Your Medical Records, Your Rights

Whenever you go to the hospital, every doctor, nurse, therapist or other medical professional that is involved in your care generates a large number of medical records. These records are a vital part of any medical malpractice lawsuit and often total thousands of pages. Medical records serve as a window into the minute details that are often crucial in explaining why a medical procedure may have gone wrong. For example, when a patient is hooked up to monitor, every blood pressure reading, heart fluctuation or oxygen level is recorded, often on a minute-by-minute basis. This allows for the ability to track causes and their effects and pinpoint the precise moment that something may have changed. If a patient’s heart rate unexpectedly drops, it is very important to look at the portion of the medical records surrounding the decreasing heart rate to figure out exactly what may have happened to explain the change.

With all of that said, medical records are very private documents. They often contain information and medical history that is personal and therefore should only be seen by a doctor, the patient or a representative authorized by the patient to view their records. In order to protect this patient privacy, Congress passed the Health Insurance Portability and Accountability Act (HIPAA) in 1996. The HIPAA law regulates the use of protected health information by ensuring that this information remains private and is not shared with third parties. Protected health information is broadly defined as any portion of a patient’s medical record or billing information.

Under the HIPAA law, your medical information cannot be shared with anyone outside of the patient’s care team or the patient himself or herself. In fact, absent the waivers discussed below, the individual patient is the only individual who may view their own medical records outside of their medical team. Third parties such as employers or even other family members may not accesses your records without your permission. If, in the event your protected health information is disclosed to a third party, the entity responsible for the safekeeping of your records but notify you of the improper disclosure.

As a patient, you have an absolute right to your medical records. Healthcare providers, hospitals or doctors must provide you with your records within a reasonable period of time following a records request. Generally, complete records must be provided within 30 days of receiving the request, although the law allows for a 30-day extension in limited circumstances. In Illinois, providers may charge a small fee for processing and copying medical records. This fee can be minimized if the record request seeks electronic as opposed to paper copies of the records. Healthcare providers must also make exceptions to the fee provisions in cases of financial hardship.

With our clients, we often ask you to sign a document referred to as a HIPAA authorization. This document allows our office to request and view your medical records that are protected under the HIPAA law. This also allows us to communicate with a medical provider’s records department to clear up confusion over missing records or seek additional records if needed. The HIPAA law creates strict requirements that we also must follow to ensure that your medical information is kept confidential and private.

Due to the restrictive nature of the HIPAA law, we often receive questions regarding who may request medical records in the event of the death of a loved one. In 2011, Illinois streamlined the process to make it easier for family members of a deceased relative to access their records. Prior to the passage of this law, family members could not access such records without formally opening the deceased’s estate in probate court. With the recent changes, upon the death of a loved one, the decedents spouse may request the records. If the decedent was unmarried, records may be requested by a child, sibling or parent. The request must be in writing and contain an affidavit, known as an Authorized Relative Certification. This affidavit simply states the requestor’s relationship to the decedent. A copy of the death certificate must also be provided. You can find sample language for the Authorized Relative Certification by clicking here. Additionally, please do not hesitate to contact our office with any questions regarding obtaining a loved one’s medical records.