Your healthcare providers have a right to see and share your records with anyone to whom you have given permission. For example, if your primary care doctor refers you to a specialist, you might be asked to sign a form that says they can share your records with that specialist.
If you believe that your doctor or other health care provider violated your health information privacy right by not giving you access to your medical record, you may file a HIPAA Privacy Rule Complaint with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights.
The scenarios in which a valid HIPAA authorization form is required are listed in §164.508 and include: Prior to disclosing PHI for marketing purposes. Prior to disclosing PHI for fundraising purposes. Prior to disclosing PHI to a research organization. Prior to disclosing PHI in psychotherapy notes.
Under the CMIA, medical information must be released when compelled: by court order. by a board, commission or administrative agency for purposes of adjudication.
"The correct situation where a patient has to authorize the release of their medical record is when the patient is being charged with assault, and there is a court order.
A covered entity must obtain the individual's written authorization for any use or disclosure of protected health information that is not for treatment, payment or health care operations or otherwise permitted or required by the Privacy Rule.
Permissible situations to release information from a patient's records include when an attorney requests it, when a court requests it by means of a subpoena, and when the patient's father requests it if the patient is a minor.
Reach out to the Pennsylvania Department of Health by calling 877.774. 4748 or emailing pasiis@state.pa.
You may be able to request your record through your provider's patient portal. You may have to fill out a form — called a health or medical record release form, or request for access—send an email, or mail or fax a letter to your provider.