hipaa logo

Part 2: Basic Patient Rights (FAQ 23 of 65)

 

Right to Inspect and Copy Your Record

23. What Records Should I Ask For?

A covered entity must allow you to inspect or obtain a copy of your record. Some records can be withheld. (See FAQ 24.) Just figuring out who to ask and what to ask for can be complex. Don't assume that you need a copy of all records from all health care providers and insurers. Obtaining your health records can be surprisingly complicated, may present some hard choices, may be expensive, will require some planning, and can take time.

First, copying costs may be considerable. You may want to think about the costs involved before you ask. A hospital record can have hundreds or even thousands of pages. Think about whether inspecting your records will meet your needs. If you can inspect first, you might be able to narrow your request and cut the cost.

SIDEBAR:

You might be able to inspect your records and make a copy with your digital camera or a portable scanner. If you try using your own equipment, don't be surprised if the covered entity doesn't like it and tries to stop you. However, if you can see the record, you should be able to make your own copy. Nothing in the HIPAA rule says that you can't. However, if you want to wheel in a 500-pound copying machine, you'd better ask permission first.

Second, if you have been using the same hospital or doctor for 20 years and the reason for your request relates only to your treatment from the last month, you might limit your request to recent records, or records dating back just one year. The same idea may work if you want records from your insurer.

You may not know which records you need at first. The point is that you want to obtain records that you think are relevant, but you may not want every record from every HIPAA covered entity. Most people have had dozens of health care providers and insurers in the course of their lives. Many records will not be important or worth the time and effort to find for most people. Old records from individual practitioners may be hard to locate and obtain. However, hospitals and other long-standing institutions are more likely to have older records, although they may be in storage offsite.

SIDEBAR:

If you want your records because you think you might have been a victim of an identity thief, you will find some more specific advice at the World Privacy Forum's FAQ for medical identity theft victims. www.worldprivacyforum.org/FAQ_medicalrecordprivacy.html.

It is possible that a thief used your name to obtain services from a health care provider, clinic, pharmacy, or laboratory that you never used yourself. Don't be surprised if the trail leads you to unexpected places.

RULE OF THUMB:

One part of the health care world that few people recognize is the Pharmacy Benefit Manager or PBM. A PBM is a company that contracts with managed care organizations, self-insured companies, government programs, and other insurers to manage pharmacy network management, drug utilization review, and other activities. A PBM is likely to be the organization that fills your drug prescriptions by mail. A PBM may have relevant records. Your health plan hires the PBM, and you may have to seek access to PBM records through the plan.

The notice of privacy practices should tell you what you need to know on this front, or it should tell you how to find out. PBM records may duplicate records that exist elsewhere, but they can be important sources of information at times. If you are seeing more than one doctor, clinic, or hospital, PBM records tend to include information from different providers.

SIDEBAR:

It can be especially important to correct errors in PBM records. If you apply for individually underwritten life insurance or certain other types of insurance, the insurance company will insist that you sign a consent for disclosure of your health records. The company wants to know if you have a health condition that affects your insurability. The easiest place for the insurer to obtain your records may be from a PBM rather than from your doctor. PBM records are electronic and can be shared quickly. Your doctor may not respond to the insurer's request so quickly.

Third, asking for a copy of your complete health record may provide more information than you need. It may also be especially expensive. Your health records may include results of x-rays and other diagnostic tests that may be costly to duplicate.

Consider how you might limit your request for access so that you limit your costs. See if you can talk to someone in the record keeper's office when you make a request so that you can negotiate what you really need. One idea is to not ask for a hard copy of an x-ray unless you know that x-rays are essential. If other records are especially expensive to duplicate, you may want to defer asking for those records too. Ask for a price list before requesting all records. Another idea is to ask to inspect your records first so you can decide which parts you want to have copied.

On the other hand, if records are electronic, it may be easy and inexpensive to obtain an electronic copy of everything or almost everything. If the covered entity has electronic records, it must give them to you in electronic form if you want them in that form. You can ask for hard copy of electronic records, but the cost might be higher. Not all electronic records can be printed on paper.

Fourth, once when you receive some records, you may be able to focus your later requests. You may find that the provider used a lab or other independent provider that will have some of your records that you may want to have or that you may want to inspect.

 

Jump to list of FAQs 1-65 | See all of Part 2