Even though you cannot sue directly under HIPAA, you may be able to pursue legal action under other laws if you have suffered harm due to a breach of your medical information.
The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that requires covered entities (e.g., private health care providers, health plans) to protect individuals' health records and other personal health information that the entities maintain or transmit.
A HIPAA violation refers to the failure to comply with HIPAA rules, which can include unauthorized access, use, or disclosure of Protected Health Information (PHI), failure to provide patients with access to their PHI, lack of safeguards to protect PHI, failure to conduct regular risk assessments, or insufficient ...
The NYS Department of Health, however, requires medical doctors to retain records for any adult patients for 6 years. Minor patients are kept for 6 years and until one year after the minor reaches the age of 18 (whichever is longer). For hospitals, medical records must be kept for six years from the date of discharge.
Section 18 requires that within 10 days of a written request for access to records, the provider must give the qualified person the opportunity to inspect the records. Providers must also provide copies of records if copies are requested within a reasonable time frame.
Authorization. A covered entity must obtain the individual's written authorization for any use or disclosure of protected health information that is not for treatment, payment or health care operations or otherwise permitted or required by the Privacy Rule.
Section 18 requires that within 10 days of a written request for access to records, the provider must give the qualified person the opportunity to inspect the records. Providers must also provide copies of records if copies are requested within a reasonable time frame.
New York State Law requires all health care practitioners and facilities to allow patients to have access to their health records. However, some restrictions may apply. This form describes your rights, what information is available and how to appeal if access to health records is denied.
A family member or representative can also request medical records for a deceased patient. To request records for a deceased patient, you can complete the Authorization for Use and Disclosure of PHI formand a letter of testamentary from the courts designating the administrator or executor.
New York State Law requires all health care practitioners and facilities to allow patients to have access to their health records. However, some restrictions may apply. This form describes your rights, what information is available and how to appeal if access to health records is denied.