How to See Who Accessed Your Medical Records?
Learn how to request an accounting of disclosures under HIPAA to find out who accessed your medical records, what was shared, and why. Step-by-step guide with templates.
Loading...
Loading...
Continue your research
Related medical records and patient rights resources.
Learn how to request an accounting of disclosures under HIPAA to find out who accessed your medical records, what was shared, and why. Step-by-step guide with templates.
HIPAA gives you the right to request a detailed log of who your provider shared your records with. Most people have never used this right. Here is how to exercise it.
An accounting of disclosures is a detailed log that shows when your protected health information (PHI) was shared with third parties. It is one of your fundamental rights under HIPAA.
This log shows you who has seen your medical information beyond the healthcare providers directly treating you. It is the tool for monitoring your privacy and identifying unauthorized access to your records.
Date of Disclosure
When the information was shared
Name & Address
Who received the information
Description
What information was shared
Purpose
Why the disclosure was made
The accounting covers specific types of information sharing. The biggest surprise for most patients is what it leaves out.
The Key Limitation:
Routine disclosures for treatment, payment, and operations (TPO) are NOT included. You won't see when your records were shared between treating doctors or sent to your insurance company for billing.
Follow these steps to request your accounting from any healthcare provider or health plan:
Determine which healthcare provider(s) or health plan(s) you want to request an accounting from. You will need to submit separate requests to each organization. Look for the Privacy Officer or Health Information Management (HIM) department.
While some providers may accept verbal requests, written requests create a paper trail. Specify the time period you want covered (up to 6 years back). Use the sample letter below.
Providers must respond within 60 days. They can extend this by 30 days with written notice. Your first request in any 12-month period must be provided free of charge.
Carefully review the accounting for any unexpected disclosures. If you identify unauthorized access, contact the provider's Privacy Officer or file a complaint with HHS.
Use this template to request an accounting of disclosures from your healthcare provider. Customize the bracketed sections with your information.
[Your Name]
[Your Address]
[City, State ZIP]
[Your Phone Number]
[Your Email]
[Date]
Privacy Officer / Health Information Management
[Healthcare Provider Name]
[Provider Address]
[City, State ZIP]
RE: Request for Accounting of Disclosures
Patient Name: [Your Full Legal Name]
Date of Birth: [Your DOB]
Medical Record Number: [If known]
Dear Privacy Officer:
Pursuant to the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, 45 CFR § 164.528, I am requesting an accounting of disclosures of my protected health information (PHI).
Please provide an accounting of all disclosures of my PHI for the period from [Start Date] to [End Date] (not to exceed 6 years).
As required by HIPAA, please include for each disclosure:
I understand this accounting does not include disclosures made for treatment, payment, or healthcare operations; disclosures authorized by me; or certain other permitted disclosures.
Please send the accounting to the address listed above. I understand you must provide this accounting within 60 days of receiving this request, and that my first request within a 12-month period is provided free of charge.
If you have any questions, please contact me at [Phone] or [Email].
Thank you for your assistance.
Sincerely,
[Your Signature]
[Your Printed Name]
Enclosures: Copy of government-issued ID (if required)
Once you receive your accounting of disclosures, here is how to read it and what to do with it:
Routine reporting of certain conditions to state health departments (e.g., communicable diseases, cancer registries). This is normal and required by law.
If you had a workplace injury, records may have been shared with your employer's workers' comp insurer.
Court orders, subpoenas, or legal discovery requests. If you were involved in litigation, this should be expected.
If your records were part of a data breach, this may be documented. You should have also received separate breach notification.
If you find concerning disclosures, contact the provider's Privacy Officer for an explanation. If you are not satisfied, you may file a HIPAA complaint.
Requesting an accounting of disclosures once a year is one of the most underused patient rights in healthcare. Start with your main providers.