Your rights to your own health record in the US, and how to use them

Two rules, not one, and they cover different things

Most people asking about their medical records have heard of HIPAA and nothing else. HIPAA is only half of the picture in the United States, and the half it covers is narrower than its reputation suggests. The Health Insurance Portability and Accountability Act gives you a right of access: the HHS Office for Civil Rights states that the Privacy Rule gives you, with few exceptions, the right to inspect, review, and receive a copy of your medical records and billing records held by health plans and health care providers covered by the rule.

The second rule is newer and is the one that matters when a record exists in digital form and still does not reach you. The 21st Century Cures Act of 2016 made sharing electronic health information the expected norm, and the information blocking regulations define a practice by an actor that is likely to interfere with the access, exchange, or use of electronic health information, except as required by law or covered by an exception. The actors named in the law are health care providers, health IT developers of certified health IT, and health information exchanges or networks.

Knowing which rule your problem sits under decides where you complain, and the two go to different places. That is the whole reason to hold both in your head.

How to ask for a copy, and what it can cost

Ask the organization that holds the record, which is not always the doctor you remember seeing. Hospitals usually route these requests through a health information management or medical records department, and many now publish an online request form. Say plainly which records you want, over which dates, and in which format.

Format is worth being specific about, because the rule supports you. The Office for Civil Rights states that in most cases you can get a copy the way you want it, such as by email, and that where a provider offers a web portal you may be able to view and download your information whenever you want. It also states that your doctor normally has up to 30 days to provide a copy, and often can provide it sooner.

On money, two published points settle most arguments. You cannot be denied access for not paying your medical bill. A provider can charge a reasonable fee for a copy, and the Office for Civil Rights adds that the fee may not be a per page fee if your information is stored electronically. Its separate page on medical records adds that a provider cannot charge you for searching for or retrieving your records.

• Identify the organization that actually holds the record, not the individual clinician.
• Name the record set and the date range instead of asking for everything.
• State the format you want, including electronic copy or email, in the request itself.
• Ask what the fee will be before the work starts, and ask how it was calculated.
• Keep the date you asked, because the clock and any later complaint both run from it.

Check the copy, and ask for a correction when it is wrong

A record you cannot read is not much use, and a record that is wrong is worse than one that is missing. The Office for Civil Rights is direct about this: check that your health information is correct and complete, and if something is wrong or missing you can ask your doctor to fix it. The organization must respond to a request to amend, and if it created the information it must amend information that is inaccurate or incomplete.

If it refuses, you are not out of options. You have the right to submit a statement of disagreement, and the provider or plan must add it to your record. That statement then travels with the record. Two limits are published alongside the right. You do not have a right of access to a provider's psychotherapy notes, which are kept separate from the medical and billing record, and a small number of other exceptions exist.

When the record does not come: information blocking

The information blocking rules exist for the case where the data is electronic, the request is reasonable, and it still does not arrive. The exceptions are published in the regulations rather than decided case by case in private, and an actor whose practice meets an exception is not information blocking. Not meeting an exception does not automatically mean blocking occurred either; those cases are assessed individually.

Claims are submitted through the government's Report Information Blocking Portal. Two offices handle what follows. ONC can review claims against health IT developers of certified health IT as a possible non-conformity under the Health IT Certification Program. Separately, the HHS Office of Inspector General has authority to investigate claims across all three actor types, and a final rule now establishes disincentives for health care providers that the Office of Inspector General finds to have committed information blocking.

Two honest cautions. A submitted claim is not a finding, and nothing about this route is fast. It is worth knowing about because it changes what an organization can reasonably tell you, not because it will get a discharge summary onto your screen this afternoon.

• A HIPAA access problem goes to the HHS Office for Civil Rights as a privacy complaint.
• An electronic access problem goes to the Report Information Blocking Portal.
• The same situation can raise both, and they can be filed separately.
• Keep dates, names, and what you were told, because both routes ask for them.
• Neither route is a substitute for asking the organization directly first.

What read-only means when an app connects

The Office for Civil Rights lists a mobile application as one of the parties you can ask a provider to share your information with. When you connect an app, what usually happens is that the app receives a copy of specific categories of your record through an authorized connection, and can display them back to you. Read-only means exactly that and nothing more: the app reads, and it writes nothing into the health system's record.

The practical consequence catches people out. If a read-only app shows a medication you stopped taking two years ago, the app cannot remove it, and neither can you from inside the app. That correction is the amendment right described above, exercised with the organization that holds the record. An app can make an error visible. Only the record holder can change it.

There is also a security point worth knowing, in MyChart's own published words: an app you choose to share your health information with never sees your username or password, because you log in on your healthcare organization's secure login page. Any app that asks you to type your portal password into its own screen is not using this route.

How to disconnect an app, and the part most people miss

In MyChart, connected apps are listed under Linked Apps and Devices, and access is revoked from there. The distinction that matters is between denying and revoking. MyChart states that if you deny access, the app cannot see any of your health information, and that denying does not affect your MyChart account or your care.

Revoking is different, and this is the part almost nobody is told. MyChart states that if you revoke access, the app stops receiving new information from your health record, however the app might still have information it already received, and that to request deletion of that information you should contact the app directly. Revoking closes the tap. It does not empty the bucket.

So disconnecting properly is two actions, not one: revoke the connection in the portal, then ask the app to delete what it already holds. MyChart also notes that you can file a complaint with the app developer, or, if you believe the app has violated your rights, contact the U.S. Department of Health and Human Services or your country's data protection authority.

• Open Linked Apps and Devices in the portal to see which apps have access.
• Revoke the connection there to stop any new information flowing.
• Contact the app separately and ask it to delete what it already received.
• Read what the app said it retains before you connect, not after.
• Denying at the consent screen is not the same as revoking a live connection.

Where Sahara fits, and where it stops

Sahara is a free, read-only view of authorized record data, built by Synodha. It connects through Epic MyChart today. It is not connected to Oracle Health, MEDITECH, or athenahealth. If the organization holding your record runs one of those, nothing on this page changes that, and your route is the portal that organization gives you.

Where Sahara can connect, it displays supported information such as medications, allergies, laboratory results, vital signs, conditions, immunizations and recent visits, and can link supported coded items to general patient education from MedlinePlus. It writes nothing back, it is designed not to retain the medical record after the session, and it does not interpret what any result means for you. The rights on this page are yours against the organization that holds your record. Sahara is not a party to them and cannot exercise them for you.

Limits to keep visible

• This page is general information about published federal rules. It is not legal advice, and it is not medical advice.
• Rules and published guidance change, and some HHS access guidance carries a court-ordered rescission notice on the page itself. Read the current source before relying on a detail.
• State law, and the policies of the organization holding your record, can add requirements this page does not cover.
• Sahara does not create access, widen a permission, correct a record, or file a complaint on your behalf.
• Sahara connects through Epic MyChart today and is not connected to Oracle Health, MEDITECH, or athenahealth.

How this guide was prepared

Synodha's editorial team prepared this guide from the official sources listed below, checked the product statements against Sahara's current documented scope, and separated general education from patient-specific interpretation. No clinician review is claimed. This guide is educational and does not replace the source record, discharge instructions, a professional interpreter, or the care team.

Last reviewed September 5, 2026. Recheck the linked sources and the healthcare organization's current instructions before acting on health information.

Primary sources and scope

These official sources establish the current proxy-access, app-access, and patient-education context used in this guide. They do not endorse Synodha or Sahara.

• HHS Office for Civil Rights: Your medical records
• HHS Office for Civil Rights: Get it. Check it. Use it. (your right of access)
• HHS: Filing a health information privacy complaint
• ASTP/ONC: Information blocking
• ASTP/ONC: Report Information Blocking Portal
• MyChart: What happens if I deny or revoke access to an app?
• MyChart: Security and sharing your health information

Related Synodha resources

• Look up what your health system requires for proxy access
• How authorized caregiver access to MyChart works
• Read a loved one's MyChart lab results
• Understand a hospital discharge summary
• See a demo record before connecting anything
• Explore Sahara
• Read Sahara's current Privacy Policy
• What Synodha does and does not hold
• Browse all US healthcare guides