In Brief: The Health Insurance Portability and Accountability Act Privacy Rule and Patient Access to Medical Records

Some patients have complained to DHHS’ Office for Civil Rights (OCR), which oversees HIPAA implementation, about refusals of access, suggesting that some providers are not complying with the law or may not understand how to influence the patient access rules.

 

 

Findings: Improving Patient Access—The Promise of Electronic Communication

While the Privacy Rule allows for access to paper and electronic records, the increasing use of technology in the health care arena has the potential to streamline the process of granting patients access to their records. Americans support advancements in health information technology but also express serious concern about related privacy and security issues.

Electronic medical record (EMR) systems could go a long way to addressing issues related to patient access to personal health information, such as cost and timeliness. But while the technology is certainly promising, the privacy risks are significant. The HIPAA Privacy and Security Rules provide a clear foundation for the development of EMR systems, but they are just that—a foundation. While both laws serve as a good starting point, neither fully anticipates or addresses issues associated with the development of a system in which personal health information is shared electronically across a spectrum of providers.

Conclusion and Recommendations

Generally, providers understand their responsibilities to grant patients access to their medical records under the HIPAA Privacy Rule. Nevertheless, some confusion remains among providers about the access provisions of the law.

Additionally, patients are ill-informed about the rights afforded them under the Privacy Rule. Overall, OCR needs to actively monitor, enforce, and educate the public and providers about the law. OCR should seek funding from Congress to launch an immediate, widespread public education campaign that encourages patients to assert their access rights under the law by offering them technical assistance, including written guidance and sample language to prepare written requests.

Access to personal health information is essential to strong privacy protections and quality health care. In the health care arena, access to personal medical records has been shown to encourage patient participation in care, adherence to treatment regimens and enhanced doctor-patient communication.