office to disclose them. However, there are a variety of circumstances under which a doctor may share the information in medical records and personal medical information without permission from the patient. The following are some examples.

The Doctor and/or Patient Needs Help

If the patient has suffered some traumatic injury and cannot make medical decisions for themselves, the doctor may discuss the patient's medical information with their next of kin. The family member will often need this information so they can make an informed decision about the next steps in medical treatment. If the patient has a living will or a healthcare power of attorney, the doctor may only discuss the patient's condition with the people named in those documents.

Even in cases not involving traumatic injuries, HIPAA allows doctors to share patient information and records with other health care providers as necessary for their health and treatment. They may also discuss a patient's condition with family, relatives, and friends that the patient identifies as being involved in their healthcare (unless the patient objects). However, health care providers generally can't share personal medical information and records with providers who aren't involved in the patient's care, unless all personal identifiable information is removed.

The Government Requires Patient Information

The government and legal system usually respect patients' privacy and don't require doctors to disclose personal medical information. However, there are a few basic data points doctors must report. Doctors must file birth and death certificates. They must also report certain diseases they've treated over a certain time period so that the government can monitor the nation's health, although these disclosures don't usually include the patients' names. Doctors can also use your health information if necessary to protect public health, such as reporting a flu outbreak.

Doctors must also report suspected cases of child abuse, even when the child or parent don't expressly authorize the disclosure. Similarly, if a doctor thinks their patient's mental state will cause them to be a danger to themselves or others, they may report this in order to prevent harm to others.

The Patient Makes Their Health an Issue in Court

If the patient brings a personal injury or workers' compensation claim, in which his health is a major issue in the case, the doctor may come to court and testify about the patient's injuries. However, if the patient's health is not necessary to the case's resolution, the doctor usually cannot be forced to testify.

Talk to an Attorney About Your Patient Information

Medical privacy laws are varied and complex, particularly since they are addressed by both state and federal laws. If you're concerned that your doctor shared patient information without your permission, in an improper manner, you should consider speaking with an experienced health care attorney today.

Who can access my medical records without my permission
This guidance remains in effect only to the extent that it is consistent with the court’s order in Ciox Health, LLC v. Azar, No. 18-cv-0040 (D.D.C. January 23, 2020), which may be found at https://ecf.dcd.uscourts.gov/cgi-bin/show_public_doc?2018cv0040-51. More information about the order is available at https://www.hhs.gov/hipaa/court-order-right-of-access/index.html. Any provision within this guidance that has been vacated by the Ciox Health decision is rescinded.

The Privacy Rule gives you, with few exceptions, the right to inspect, review, and receive a copy of your medical records and billing records that are held by health plans and health care providers covered by the Privacy Rule.

Access

Only you or your personal representative has the right to access your records.

A health care provider or health plan may send copies of your records to another provider or health plan only as needed for treatment or payment or with your permission. 

The Privacy Rule does not require the health care provider or health plan to share information with other providers or plans.

HIPAA gives you important rights to access your medical record and to keep your information private.

Charges

A provider cannot deny you a copy of your records because you have not paid for the services you have received. 

However, a provider may charge for the reasonable costs for copying and mailing the records. The provider cannot charge you a fee for searching for or retrieving your records.

Provider’s Psychotherapy Notes

You do not have the right to access a provider’s psychotherapy notes. 

Psychotherapy notes are notes that a mental health professional takes during a conversation with a patient. They are kept separate from the patient’s medical and billing records. HIPAA also does not allow the provider to make most disclosures about psychotherapy notes about you without your authorization.

Corrections

If you think the information in your medical or billing record is incorrect, you can request a change, or amendment, to your record. The health care provider or health plan must respond to your request. If it created the information, it must amend inaccurate or incomplete information. 

If the provider or plan does not agree to your request, you have the right to submit a statement of disagreement that the provider or plan must add to your record.

See 45 C.F.R. §§ 164.508, 164.524 and 164.526, and OCR's Frequently Asked Questions.

Content created by Office for Civil Rights (OCR)
Content last reviewed November 2, 2020