Contact your doctors’ offices or the health information management or medical records staff at each facility where you received treatment. Find out if your provider has his/her own plan for helping patients to create pesonal health records (PHRs). Ask if your records are in an electronic format that you can access yourself, or if you need to request that they make copies for you. Also, ask your physician or health information management professional to help you determine which parts of your record you need. If you want medical records kept by your health plan, contact the plan’s customer service department.

Ask for an "authorization for the release of information" form. Complete the form and return it to the facility as directed. Most facilities do charge for copies. The fee can only include the cost of copying (including supplies and labor), as well as postage if you request the copy to be mailed. It can take up to 60 days to receive your medical records, so ask when you can expect to receive the information you requested.

Your healthcare provider is allowed to charge a reasonable fee for copies of your health record. The fee should only include the cost of copying (including supplies and labor), as well as postage if you request the copy to be mailed. If you request an explanation of this information, you may also be charged a fee for its preparation.

Even if your physician moved, retired, or died, his/her estate has an obligation to retain your records, including immunization records, for a period defined by federal and state law. Often this retention period is 10 years following your last visit (or until a child/patient is 21 years old). You may be able to locate your records by contacting:

• Your physician’s partners
• The health information manager at a nearby hospital where the physician practiced
• The local medical society
• The state medical association
• The state department of health

If your efforts are unsuccessful, you may have to be re-immunized.

If you know the name of the new healthcare provider you may ask your current physician to send a copy of your health information. You may be asked to make the request in writing and to specify what information you want to have sent.

If you don’t know where you will be receiving care, you have two other options.

• Once you have selected a new healthcare provider, go to his or her office and sign an authorization form, which the office staff will send to your previous provider requesting that copies of the information be sent.
• Ask your current provider’s staff to make a copy of your records, and carry it with you to give to your new provider, when you choose/visit one. You will probably be asked to pay for the cost of copying records, so you may want to ask for help determining which records your new provider will need.

Even if your physician moved, retired, or died, his or her estate has an obligation to retain your records, including immunization records, for a period defined by federal and state law. Often this retention period is 10 years following your last visit (or until a child/patient is 21 years old). You may be able to locate your records by contacting:

• Your physician’s partners
• The health information manager at a nearby hospital where the physician practiced
• The local medical society
• The state medical association
• The state department of health

Yes. If your PHR is stored through an Internet service, it can be accessed. If your phone does not receive Internet access, you may install an application that allows you to print, backup, encrypt, and import data when connected to a computer. Later, when you’re on the go, your PHR can be accessed and edited through your mobile phone.

A Notice of Privacy Practice tells you how your information is used or disclosed and explains who has access to your information. You receive the notice the first time you visit a new healthcare provider, pharmacy, or hospital. You are asked to read and sign an acknowledgement that you received the notice. The law does NOT say you HAVE to sign it, but if you do, it helps the provider to document that you got the information.

Health insurance plans must also provide you with a Notice of Privacy Practice, so if you have health insurance, you received the notice in the mail. Insurance plans don’t ask for your signature.

The law says that anyone can see your health record who needs it in order to provide your treatment, to facilitate payment for healthcare services, and to make sure quality care is being received. Most healthcare organizations have quality assurance departments. People in these departments review patient information in order to monitor and improve the quality of care you receive. Your information may also be used for research and as a legal document in cases where evidence of care is needed. For the most part, anyone who wants to use it for any other purpose needs your permission first.

It is important to be aware that PHRs that are not part of a provider’s electronic health record are not considered to be legal records, and therefore, are not HIPAA covered entities.

Hospitals can share information with family members without your authorization if you are unable to consent and a family member (such as spouse, parent, or child) is involved in providing your care. For example, your spouse or child may be involved in caring for you following a hospital stay (by helping you in and out of bed, to bathe, changing bandages, and similar activities). You can simplify things at the time you are admitted to the hospital (or nursing home) by specifying which family member you want to receive information about you.

Yes, generally parents do have access to their minor children’s health record. There are three circumstances where parents do not have access:

• When the minor is the one who consents to care and the consent of the parent is not required under law;
• If the minor obtains care at the guidance of a court or person appointed by court; and
• When a parent agrees that the minor and healthcare provider have a confidential relationship.

However, access to parents may be permitted in these circumstances if permitted by state or other applicable laws.

To access another adult’s information:

• Have the person you are caring for submit written authorization to his or her physicians’ and healthcare facilities.

• In that authorization, the patient should include language that gives permission to release all information regarding treatment and care to you, and/or anyone else the patient wants to have access.

• This document might also include the names of people the information should NOT be shared with. An example might be a domestic abuse case where the wife would request that a husband not have access to any information.

• Then you’ll need to give this authorization to the healthcare facility’s Health Information Management Department.

In cases of lengthy or permanent incapacity, a legal guardian for the patient may be appointed through court proceedings. In that case, the legal guardian can access the patient’s health records and decide who else can see them.

For information about the health information laws in your state, visit The Center for Democracy & Technology.

Most health records are subject to the HIPAA Privacy Rule.

Health records originated by the federal government, such as the Veterans Administration or Indian Health Services are also subject to the Privacy Act of 1974.

Health records originated by federally subsidized substance abuse programs are subject to the Confidentiality of Alcohol and Drug Abuse Patient Records rule.

If you believe your privacy rights have been violated, you should contact the Privacy Officer of the provider where you believe the violation occurred to try to resolve your concern. If you are unable to resolve your concern locally, you can file a formal complaint regarding the organization’s privacy practices directly to the organization, health plan, or to the Department of Health and Human Services’ Office for Civil Rights (OCR). The OCR is charged with investigating complaints and enforcing the privacy regulation.

Complaints to the OCR must be filed in writing, either on paper or electronically; name the provider that violated your rights according to the privacy rule and what occurred. Complaints must be filed within 180 days of when you knew the act or omission occurred. Violations must have occurred on or after April 14, 2003, for the OCR to have any authority to investigate. For additional information on filing a complaint, visit the OCR Web site.

If you believe your privacy rights have been violated, you should contact the Privacy Officer of the provider where you believe the violation occurred to try to resolve your concern. If you are unable to resolve your concern locally, you can file a formal complaint regarding the organization’s privacy practices directly to the organization, health plan, or to the Department of Health and Human Services’ Office for Civil Rights (OCR). The OCR is charged with investigating complaints and enforcing the privacy regulation.

Complaints to the OCR must be filed in writing, either on paper or electronically; name the provider that violated your rights according to the privacy rule and what occurred. Complaints must be filed within 180 days of when you knew the act or omission occurred. Violations must have occurred on or after April 14, 2003, for the OCR to have any authority to investigate. For additional information on filing a complaint, visit the OCR Web site.

If you are in critical condition and need medical treatment, your family or caregiver must determine and/or approve the treatment you receive. So access to your medical history will help them make the best decision.

No. They can only view your PHR if they have received permission from you.

PHRs (personal health records) are not the same as EHRs (electronic health records). Therefore, you may store your PHR in the form of paper, computers, Internet, or portable devices such as CDs or jump drives.

Your health information is scattered across many different providers and facilities. Keeping your own complete, updated and easily accessible health record means you can play a more active role in your healthcare. You wouldn’t write checks without keeping a check register. The same level of responsibility makes sense for your healthcare.

A patient’s own PHR offers a different perspective, showing all your health-related information. It can include any information that you think affects your health, including information that your doctor may not have, such as your exercise routines, dietary habits, or glucose levels if you are diabetic.

Also, the PHR is a critical tool that enables you to partner with your providers.
It can reduce or eliminate duplicate procedures or processes, which saves healthcare dollars, your time, and the provider’s time. And the information you gather gives you knowledge that assists your preparation for appointments.

With your PHR, you can:

• Knowledgeably discuss your health with healthcare providers
• Provide information to new caregivers
• Have easy access to your health information while traveling
• Access your information when your doctor’s office is closed
• Record your progress toward specific health-related goals
• Refer to physician instructions, prescriptions, allergies, medications, insurance claims, etc.
• Track appointments, vaccinations, and numerous other wellness healthcare services

Yes. A simple file folder with copies of your health records can be very valuable in documenting your health. Electronic PHRs may be more efficient than paper, especially once more physicians move to electronic health records, but the important thing is to have a single source of your health information, in whatever format you choose to store it.

Yes. Several universities now offer PHRs to enrolled students. Indiana University is providing free PHRs to students through a service called NoMoreClipboard.com, which allows students to import their health data from the school’s health system. Students can keep their PHR after graduation, if needed.

Yes. For the best possible care in the case of an emergency, you should include emergency contact information in your PHR.

The American Health Information Management Association (AHIMA) is a national non-profit professional association dedicated to the effective management of personal health information needed to deliver quality healthcare to the public. AHIMA’s 53,000+ members are health information management (HIM) professionals who specialize in managing and protecting your personal health information and medical records in hospitals, doctors’ offices, and other healthcare settings. HIM professionals care for your health by caring for your health information. Their job is to make sure all medical information collected about you is complete, accurate, and protected, yet, at the same time, readily available for your healthcare providers when it’s needed.

No. There is no nationwide repository of health records. Your health records are stored by your doctor’s office or any other facility where you have received treatment. That is why it is such a good idea to create your own personal health record, so there is one complete source of information about you.

Typically, the people who are responsible for the oversight and management of all patient health records have received specialized training in health information management. In fact, many of these individuals have college degrees and have passed an examination earning the certification of either Registered Health Information Technician or Registered Health Information Administrator. To learn more about the education standards for this profession, visit AHIMA.

If you are unable to find the answer to your question on this Web site, please visit our Helpful Links section for additional resources. You can also try contacting the director or manager of health information manager at your local hospital who may have additional suggestions.