Loading...
HIPAA protects your medical privacy -- but it also carves out 12 specific exceptions where your records can be shared without your consent. Here's who can see your records, what they can access, and what rights you have to stop it.
HIPAA protects your medical privacy -- but it also carves out 12 specific exceptions where your records can be shared without your consent. Here's who can see your records, what they can access, and what rights you have to stop it.
HIPAA has more exceptions than most people realize. The law that's supposed to lock down your medical records also contains 12 carved-out situations where those records can be shared without your consent. Some make obvious sense. Others feel like loopholes. HIPAA is, somehow, both more protective and more permissive than its reputation suggests.
This guide covers who can see your medical records without permission, what "access" means under the law, who owns your records, and what you can actually do when something feels wrong.
Two terms get conflated constantly.
Access means the ability to look at, use, or retrieve your health information. Disclosure means sharing it with someone else. HIPAA restricts both, but the exceptions work differently -- some let your provider use information internally, others authorize disclosure to outside parties.
HIPAA applies to covered entities -- healthcare providers, health plans, and healthcare clearinghouses -- and their business associates. It does not cover employers, life insurance companies, or data brokers directly. Other laws may apply there, but HIPAA does not.
This question comes up constantly, and the answer is slightly counterintuitive.
Your provider owns the physical record -- the paper chart or electronic file. Courts and state laws have consistently held this. You own the information in the record. That split is why HIPAA grants you the right to access, copy, and request corrections. The data is yours. The file is not.
You control disclosure. Outside the 12 exceptions below, your provider cannot share your records without your authorization.
Some states go further than HIPAA. California's Confidentiality of Medical Information Act (CMIA) adds protections that federal law doesn't require. Check your state's specific rules to understand what applies where you live.
"You own the information in your medical records. Your provider owns the file. This distinction is why HIPAA gives you the right to access and copy your records -- but doesn't give you the right to take the original chart home."
HIPAA's Privacy Rule (45 CFR Part 164) lists specific situations where covered entities may use or disclose protected health information (PHI) without patient authorization.
Doctors, nurses, and other providers can share your records with each other to treat you. Referrals to specialists, hospital admissions, care coordination -- all covered. This is the broadest exception and arguably the most necessary. Without it, every handoff between providers would require a signed form. The tradeoff: the "treatment" umbrella is wide enough that records move between providers more freely than many patients expect.
Your provider can share clinical details -- diagnosis codes, procedure codes -- with insurance companies to get paid. Claims processing requires it.
Providers can use your records internally for quality improvement, audits, training medical students, business planning, and accreditation reviews. You never sign off on this. It happens in the background of every health system.
When a statute mandates disclosure, your provider must comply. This covers mandatory reporting: communicable diseases like tuberculosis and hepatitis, gunshot wounds in most states, suspected child abuse or elder abuse, and certain occupational diseases.
Public health authorities -- the CDC, state health departments -- can receive your information for disease surveillance, tracking adverse drug reactions, investigating outbreaks, and maintaining birth and death registries.
Providers can disclose information to government authorities authorized to receive reports of abuse, neglect, or domestic violence. Providers are generally required to tell you about this disclosure.
Government agencies that regulate healthcare -- HHS Office of Civil Rights, state health departments, the Department of Labor -- can access records during audits, investigations, and inspections.
A court order or subpoena can compel disclosure of your medical records during a lawsuit or administrative hearing. In some circumstances, a valid subpoena alone -- without a court order -- is enough.
Police cannot simply walk into a clinic and demand records. Law enforcement access requires a court order, grand jury subpoena, or falls under narrow categories: reporting gunshot wounds, identifying a suspect with limitations, or responding to a national security request. The exception is tighter than most people assume.
After death, records can be shared with coroners and medical examiners to determine cause of death, and with funeral directors to carry out their duties. For families of deceased patients, this means the medical examiner may access records you cannot -- a friction point that catches many families off guard.
Records can be shared with organ procurement organizations to facilitate organ, eye, or tissue donation and transplantation.
Researchers can use de-identified health data freely. Identified data requires IRB review and additional protections. If you've ever been a research subject, your records may have moved through channels you weren't specifically told about -- though the de-identification requirement is meant to sever the link back to you.
No. Being a physician does not grant access to anyone's records.
A doctor at a different practice who is not involved in your care cannot pull your records from another provider. HIPAA's "minimum necessary" standard requires that even within the treatment exception, providers share only what's needed for the specific purpose. The treatment exception kicks in only when the doctor is actually treating you -- a referral, an admission, coordinated care.
Curiosity is not a covered purpose. Neither is a personal relationship.
"A doctor at a different practice cannot look up your records just because they're curious or because they know you personally. The treatment exception only applies when they are actually involved in your care."
Health Information Exchanges (HIEs) are regional or statewide networks that let providers share patient data electronically. When you see a new provider, they may pull records from previous providers through an HIE -- often without a separate authorization from you.
Most states now have active HIEs. Participation by providers is increasingly common.
What this means for you:
To find out if your state has an HIE and how to opt out, contact your state health department or search "[Your State] health information exchange opt out."
HIPAA gives you the right to request an accounting of disclosures -- a log of instances where your records were shared without your authorization.
The gap: this accounting does not cover disclosures for treatment, payment, or healthcare operations. Those are the three most common reasons anyone touches your records. What the accounting does cover:
To request one:
One free accounting per 12-month period. After that, providers may charge a reasonable fee.
For a log of who accessed your records within your provider's system -- including for treatment -- ask about their access logs. Many large health systems with electronic records can provide this, though HIPAA does not strictly require it.
They are not. Medical records are private under HIPAA and state law.
The confusion arises because some health-adjacent information is publicly available in limited forms:
Your diagnoses, test results, medications, and visit notes are not public records. No member of the public can access them.
HIPAA's exceptions don't land the same way for everyone.
Minors. In most states, parents can access their minor child's records -- but exceptions exist for reproductive health, substance abuse treatment, and mental health services in states where minors can consent to those services independently. The rules vary significantly by state.
Families of deceased patients. HIPAA allows disclosure to personal representatives of a deceased person, but the process is bureaucratic and slow. Families often discover they need legal documentation (executor status, power of attorney) before providers will release records -- even when the request feels straightforward.
Research subjects. If you participated in a clinical trial, your records may have been shared with researchers, sponsors, and oversight bodies under the research exception. Consent forms cover this, but the scope of downstream data sharing often exceeds what participants remember agreeing to.
If you believe your records were accessed or shared without proper justification, four paths are available.
Contact the provider's Privacy Officer directly. Every HIPAA-covered entity must designate one. Ask for an explanation of the disclosure.
File with the HHS Office for Civil Rights (OCR):
Many states have their own health privacy laws and enforcement mechanisms. Your state attorney general's office or health department may accept complaints.
Some HIPAA violations give rise to claims under state law. An attorney specializing in health law or privacy can advise on additional legal remedies.
| Right | What It Means |
|---|---|
| Right to access | See and get copies of your own records |
| Right to amend | Request corrections to inaccurate records |
| Right to accounting of disclosures | Learn who received your records (for certain disclosures) |
| Right to restrict | Ask providers not to share information with insurers if you pay out of pocket |
| Right to confidential communications | Ask for records to be sent to a specific address or phone number |
| Right to notice | Receive the provider's privacy notice |
| Right to complain | File a complaint with HHS or your state without retaliation |
The honest assessment: HIPAA does a reasonable job balancing privacy against the operational demands of a healthcare system that depends on information flow. But "reasonable" and "intuitive" are different things, and the gap between what patients assume and what the law permits is where most frustration lives.
This information is educational and does not replace professional medical or legal advice.
Use our comparison tool to evaluate EMR systems side-by-side based on your specialty, practice size, and budget.