HIPAA patient rights
The rights HIPAA gives patients over their health information, with deadlines, and what a practice must do to honor each one.
HIPAA patient rights at a glance
HIPAA gives patients six main rights over their health information: to get a Notice of Privacy Practices; to access and get copies of their records within 30 days; to request amendments, answered within 60 days; to an accounting of certain disclosures from the past six years; to request restrictions — which providers must accept for services paid in full out of pocket when the disclosure is to a health plan; and to request confidential communications. Patients can complain to the provider and to HHS.
| Notice | Notice of Privacy Practices — 164.520 |
|---|---|
| Access | Copies within 30 days — 164.524 |
| Amendment | Decision within 60 days — 164.526 |
| Accounting of disclosures | Last 6 years, within 60 days — 164.528 |
| Restrictions | Must honor for health-plan disclosures of services paid in full out of pocket — 164.522(a) |
| Confidential communications | Alternative means or locations — 164.522(b) |
| Right | What the patient can do | Deadline for the practice | Rule |
|---|---|---|---|
| Notice | Receive the Notice of Privacy Practices | By first service | 164.520 |
| Access | Inspect and get copies, including electronically; direct an electronic EHR copy to a third party | 30 days (+30) | 164.524 |
| Amendment | Ask to correct records they think are wrong | 60 days (+30) | 164.526 |
| Accounting | Get a list of certain disclosures from the past 6 years | 60 days (+30) | 164.528 |
| Restriction | Ask to limit uses and disclosures; must be honored for health-plan disclosures of services paid in full out of pocket | — | 164.522(a) |
| Confidential communications | Choose how and where they’re contacted, such as email | Reasonable requests must be accommodated | 164.522(b) |
| Complaint | Complain to the practice and to HHS OCR | — | 164.530(d), 160.306 |
What a practice needs to honor these rights
- A Notice of Privacy Practices that explains them.
- A named person and a short process for each type of request, with a log of dates.
- Tools that can export a full record, flag restricted information and record contact preferences.
- Staff training so the front desk knows what to do with a request.
Next steps
- HIPAA for therapists in private practice →Scenario
- Right of access →Requirement
- Notice of Privacy Practices →Requirement
- Emailing patients →Requirement
- HIPAA authorization →Requirement
Frequently asked questions
What are my rights under HIPAA?
To see and get copies of your records, ask for corrections, get a list of certain disclosures, ask for limits on how your information is used or shared, choose how you're contacted, receive a Notice of Privacy Practices, and file a complaint.
Can I stop my doctor from telling my insurer about a visit?
Yes, if you pay for that service in full out of pocket and ask the provider not to disclose it to your health plan. The provider must agree, unless the disclosure is required by law.
Where do I complain about a HIPAA rights violation?
To the provider or plan first, and to the HHS Office for Civil Rights, generally within 180 days.