Get your records
Ask a covered provider or plan for the designated record set. Most access requests must be acted on within 30 days; one 30-day extension is possible.
Official / Primary ResourceFederal patient-rights navigation
HIPAA How-To Directory
Use this directory to locate the right federal process. A HIPAA amendment request, an OCR complaint, an information-blocking complaint and a state licensing complaint are different tools for different problems.
Check for errors
Review allergies, medications, diagnoses/problem list, history, test results, dates, demographics and billing information.
Official / Primary ResourceRequest an amendment
Use HIPAA 45 C.F.R. §164.526 to ask a covered entity to amend PHI you believe is inaccurate or incomplete.
Official / Primary ResourceIf the amendment is denied
Ask for the written denial. You can submit a statement of disagreement and have it linked to the disputed record.
Official / Primary ResourceFile a HIPAA complaint
HHS OCR accepts privacy/security complaints, generally within 180 days of when you knew of the alleged violation; good-cause extensions may be possible.
Official / Primary ResourceReport information blocking
If access/exchange/use of electronic health information is improperly interfered with, ONC has an information-blocking claim process.
Official / Primary ResourceUnderstand who HIPAA covers
HIPAA generally regulates covered health plans, clearinghouses, certain electronic-transacting providers, and business associates—not every employer, app or website.
Official / Primary ResourceMilitary Health System rights
MHS/TRICARE patients also have HIPAA rights to access and request amendment of incorrect/incomplete PHI.
Official / Primary ResourcePrivacy practices
Read the provider/plan Notice of Privacy Practices to learn permitted uses/disclosures, complaint contacts and patient rights.
Official / Primary ResourceCord-blood decisions
Compare public donation, private banking, FDA regulation, proven transplant uses, cost/storage terms and experimental claims.
Official / Primary ResourceWhich path fits?
| Problem | Likely starting path |
|---|---|
| You want a copy of records | HIPAA Right of Access / provider records office. |
| A factual or incomplete medical/billing record | HIPAA amendment request under §164.526. |
| Provider refuses amendment because it believes the record is accurate/complete | Written denial → statement of disagreement → complaint if you believe HIPAA procedures were violated. |
| Electronic health information is being improperly blocked | ONC information-blocking process. |
| Privacy/security violation by a HIPAA regulated entity | HHS Office for Civil Rights complaint. |
| Medical negligence / professional misconduct | Not automatically HIPAA. Consider state licensing, malpractice counsel, insurer grievance or other applicable process. |
| Military Health System record | MTF HIPAA Privacy Officer / DHA Privacy & Civil Liberties; MHS recognizes access and amendment rights. |