Both the HIPAA Privacy Rule and Arizona law give you rights to your medical record. The HIPAA Privacy Rule sets standards that apply to records held by health care providers across the nation. Arizona law sets standards for records held by physicians, optometrists, chiropractors, hospitals and others licensed to provide medical care in Arizona. Most health care providers must follow both the HIPAA Privacy Rule and Arizona law. If a standard in Arizona law conflicts with a standard in the HIPAA Privacy Rule, your health care provider must follow the law that is the most protective of your rights.

Summary of Your Rights

In Arizona you have the right to:

• See and get a copy of your medical record.
  
  Your health care provider usually must let you see your medical record or give you a copy of it no later than 30 days after they receive your request. This right is called the right to access your medical record.
  
  In many cases, your health care provider is allowed to charge you a fee for copying your record. They can also charge you the actual cost for postage if you have the copy mailed to you.
• Correct your medical record by having information added to it.
  
  You have the right to have information added to your medical record to make it more complete or accurate. This right is called the right to amend your record.

• File a complaint.
  
  You have the right to file a complaint with the Office for Civil Rights, U.S. Department of Health and Human Services if you believe your health care provider has violated your right to see, get a copy of, or amend your medical record. You can also file a complaint with the state agency that regulates your health care provider.

You can learn more about these rights in the following sections of guide.

Who Has to Follow these laws?

Most Arizona health care providers (such as physicians, optometrists, chiropractors, hospitals) must follow both the HIPAA Privacy Rule and state laws that give patients rights in their medical records.

There are some health care providers, however, that do not have to follow the HIPAA Privacy Rule. The HIPAA Privacy Rule only covers health care providers that use computers to send health information for certain administrative or financial purposes (such as filing claims for insurance).

Sometimes Ashley goes to a doctor at a free clinic for medical treatment. The doctor does not accept private insurance, Medicaid, or Medicare. The doctor does not file any insurance claims. Ashley’s doctor probably does not have to follow the HIPAA Privacy Rule because the doctor does not appear to send health information for the types of administrative or financial purposes that would make her a covered health care provider under the Rule

---

If you have questions about whether your health care provider must follow the federal HIPAA Privacy Rule, you can contact the Office for Civil Rights, U.S. Department of Health and Human Services (OCR), the agency that is in charge of enforcing the HIPAA Privacy Rule. Section 4 of this guide lists contact information for OCR.

Are nursing homes covered by HIPAA?

Yes. Most nursing homes are covered by the HIPAA Privacy Rule. They also have to follow other specific rules that only apply to nursing homes and long term care facilities. Because the rules for nursing homes are different than they are for other health care providers, they are not covered by this guide.

What if my health care provider does not have to follow HIPAA?

Even if your provider does not have to follow the HIPAA Privacy Rule, they still have to follow Arizona laws that give you rights to your medical record. Section 6 lists some resources where you can read these state laws.

This guide, however, only explains how to get your medical record from Arizona providers who have to follow the HIPAA Privacy Rule and state law. 

What Records Do I Have the Right to Get and Amend?

You have the right to see and get a copy of your medical record. This right often is called the right to access your medical record. You also have the right to correct your medical record by having information added to it to make it more complete or accurate. This right is called the right to amend your record. (This guide will call these rights the "right to get and amend.")

Your medical record includes such things as:

• Information that identifies you, such as your name and Social Security number.
• Information that you tell your doctor, such as:
  • Your medical history.
  • How you feel at the time of your visit.
  • Your family health history.
• The results of your examination.
• Test results.
• Treatment received in a hospital.
• Medicine prescribed.
• Notes your doctor makes about you.
• Other information about things that can affect your health or health care.

You have the right to see, get a copy of, and amend these records whether they are kept on paper, on a computer, or in other format.

Who owns my medical record?

Under Arizona law, your health care provider owns the original medical record. However, you have the right to see and get a copy of it.

What happens if my medical record has information in it that came from a different health care provider?

Generally, if your provider has the medical information that you request, they must give it to you. You have the right to get the information no matter who originally put it in the record. Your right to amend this information may be limited, though. For more information about how to amend information in your record you can read Section 3 of this guide.

Do I have the right to get and amend records related to substance abuse or mental health treatment?

Maybe. The rules for when you can get and amend your records about mental health and substance abuse treatment can be different. For example, psychotherapy notes may be treated differently than other records under HIPAA and state law. Because the rules for mental health and substance abuse records can be different they are not discussed in this guide. You can find some resources that explain your rights in these types of records in Section 6 of this guide.

Who Has the Right to Get and Amend My Medical Record?

You have the right to see and get a copy of medical records that are about you. You also have the right to correct medical records that are about you by having information added to them. (This guide calls these rights the right to "get and amend" your medical record.) If there is someone who acts as your personal representative, they usually have the right to get and amend your record on your behalf.

Do I have the right to get and amend my minor child’s medical record?

Generally, yes. As a parent or guardian, you generally have the right to get and amend your minor child’s medical record. In Arizona, you usually have these rights when your child is younger than 18 years old.

As a parent, do I always have the right to get and amend my child’s medical record?

No. A parent does not always have the right to get and amend a minor child’s medical record. For example, if a health care provider reasonably believes that a parent is abusing or neglecting a child, the provider does not have to give the parent access to the child’s medical record.

Some other situations where parents do not have the right to get and amend their child’s medical records are discussed in the following questions and answers.

Who has the right to get and amend my child’s medical record once she turns 18?

Once your child turns 18, your child has the right to see, get a copy of, and amend her own medical record. This includes getting access to records that were created when she was still a minor. After your child turns 18, you usually no longer have the right to get and amend your child’s medical record just because you are her parent.

I am under 18. Do I have the right to get and amend my own medical record?

Usually, the right to get and amend a minor’s medical record belongs to the minor’s parents. There are certain circumstances, however, in which you, as a minor, have the right to get and amend your own medical record. In Arizona, if you are under 18 and emancipated or if you are married or homeless, you have the right to consent to your own medical treatment. You also have the right to get and amend your medical records. In these circumstances, your parents generally do not have the right to access your medical record without your written permission.

Additionally, in Arizona, an unemancipated minor can consent to diagnosis and treatment for venereal disease without their parents' permission. When you consent to treatment for a sexually transmitted disease, you have the right to get and amend your medical record related to this treatment. Your parents do not have the right to access information related to this treatment without your written permission.

Jason is 16 and is sexually active. He consents to be tested and treated for chlamydia, a venereal disease. Jason’s mother later requests a copy of his medical record. Jason's doctor may not give Jason's mother the part of his record that is related to this testing and treatment without Jason's written permission.

---

I am listed as my mother’s agent on her health care power of attorney. Do I have the right to get her medical records?

Yes. If you have your mother’s designated agent on her health care power of attorney, you generally have the right to get and correct her medical records that are relevant to making health care decisions on her behalf. You have the right of access for as long as the power of attorney is in effect.

Maria’s mother signed a health care power of attorney form that gives Maria the power to make health care decisions if her mother is unable to make such decisions. Maria’s mother was in a bad accident and is not able to make decisions about her health care. Maria now has the right to make health care decisions on her mother’s behalf. She also has the right to get her mother’s medical records. For example, Maria has the right to see the records about her mother’s current medical condition and treatment.

Maria is curious about the time her mother had a miscarriage. Maria wants to look at these old medical records. Maria does not have the right to get and amend these old medical records because the records have nothing to do with her mother’s current condition or treatment.

---

It depends. Arizona has a very detailed law controlling who can get access to a deceased person's medical records. Generally, a person who was authorized to make health care decisions for the patient at the time of death (such as a designated agent for health care decisions or another health care surrogate) has the right of access to the deceased person's medical records. In addition, the personal representative or administrator of the estate of a deceased patient has the right to access the deceased's record. If there is no personal representative or administrator, the right to access the deceased's medical record generally belongs to the following persons in the following order of priority:

• The deceased's spouse, unless the patient and the patient's spouse were legally separated at the time of the patient's death
• The acting trustee of certain inter vivos trusts created by the patient during his life.
• An adult child of the deceased patient.
• A parent of the deceased patient.
• An adult brother or sister of the deceased patient.
• A guardian or conservator of the deceased patient at the time of the patient's death.

However, these persons do not have the authority to obtain the deceased's medical record if during his lifetime, the deceased patient notified the health care provider in writing that he opposed the release of his medical record. Additionally, if a person higher in priority notifies the health care provider in writing that the deceased opposed the release of his medical record, a person lower in priority does not have the authority to obtain the deceased's medical record.

When Donald died, he left behind a spouse, Joyce, and an older brother, Tom. Following her husband's wishes, Joyce wrote a letter to Donald's doctor advising him that Donald did not want his medical record released after his death. Because Tom (a brother) has a lower priority than Joyce (a spouse) Tom does not have the authority to obtain Donald's medical record. If Tom requests Donald’s medical record from Donald’s doctor, the request should be denied.

---

How Long Does My Provider Have to Keep My Medical Record?

Generally, Arizona law requires health care providers to keep the medical records of adult patients for at least 6 years after the last date the patient received medical care from that provider. If the patient is a child, the provider must keep the patient's medical records either until the patient reaches the age of 21 or for at least 6 years after the last date the patient received medical care, whichever is longer.

You have a right to see, get a copy of, and amend your medical record for as long as your health care provider has it.