Introduction

Your medical records are the paper (or electronic) trail you leave behind as you make your way through the medical system. They can give you insight into your condition, your progress, and the care you are receiving. When you have a chronic illness, like inflammatory bowel disease (IBD), these records take on added importance, since an accurate medical history can be vital to your treatment. Understanding your medical records and your rights regarding their accessibility is a critical part of being an active participant in your healthcare.

Back to Top

What is a medical record?

Each time you receive healthcare –– whether it is a checkup, a diagnostic procedure, or treatment in a clinic or hospital –– information is documented and then compiled into a medical record. You probably have a number of medical records, since each healthcare provider that you see (e.g., your internist, your gastroenterologist, and your surgeon) typically compiles a separate file or "chart" about your medical history.

A medical record is also a legal document. The law requires healthcare providers to record certain information in a specified format and to sign the documents they create. Your medical record is the physical property of your healthcare provider; however the information within the record belongs to you.

Back to Top

How is my health information collected and used?

Each time you see a healthcare provider, your medical record travels through a number of hands, and different information is collected at each stop. First, the clinic registration staff or hospital admitting staff typically documents where you live and your method of payment. They may also collect and file standard forms regarding clinic or hospital registration and treatment consent.

Next, your healthcare provider records information about your health history, as well as observations, diagnostic reports, notes regarding your response to treatment, and plans for future treatment. At this point, consultations from other healthcare providers and directions to other members of your healthcare team may also be incorporated.

Then, your file travels to the medical records personnel, who ensure that the information collected is complete and accurate and assign codes to each aspect of treatment for billing purposes. The medical records staff is also responsible for making sure that your healthcare information is maintained securely and in accordance with regulatory agencies.

Finally, the billing department files claims with your health insurance provider, who then uses coded data to determine the appropriate payment for the services that you received. There are additional situations where your health information may be shared (e.g., with employers, public health agencies, law enforcement agencies, health research organizations, and quality improvement agencies), but your identity, and therefore your privacy, will be protected.

Back to Top

How is my privacy protected?

In 1996, the Health Insurance Portability and Accountability Act (HIPAA) was enacted to improve the portability and continuity of health insurance coverage. This prompted Congress to require the development of regulations to protect the confidentiality of your medical records. A final Privacy Rule, issued in 2002, gives you the right to inspect, review, and receive a copy of your medical record. It also sets limits on who has access to your health–related information. Protected information includes your medical record, conversations healthcare providers have regarding your care and treatment, information about you in your health insurance company's computer system, and most other health information about you that is held by those who must follow this law.

The Privacy Rule applies to most healthcare providers, health plans (e.g., health maintenance organizations (HMOs), health insurance companies, company health plans, Medicare, and Medicaid), and healthcare clearinghouses. These individuals and organizations must

• establish safeguards to protect the confidentiality of your health information,
• reasonably limit use and disclosure of your health information,
• have contracts in place with their contractors and others ensuring that your information is appropriately used and disclosed,
• have procedures in place to limit who can view and access your health information, and
• implement training programs for employees about how to protect your health information.

Life insurance companies, employers, workers compensation carriers, and many schools, state agencies, law enforcement agencies, and municipal offices are allowed to share information in special circumstances, such as during legal proceedings or when benefits are contested or questioned.

Back to Top

What if I think that my rights have been violated?

If you think that your medical information was used or shared in a way that is not allowed under the Privacy Rule, you can file a complaint with the privacy officer at the healthcare facility or insurance company where you believe the violation occurred. If you cannot resolve the issue, you can file a complaint with the Department of Health and Human Service's Office for Civil Rights (OCR). A complaint must be filed in writing (either hard copy or electronically) within 180 days of the event. For more information about filing a complaint, visit the OCR Web site (www.hhs.gov/ocr/hipaa/).

Back to Top

My clinic gave me a copy of their "Notice of Privacy Practice." What is it? Do I have to sign it?

When you receive healthcare, your provider must give you a notice that tells you how your health information is used and shared and how you can exercise your rights. Typically, you should get this notice the first time you visit a healthcare provider, and you can ask for a copy at any time. You will be asked to read the information and sign an acknowledgement that you received the notice, but your signature is not legally required. Health insurance companies must also give you a Notice of Privacy Practice, but do not ask for your signature.

Back to Top

When can my health information be shared without my consent?

In general, your health information cannot be given to your employer, used or shared for things like sales calls or advertising, or used or shared for many other purposes unless you give your permission by signing an authorization form that tells you who will get your information and how they will use it.

However, healthcare staff can see your medical records without your consent if doing so is necessary to provide your treatment, facilitate payment for healthcare services, or ensure that you are receiving quality care. And hospitals can share your health information with family members without your consent if you are unable to provide consent and a spouse, parent, or child is involved in providing your care.

Back to Top

How can I obtain a copy of my medical records?

Many patients are unaware that they have a legal right to review their medical records. To obtain a copy, simply contact your healthcare provider's office or the medical records department at each facility where you have received treatment. You typically must complete a form to authorize the release of your information. In most cases, you must receive a copy within 30 days, but this can be extended for another 30 days if you are given a reason.

Your healthcare provider may charge for reasonable costs related to copying and mailing your records, however you cannot be charged for the time required to search for and retrieve your records. You also cannot be denied a copy of your records because you have not paid for the service you received.

If your healthcare provider has moved, retired, or died, his estate is obligated to retain your records for a period of time defined by federal and state law – usually 10 years following your last visit. You may be able to locate your records by contacting your physician's partners.

Once you get a copy of your medical records, you may find that their contents are difficult to understand. You can schedule a consultative visit with your healthcare provider to discuss your records, or you can try referring to a medical dictionary or a Web site like http://www.nlm.nih.gov/medlineplus/mplusdictionary.html.

Back to Top

Do I have the right to see my child's medical records?

If your child is a minor, you typically have the right to see his/her medical records. Exceptions include situations where your child

• consents to care for which parental consent is not legally required,
• obtains care at the guidance of a court or a person appointed by a court, or
• has your consent to have a confidential relationship with a healthcare provider.

Back to Top

What if I find errors in my medical record?

If you find an error in your medical record, you can ask your healthcare provider to correct the record. For example, if you and your physician agree that a diagnostic test result has been recorded incorrectly, your physician must change it. You can also ask that information be added, if you believe your file is incomplete. If your provider does not agree with your request, you have the right to submit a statement of disagreement that your provider must add to your record.

Back to Top

How do I transfer my medical records if I move?

Anytime you change healthcare providers, it is important to make sure that your new provider has access to your medical records. If you know the name of your new doctor, you can ask your current doctor to send a copy of your records. Your clinic may ask you to make the request in writing and specify the information that you would like sent. If you don't yet have a new healthcare provider, you can ask your current doctor for a copy of your records, which you can keep until you choose a new provider. Alternatively, once you find a new doctor, you can sign an authorization form requesting a copy of your records, which the office staff will send to your former provider.

Back to Top

What are electronic medical records?

Electronic medical records are simply comprehensive, computerized versions of the paper medical records that most healthcare providers currently use. These files can then be linked to a centralized system. Currently, only 8% to 12% of hospitals and about 17% of physicians currently use electronic medical records. The recently passed economic stimulus package includes the Health Information Technology for Economic and Clinical Health Act (the HiTECH Act), which allocates more than $19 billion over the next six years to increase electronic medical record use.

There are a number of benefits related to the use of electronic medical records. They can foster more efficient healthcare, because they facilitate access to information. However, efficiency isn't the only benefit. Electronic medical records can also enhance patient care. Most systems include tools that assist physicians with diagnosis and treatment recommendations, which can lead to better decision making. Finally, electronic medical records can make healthcare safer. For example, when your records can be easily shared, everyone involved in your healthcare can access important information about your medical history and medications. This can be lifesaving, in an emergency situation.

On the other hand, keep in mind that digital technology is often accompanied by concerns regarding privacy and security, and electronic medical records are no exception. There has been much discussion about the necessity of safeguards against the unauthorized access to and misuse of patient data, as well as long term data management issues. In response, the HITECH Act has set new standards related to electronic medical records. For example, it requires organizations that exchange or routinely access protected health information to develop and implement comprehensive, written security policies and procedures. It also requires organizations covered by HIPAA and their business associates to comply with new patient notification rules in the event of a security breach.

Back to Top

How can I protect myself against medical identity theft?

Medical identity theft happens when someone uses your name and other parts of your identity (e.g., your social security number or insurance information) to obtain medical services or to make false claims for medical services without your knowledge or consent. It can involve the creation of fictitious medical records in your name or the inclusion of erroneous information in your existing medical records.

It is often more difficult to discover medical identity theft than it is to discover financial identity theft, since there is no single place to look for a red flag. Some people have realized they've been victimized when they receive a debt collection letter for services they never received. Others have noticed an error in their medical file or received a call from an insurance investigator. The following steps can help protect you against medical identity theft:

• Review all insurance statements (i.e., "Explanation of Benefit" information). If you notice that you have been charged for services or medical equipment that you did not receive, call the healthcare provider and the insurer involved. Don't assume that there is not a problem just because you don't owe money.
• Each year, contact your health insurer to request a listing of all of the benefits paid in your name. If there are payments for services or goods that you don't recognize, follow up with the healthcare provider and insurer involved. Doing so will also help confirm that your contact information is correct –– sometimes identity thieves will change your billing address and phone number, which means that you may not receive fraudulent bills.

If you are a victim of medical identity theft, it is important to file a report with your local police. You may need to provide a copy of the report to healthcare providers and insurers involved in the case. You can also file a medical identity theft complaint with the Federal Trade Commission (FTC). For more information about this go to http://www.ftc.gov/bcp/edu/microsites/idtheft/ or call the FTC Identity Theft Toll–Free Hotline at 1–877–IDTHEFT (438–4338). The FTC Web site also provides helpful information about how to resolve any financial repercussions of the theft.

Back to Top

What is a personal health record?

A personal health record is a health record that you initiate and maintain yourself. You can think of it as an autobiography of your health. You never know when you will need treatment for an illness or injury, and important information about your health history may be scattered across a number of different healthcare providers and facilities. If you keep your own updated and easily accessible personal health record, you can help ensure that you will have vital information at your fingertips and that there are no errors or omissions in your "chart." This allows you to be a partner in your healthcare, rather than rely on a nurse or doctor to convey medical information to you. It also gives you a backup, in case your clinic's records are lost or destroyed.

The first step to compiling a personal health record is to contact all of your healthcare providers and obtain your records. The next step is to organize the information, so that you can easily access whatever you might need. This can be as simple as a collection of paper files of all of the records you have collected. Or, you may find that your healthcare provider allows you to access your medical record through the Internet and create a personal health record from it. There are also commercial software packages that let you to store your information electronically, either on your own computer or on the Internet. Remember that electronically stored data can be vulnerable to unauthorized access, as described above, so be sure to check the software vendor's privacy and security policies. Also consider ease of use, comprehensiveness, and accessibility. Electronic personal health records may be more efficient than paper, especially as more healthcare providers move to electronic health records, but the most important thing is to have a single location for all of your health information, in whatever format you choose.

A typical personal health record contains your name, birth date, blood type, emergency contact information, dates and results of tests, dates and other information about illnesses and surgeries, a list of your medications and dosages, and information about any allergies and chronic diseases. You may also want to include contact information for each of your healthcare providers, health insurance information, and a living will. Remember that your personal health record will be complete only if you update it each time you see a healthcare provider.

Back to Top

Conclusion

Over the past decade, consumers have been playing a more active role in their healthcare. They are using the Internet to review the quality of healthcare providers and research information related to health and disease. Accessing and using your medical records is another step in this direction. The more you know about your health, the more control you can take over it, and the healthier you are likely to be.

Back to Top