A first appointment with a new doctor may include a medical history and a physical exam, and you can bring your medical records to it or have them sent from your former doctor. The old office may send copies to the new doctor as needed for your treatment, but the HIPAA Privacy Rule does not require a health care provider or health plan to share information with other providers or plans, so ask for your own copy as well.
A copy of your own file, and what you are not allowed to have
The Privacy Rule gives you, with few exceptions, the right to inspect, review and receive a copy of your medical records and billing records from the health care providers and health plans it covers. With access to your health information you can also get x-rays and other medical images, and you can ask for any the new doctor will want.
Covered offices include most doctors, clinics, hospitals, pharmacies and dentists, and most health insurance companies and company health plans, among others, but not every organization that holds health information has to comply with the rule (see Does HIPAA protect the weight you log in a phone app?).
You do not have the right to see a provider's psychotherapy notes. These are the notes a mental health professional takes during a conversation with a patient, and they are kept separate from the patient's medical and billing records. HIPAA also does not allow the provider to make most disclosures about those notes without your authorization.
How long a copy takes, and what the office can charge you
Your doctor normally has up to 30 days to give you a copy and often can give it much sooner, and the office can charge you a reasonable fee for it. In most cases you can get the copy the way you want it, such as by email. If the office offers a web portal, you may be able to view and download your health information there whenever you want. If your appointment is less than 30 days away, look in the portal first, and ask the office when it expects to send anything the portal does not show.
A provider may charge the reasonable costs of copying and mailing your records, and cannot charge you a fee for searching for or retrieving them. Where your information is stored electronically, the fee may not be a per page fee. Ask the office what the fee will be before it makes the copy, so you can check it against those limits.
Money you still owe the office does not hold the copy back: a provider cannot deny you a copy of your records because you have not paid for the services you received.
Sending the file straight to the new doctor
To have the file sent, ask your old doctor's office. You can ask your doctor to share your information directly with others, and the new doctor can be one of them, as can a family member, a caregiver, a mobile app or a researcher.
The office may also send the file without your asking: a provider or health plan may send copies of your records to another provider or plan only as needed for treatment or payment, or with your permission. For example, a doctor can send your medical test results to another doctor without your permission if the doctor needs the information to treat you.
| A copy sent to you | A copy sent to the new doctor | |
|---|---|---|
| Does the old office have to provide it? | Yes, with few exceptions, normally within 30 days | Not on its own account. It may, as needed for your treatment or payment or with your permission, and you can also ask it to share your information directly |
| Does it need your permission? | It starts with your own request | Not when it is needed for your treatment or payment |
| Who reads it first? | You, before the appointment | The new doctor |
You can ask for both. The copy in your own hands is the one you can check before you sit down with the new doctor, to make sure your health information is correct and complete.
When something in the file is wrong, or the office refuses you
Ask the office for a change, known as an amendment, if you think an entry in your file is wrong or missing: you can request an amendment to your medical or billing record, and the provider or plan must respond to your request. If it created the information, it must amend information that is inaccurate or incomplete, so make the request to the office that created the entry. If that office does not agree to the change, you have the right to submit a statement of disagreement, and the provider or plan must add it to your record.
If an office refuses you a copy, does not respond to an amendment request, or charges you for searching for your records, you can file a complaint with the federal Office for Civil Rights, known as OCR. Anyone can file one about noncompliance with the HIPAA Privacy Rule, and the complaint must:
- be in writing, sent by mail, fax or email, or through the OCR Complaint Portal
- name the office or health plan involved
- describe what it did, or failed to do, that you believe broke the rules
- be filed within 180 days of when you knew it happened, though OCR may extend that period if you can show good cause
You do not have to be sure the office broke the rules before you go ahead and file. OCR can investigate only a complaint that alleges a failure to comply, and only against an organization the rules cover.
Put your name and contact information on the complaint, because OCR does not investigate one filed without them. If you write the complaint in your own format to mail or email, include among other details your full address and phone numbers, the address and phone number of the office involved, and your signature and the date. OCR's complaint form package and its Complaint Portal both come with a consent form, and on it you can ask OCR to keep your name and contact information confidential during the investigation. Through the portal, you sign the complaint electronically and complete the consent form, and can then print a copy of the complaint to keep for your records.
The office cannot retaliate against you for filing, and if it does, tell OCR immediately.
Keeping your own copy of your health history
Your records may already be spread across charts at several doctors' offices, plus one at any hospital you have been in, on paper or electronic. Keeping a personal health record yourself is a good way to track all of it, and you could start yours with:
- your name, birth date, blood type and emergency contact
- the date of your last physical
- the dates and results of tests and screenings
- major illnesses and surgeries, with their dates
- the medicines and supplements you take, their dosages, and how long you have taken each
- any allergies and any chronic diseases
- any history of illness in your family
Each copy you receive fills in some of those lines. If the date of your last physical or your screening results stay blank, ask the new doctor's office which screenings you are due (see Weight care is not a checkup, so the screenings are still yours to book).
For a NicoCares patient, anything in your copy that bears on your weight care, such as a diagnosis you did not know was on file, is worth sending to the care team in a message on Spruce Health, which hosts your secure messaging with them.
