HIPAA, the Health Insurance Portability and Accountability Act, regulates how personal medical information is stored and shared in the United States, IF your records are transmitted electronically by a covered entity or business associate. This includes the right to review and correct your medical records.
Not every health care provider is a “covered entity.” Your information is not protected by HIPAA if your records are not stored electronically. Also, to be covered by HIPAA, that information needs to be attached to a “covered transaction.” Covered transactions are payments, claims information, prior authorizations, and other points where insurance gets involved.
HIPAA covers a lot less than most people think it does, but the ethics of not sharing information when you don’t have to remain.
BUT, every provider, whether they are required to or not, should have a process for you to be able to request a copy of your file and request changes to your records if errors are present. Your records should not be accessible to people outside of your care team and related businesses (insurance companies, etc.) without permission from you or a court order.
At QueerDoc, patient safety, privacy, and consent are our top priorities. We are an independent clinic and use a cloud-based electronic patient care system. Nobody other than the QueerDoc team can access your records- some patient care systems link virtually across different clinics and different states. Ours does not. QueerDoc and our records software are incorporated in states with Shield Laws that protect records requests for gender care. These shield Laws may protect us from having to comply with investigation demands, subpoenas, and court orders from other jurisdictions. We won’t share your records without your permission or a court order (and we have lawyers to fight those court orders.) Other health providers may not be as stubborn, or may not be protected by state shield laws that tell nosy Attorneys Generals in other states to buzz the eff off. If you are a QueerDoc patient and have questions, please ask at your next appointment.
In this current political climate, with escalating attacks on trans and gender diverse healthcare, you may wish to request a copy of your records from your health care providers so that you know what your records say about you. You may also wish for changes to be made to your records to correct or protect your information.
What Information In My Medical Records Can I Change?
- Name, Address, and Other Demographic Information.
- You may need to supply copies of related court orders / IDs.
What Information In Can I Request To Have Changed?
- Errors In Your Account
- Incorrect information about your symptoms, diagnoses, and medicines.
Can I Change A Diagnosis Code to a Different One?
- It is unlikely that a provider will change a code used in the past if the code already used was not incorrect.
- You can ask your provider to use alternative codes in the future.
- It is important to know that insurance might not pay for gender-related care under alternative codes.
How Do I Request A Correction To My Medical Records?
- You will likely need to submit a form to your provider’s medical records office.
How Do I Request A Copy Of My Records?
- Contact information and After Visit Summaries
- Does your care provider have an electronic chart? You may be able to immediately update some demographic and contact information.
- You should be able to download and review your contact information, list of medications, your list of conditions and your after visit summaries.
- Requesting Your Full Chart
- The available documents in your patient chart may not be the full contents of your chart.
- Your best option is to contact customer service or a patient advocate and ask how to get a copy of your records, as procedures may be different at each provider.
- Start with:
- Search the website for “medical records.” This may give you the contact information for the records department or any forms you may need.
- Log in to your patient portal. Look in the menu for “records” or “Document Center” or similar terms. You may be able to download or request records from here.
- Start with:
How Do I Change Information In My Chart?
- You should be able to change your contact information directly.
- If diagnoses, information about your symptoms, or your medications are incorrect, you will likely need to formally request that they be corrected. To do this, you’ll need to contact customer support and find out what their procedure is.
- Providers don’t have to change your medical records, but they do have to tell you if they are not going to and why.
- You can appeal this decision.
- If information in your chart is correct but sensitive, you may not be able to change what is already in your chart. If you trust your provider, reach out to them (you may need to book an appointment for this time!) and ask about using alternative diagnosis codes for future appointments.
How Do I Protect My Information?
- If you’ve ever given someone else access to your chart, you can remove that permission. Again, this may need a call to customer support to find out how to remove access.
- Parents or legal guardians.
- Your special someones.
- Your emergency contacts.
- Release of Information forms for other healthcare providers.
What Information Can The State See?
Providers shouldn’t share medical records without a warrant from law enforcement, but HIPAA does allow providers to share information to law enforcement without a warrant.
If you take a controlled substance, this information is stored in a “PMP,” or Prescription Monitoring Program. Each state has a PMP, and some states share information between their PMPs.
NO ONE should be able to wander around in the PMP looking people up just ‘cause. That isn’t air tight protection, however. Some states may troll the PMP.
In WASHINGTON, the following people can access the PMP:
(via the WA PMP FAQ)
- Prescribers and pharmacists, in order to provide care.
- An individual can request their own information (see the FAQ for the email and phone number.)
- Health professional licensing, certification, or regulatory agencies.
- Local, state, and federal law enforcement or prosecutorial officials engaged in an investigation involving a designated person .
- Medical examiners and coroners during death investigations.
- Authorized practitioners of the Department of Social and Health Services or Health Care Authority regarding Medicaid program recipients.
- The director or director’s designee within the Department of Labor and Industries for workers’ compensation claimants;
- The director or the director’s designee within the Department of Corrections for offenders committed to the Department of Corrections;
- Other entities under grand jury subpoena or court order; and
- Department personnel for purposes of administration and enforcement of this rule or RCW 69.50.
- Public or private entities may get data for statistical, research or educational purposes. They will receive data without information that could be used to identify individual patients, dispensers, prescribers and people who received prescriptions from dispensers.
If you are a Medicaid or Medicare recipient, both state and federal agencies collect data about healthcare usage. Data that links directly to you should not be available without a court order. Data about the care you have received is stored in public and private databases, but shouldn’t have your identity linked to the information. Like the information in the PMP, your specific records can be located and tied to you under some circumstances.
Recap:
- You can request that incorrect information in your medical records be corrected.
- You can request that diagnosis codes be changed.
- Providers and companies may say no. You can appeal that decision but no outcome can be guaranteed.
- You can request that your provider uses different documentation in future visits.
- Government agencies, researchers, and some other folks do have access to anonymous medical information. They may have access to specific medical information if they are currently providing care to you or as part of an official investigation or by court order.
Related QueerDoc articles:
- Data Privacy in 2025: Operational Security (Op-Sec)
- Protecting Your Identity: The Critical Importance of Legal Transition Amid Current Political Challenges – Fall 2024
- 2025 Breaking News: State and Federal Happenings
- Empowered and Connected: Post-Election Resources for Transgender and Gender Diverse Communities
State and federal regulatory intervention in healthcare in the United States is kind of fucked up. Okay, it is super fucked up when it comes to discriminatory laws about who can access what healthcare and how much “The State” gets to know about decisions people make about their own damn bodies. You probably already know where we stand on that. One of the ethical frameworks that influences our work is Beyond Do No Harm: interrupting the link between providing care and supporting criminalization of patients. Some background reading, if you’re interested:
Beyond Do No Harm – Interrupting Criminalization Principles
Beyond Do No Harm Brief: We Must Fight In Solidarity With Trans Youth
Stay In Touch With Us
