HIPAA is best known for protecting the privacy of your health information, but it also gives you a set of concrete, usable rights. Knowing them helps you take an active role in your care and your privacy — and most of these rights are simpler to exercise than people assume. Here are the essentials.
1. The right to access your records
You can inspect and get a copy of your health information from providers and health plans, usually within 30 days, for a reasonable cost-based fee. You can also direct that a copy be sent to a person or organization you choose.
2. The right to request a correction
If something in your record is wrong or incomplete, you can request an amendment. If the request is denied, you can file a statement of disagreement that stays in your record and travels with the disputed information.
3. The right to a Notice of Privacy Practices
Providers and health plans must give you a notice that explains how they may use and share your information, and what your rights are. It's worth actually reading the one you're handed.
4. The right to request restrictions
You can ask a provider to limit how your information is used or shared. They don't always have to agree — but in one specific case they must: if you pay out of pocket, in full, for a service, you can require that the provider not share information about that service with your health plan.
5. The right to an accounting of disclosures
You can ask for a list of certain disclosures of your information that a provider or plan has made — generally those outside of routine treatment, payment, and health care operations.
6. The right to confidential communications
You can ask to be contacted in a specific way or at a specific place — for example, by your mobile phone rather than your home line, or at an alternate mailing address — to protect your privacy.
7. The right to file a complaint
If you believe your rights were violated, you can complain to your provider, your health plan, or the HHS Office for Civil Rights — at no cost, and you are protected from retaliation for doing so.
| Right | What it lets you do |
|---|---|
| Access | Get a copy of your records |
| Amendment | Request corrections |
| Restrictions | Limit certain uses and sharing |
| Accounting | See certain disclosures |
| Complaint | Report a possible violation |
How to actually exercise a right
Most of these rights start the same simple way: a written request to the provider or health plan that holds your information. For access, ask for a copy and specify the format. For a correction, describe what's wrong and what it should say. For confidential communications, state how and where you want to be contacted. Keep a copy of whatever you send, note the date, and follow up if you don't get a timely response. If a provider doesn't honor a right you're entitled to, the HHS Office for Civil Rights accepts complaints at no cost and has long treated patient access as a priority. You don't need a lawyer to use these rights — just a clear, dated, written request.
Put them to use
These rights only help if you use them. Read your privacy notice, review your records for accuracy, ask questions when something is unclear, and don't hesitate to file a complaint when something isn't right. They exist for you.