You've probably seen your chart at your doctor's office. In fact, you may have charts at several doctors' offices. If you've been in the hospital, you have a chart there, too. These charts are your medical records. They may be on paper or electronic. To keep track of all this information, it's a good idea to keep your own personal health record.

What kind of information would you put in a personal health record? You could start with

• Your name, birth date, blood type, and emergency contact information
• Date of last physical
• Dates and results of tests and screenings
• Major illnesses and surgeries, with dates
• A list of your medicines and supplements, the dosages, and how long you've taken them
• Any allergies
• Any chronic diseases
• Any history of illnesses in your family

A record of information about a person’s health. A personal medical history may include information about allergies, illnesses, surgeries, immunizations, and results of physical exams and tests. It may also include information about medicines taken and health habits, such as diet and exercise. A family medical history includes health information about a person’s close family members (parents, grandparents, children, brothers, and sisters). This includes their current and past illnesses. A family medical history may show a pattern of certain diseases in a family. Also called health history.

Having your health record makes it easier to:

• Share important health information with family members, a new doctor or other health care provider, or a medical emergency team
• Coordinate health care with different providers, clinics, and hospitals
• Make sure your information is up to date and correct
• Avoid repeating tests and procedures you’ve already had
• Share health information, like immunization records, with schools, camps, and others

What am I asking for?

Health records can sometimes be hundreds of pages long, so knowing which part of the record you want can be important. If you’re not sure, ask for help at your provider’s office.

• Full record: If you’re switching to a new primary care provider or health insurance plan, you’ll want to get a copy of your full record to give to them. You may also want a copy for your own use.
• Partial record: If you want to share specific health information with new providers or others, you may only need a partial record. For example:
  • Allergies
  • Medications
  • Records of immunizations
  • Provider’s notes from a single visit
  • Test results or X-rays

How many copies do I need?

If your health record is not available electronically, or you or your health care provider prefers a paper copy, you’ll need to determine how many copies you need.

• Personal use: If you want a copy for your personal use, you may need only 1 copy.
• Care providers: If you’re sharing health information with your care team, your family, or the person you’ve asked to make health care decisions for you (sometimes called a personal representative), you may need a copy for each person or office.

What format do I need?

Health records are available in different formats:

• Electronic records, like Word documents, PDFs, and data your computer can read
• Paper records

Who is the health record for?

For yourself: Choose the format that works best for you. Electronic records are the most convenient because they’re easier to update and to share. In most cases, they take up less space.

• Structured data (data your computer or smart phone app can read)
• Text file (like a Word document)
• PDF
• Paper

For your care team: If you’re sharing your record with a new health care provider, ask what format they need. Because of differences in record keeping, each office may require a different format.

How do I want it to get it?

Depending on the format of health record you choose, you have some choices about how it will be delivered to you and your care team. For example:

• Secure email through your health care provider’s health record system, sometimes called a patient portal (for your own use)
• Directly into your electronic health record (for your provider’s use)
• Non-secure email (your personal email)
• CD or USB (thumb) drive
• Fax
• Mail (standard postal service)
• Pick-up at provider’s office

TROUBLESHOOTING TIP

Ask your provider about your options

Some types of data, like X-rays or MRI scans, may not be available electronically, so work with your health care provider to find out what they’re able to provide. They may only be able to provide certain parts of your record in paper format.

If you want to get your health record, it helps to understand how the process works. That way, you’ll know what to do if you hit a roadblock.

This guide won’t provide you with your health record but instead will teach you how to request it from your health care provider.

How do I get started?

The first step is to check your health care provider’s online patient portal. A patient portal is a secure website where patients can often do things like make appointments, contact their provider, and look at lab results. Some of your health information, like a list of the immunizations you’ve had, may also be available through the patient portal.

Have you tried your provider’s online patient portal?

About 8 in 10 individuals who used their online patient portal found it helpful and easy to understand.

If the health information you need is not available through the patient portal, try other ways to contact your provider:

• Check their website: Information about how to get your health record may be found under the Contact Us section of a provider’s website. It may direct you to an online portal, a phone number, an email address, or a form.
• Phone or visit: You can also call or visit your provider and ask them how to get your health record. Ask for the health information services department or the administrative staff in charge of releasing health records.

Calling all active-duty service members, veterans, and people with Medicare coverage!

You can see and download some of your health information just by clicking on the Blue Button icon on your provider’s online patient portal. Look for the Blue Button icon on:

• TRICARE Online
• MyHealtheVet
• MyMedicare.gov

FREQUENTLY ASKED QUESTION

I care for my child, a family member, or another adult — can I access their health record?

Yes, and the process is basically the same as getting your own record. If you have a medical power of attorney — legal paperwork allowing you to make medical decisions for the person — you have the right to access their record. Under HIPAA, a person who can legally make medical decisions for someone else is called a personal representative. If you’re not a personal representative, the person you care for can ask their health care provider to give you access to their health record.

TROUBLESHOOTING TIP

Know your rights

If your health care provider says they can’t provide access to your health record because of HIPAA, tell them that both HIPAA and the Department of Health and Human Services (HHS) require them to give you access to your record. This is your protected right under the law.

How do I ask for my health record?

How you make your request will depend on your health care provider’s processes. You may be able to request your record through your provider’s patient portal. You may have to fill out a form — called a health or medical record release form — send an email, or mail or fax a letter.

How to fill out a health or medical record release form

Your provider’s medical request release form may be organized differently — there is not a standard form — but these are the questions you’re likely to see.

Patient information

Whose health records do you want? Print their full name, date of birth, patient identification number (PIN), or medical record number (MRN). (PINs and MRNs are assigned by providers. If you don’t know your number, you can ask your provider.) You can request the health records for only 1 person per form.

Clinic, hospital, care provider

Who has the information you want? This can be the name of any person who has cared for you or the place where you got care. Include the full name, address, phone number, and secure fax or secure email address.

Date of Services

When did you receive this care? This can be 1 day or a range of dates or years. If you’re not sure, ask the provider you received care from what dates you need.

Information to be released

What information do you need? This is to guide your provider in pulling the records you need. Often, it will be a set of check boxes. Check all that apply.

Receiving party or destination of records

Where do you want to send the information? Enter the complete name of the person, place, or company, along with their address, telephone number, and fax number or secure email (through their patient portal). Note: If you need to send your records to more than 1 person, including yourself, a separate request may be required. Ask your provider what they need.

Purpose of release

Why do you need this information? Often, the form will offer a set of check boxes, like ongoing care or new doctor. You can check all that apply, but according to HIPAA, you don’t have to provide this information in order to get your health record. So you can leave this section blank.

Expiration date or duration of consent

How long do you want this permission to share your records to be valid? Not all forms will include this section. However, if you don’t specify a date, most permissions will end 6 months to 1 year from the date you filled out the form. Note: According to HIPAA, you don’t have to provide this information in order to get your health record, and you can leave this section blank.

Release instructions

How and when do you want to have this information? This tells your provider if you’d like your records by a certain date and what kind of record you want — like paper or a PDF. Although you may ask to get your health records sooner, your provider can take up to 30 days to deliver your health record.

Signature of Patient or Personal Representative (also called “Patient Representative”)

You must sign the form, or your provider will not be able to process your request.

Date

Enter the date for the day you sign the authorization form.

Relationship to Patient

If you’re not the patient, how are you related to the patient? If you’re getting the records of another adult, this is where you’ll tell the provider that you’re the other adult’s personal representative.

Legal Authority

If you’re requesting health records for someone other than your child, you may be required to provide a copy of the legal paperwork giving you the right to access their health information — if their health care provider does not already have it.

TROUBLESHOOTING TIP

Bring a form of photo identification

If you deliver your request form or letter in person, you’ll be asked to present your ID — like a driver’s license.

FREQUENTLY ASKED QUESTION

Can my health care provider’s office refuse to give me my health record because I have an unpaid bill?

No. According to federal law, your provider must give you access to your health record, even if you have an unpaid bill.

Do I have to pay a fee to get my health record?

You may have to pay a fee. However, according to your federal rights, your health care provider may only charge a reasonable fee for:

1. Making a paper copy or electronic media copy — like a CD or USB (thumb) drive — of your health record
2. Mailing you a paper or electronic media copy of your health record

When you send in the request for your health record, ask your provider how much it will cost to get your record.

TROUBLESHOOTING TIP

Get your doctor’s or provider’s contact information

In order to get your health record, you’ll need the full names, physical addresses, phone numbers, and fax numbers or secure emails (through their patient portal) of all the doctors and providers who are sending and receiving your health record.

How long will I have to wait?

According to federal law, your health care provider can take up to 30 days to deliver your health record. However, if you requested a specific delivery date, you may get your record sooner. If your provider needs more than 30 days, they must give you a reason for the delay and a new delivery date. They can take up to 30 extra days.

FREQUENTLY ASKED QUESTION

Why is it taking so long to get my record?

There are a few reasons why getting your record can take some time:

1. Records can be thousands of pages long, so sorting through them to find the right information can take time.
2. Your health care provider may have many requests. Some large providers get over 10,000 requests a month.
3. If you are asking for older records, they may be on paper in storage. It may take some time to find and copy these records.

What happens when you request your health record?

This graphic shows the process of what happens when you request your health record from your doctor’s office. It details the process both from your perspective and from your doctor’s perspective.

First, check your patient portal to see if the health information you need is available through the portal. If it’s not, contact your doctor’s office to ask how to request your record.

Next, you’ll have to fill out and submit a health record release form. Depending on the office, you may have to do that in person, by email, or by fax.

The doctor’s office will then gather your information. Federal law gives health care providers 30 days to deliver your health record. After they gather the information, the office will prepare your record for you. You may receive it on paper or electronically, like on a CD or USB drive.

Finally, you’ll receive your record either in person or through your patient portal. Once you have your record, you can share it or use it to manage your health.

TROUBLESHOOTING TIP

Call your provider and ask, “Did you get it?”

After you send in your record request, it’s a good idea to check with your health care provider and make sure they got your request. Sometimes record requests get lost.

If you requested a specific delivery date and your record hasn’t come, or it’s been more than 30 days, call again. And if you feel that you’re not being taken care of, try calling these departments at your provider’s office:

• Customer or patient care: They handle patient complaints. Their contact information is often found in the Contact Us section of your provider’s website.
• Patient privacy and rights: Every provider has a designated HIPAA privacy officer. They make sure your provider is following the rules for protecting the privacy of your health record and responding to your right to access it. Their contact information is often found in the Contact Us or Privacy section of your provider’s website.

Once you get your health record (also known as a medical record), look it over to make sure that all of your health information is complete, correct, and up to date. This is important because you may have forgotten to tell your health care provider something or they may have forgotten to write it down. The staff in your provider’s office are busy people who make mistakes just like everyone else. Some examples of common errors:

• You may have forgotten to tell your provider about something — like a new medication or allergy
• Your provider might have misunderstood, incorrectly noted, or left out something — like information about your health history or your symptoms or the date of your visit
• Your provider might have charged you for a test you didn’t have

If you don’t check your record, you won’t know these mistakes have been made, and they could impact your future health and treatment. Explore these tips on what kind of mistakes to look for — and what to do if you find one!

It’s important to check it!

Nearly 1 in 10 people who check their online health record ask to have a mistake corrected.

Source: ONC Data Brief 40

What kind of mistakes am I looking for?

You’re looking for mistakes or out-of-date information that will affect how your health care provider diagnoses and treats you, whether your provider can contact you, and how you’ll be billed. You can let typos go, but if a mistake can affect your health, it should be fixed.

Check your personal information, including:

• Name, address, and phone number
• Health insurance plan’s name and phone number
• Identification numbers, like your patient identification number or social security number
• Emergency contact names, addresses, and phone numbers

Check your health information, including:

• Doctor’s appointment notes
• Health or medical history
• Signs of illness (called symptoms)
• Immunizations
• Health conditions (sometimes called diagnoses or problem lists)
• Allergies
• Medicines (what you take, how much, and when)
• Tests
• Surgeries and other procedures

Check your medical bills:

Make sure you’re only being charged for services you’ve received. You can do this by comparing the information in your health record with:

• The reports your health insurance plan sends you (often called Explanation of Benefits)
• The bills from your doctor or other health care providers

FREQUENTLY ASKED QUESTION

Some of my older records are missing — can I get them?

Yes, if they still exist. State laws determine how long a health care provider must keep your health records — and it varies from state to state. Some providers archive (store) older records offsite. If you haven’t been to your provider in more than 5 years, your records may have been put in storage — but you still have the right to get a copy.

What do I do if something is incorrect or missing?

If you think there’s a mistake in your health record, you have a right under HIPAA to ask your health care provider to fix it.

If you want to have a mistake fixed, follow these steps:

Step 1: Contact your provider

Contact your provider’s office and find out what their process is for making a change to your health record. They may ask you to write a letter or fill out a form. If they have a form, ask them to email, fax, or mail a copy to you.

Step 2: Write down what you want fixed

If your provider has a form, and you want to fix a simple mistake, fill out the form and attach a copy of the health record page where you found the mistake.

If your provider doesn’t have a form or if the mistake is complex, you may want to write a letter describing the correction. Make sure you include:

• Your full name, address, and phone number
• Your doctor’s, nurse’s, or provider’s full name and address
• The date of service
• A short, specific, and clear explanation of what needs to be fixed and why
• A copy of the record page where you found the mistake
• Your signature

Step 3: Make a copy of your request

Make a complete copy of everything you’re sending to your provider for your own records.

Step 4: Send your request

Depending on your provider’s processes, you may be able to deliver your request different ways:

• Secure email through your patient portal
• Non-secure email (your personal email)
• Fax
• Mail (standard postal service)
• In person

Note: If you want to send your request by email, you’ll need to attach digital copies (PDF files) of the record page where you found the mistake and the request form. Messages you send through your patient portal are secure, which helps protect your privacy and personal information. But your personal email isn’t secure, which makes it easier for someone to view or steal your personal information.

TROUBLESHOOTING TIP

Find out who needs to fix the mistake

Make sure you address your request to the specific doctor or other provider who made the mistake. It will be their responsibility to fix it. Note: Your doctor or provider may have retired or changed practices. If this is the case, the clinic, office, or hospital can tell you who should take care of your request.

FREQUENTLY ASKED QUESTION

I care for my child, a family member, or another adult — can I ask to fix something in their health record?

Yes. If you legally make health care decisions for someone else, the process is the same as fixing a mistake in your own record. Under HIPAA, a person who can legally make medical decisions for someone else is called a personal representative. Health care providers are not required to respond to requests from caregivers who are not personal representatives. If the person is someone other than your child, the provider may ask to see a copy of your power of attorney (legal paperwork) before responding to your request.

What happens after I request a correction?

Your health care provider has 60 days to respond to your request, unless they ask for an extension (extra time). Here’s what you can expect:

If your provider agrees there’s a mistake in your health record, they’ll update your record and send you a notice — either in your patient portal or via email or mail — that they’ve taken care of it.

If your provider does not agree with you, they’ll send you a denial notice that should include:

• The reason they’re not going to fix the mistake. For example, they might say they believe your health record is correct and complete.
• Information about how to reply to their decision.

What do I do if my provider doesn’t agree with my request?

If your health care provider does not agree that there is a mistake in your health record, you can:

• Send them a formal letter in reply to their decision, stating clearly why you disagree. Their denial notice should include instructions on how to do that. If not, call their office. This response will be attached to your health record.
• If you don’t want to reply to the denial notice, you can ask your provider to attach a copy of your original request and the denial notice to the affected page(s) of your health record.
• File a complaint with the Department of Health and Human Services.

FREQUENTLY ASKED QUESTION

What do I do if I can’t understand something in my health record?

Medical words and abbreviations can be confusing for us all. If you don’t know what something means, ask your health care provider. You can also use the A.D.A.M. Medical Encyclopedia to find out what medical terms mean and look up abbreviations and acronyms at MedlinePlus.

It’s very common to get your health record for a specific purpose — like when you have a new primary care provider or you need to share some test results with your care team. These are great reasons to get it. But it can also be empowering to have your record for your own use.

Your health record can help you understand, advocate for, and manage your own health care — it can make you an expert on you.

Explore these tips on how to make the best use of your health record. And keep in mind that it will be easier to share and manage your health information if you have an electronic copy of your health record.

Share your health record

Having your health record makes it easier for you to share it. Sharing your health information helps ensure that all of the health care providers and caregivers you work with have the information they need to safely care for you. People who might need this information include:

• Family members and caregivers
• Primary care doctors, specialists, and other providers
• Emergency care teams

Stay on top of your health care

Having your health record can give you a complete picture of your health. You can:

• Review your health care provider’s notes, treatment plans, and test results to make sure you understand them — and prepare questions for the things you don’t understand
• Keep track of your test results and chronic conditions — is your health improving?
• Stay on top of yearly check-ups, immunizations, and tests — for you and your family
• Save time and money by only getting the tests and procedures you need

Use an app to manage your health information

You may have heard of apps (programs) that track things like how many steps you take and calories you eat. There are also health apps that help you manage your health record from your phone or tablet.

No matter how you store and manage your health record, remember: It’s important to make sure it’s secure — that no one else can see your health information. You may be able to securely copy your health record directly into an app from your provider’s portal.

What are the benefits of a secure health app?

• It lets you see your health record from anywhere, at any time
• It can be more secure than paper or email, so you can get to your health information while keeping it private
• It can make it easier to keep your health records organized and up to date
• It can make it easier and safer to share your health record with providers and caregivers

Some apps also let you:

• Keep health records for family members or other people you care for
• Store information about your medicines, allergies, health conditions, and emergency contacts
• Track and set up reminders for medicines, tests, and appointments
• Add notes and photos to your record so you can remember questions and information for your health care provider
• Get detailed information about medicines you’re taking
• Meet your health goals with a digital coach

Many people use health apps — you might like one too!

Half of people with a smartphone or tablet have a health or wellness app.

Source: ONC Data Brief 48

What should I look for in a health app?

If you are looking for an app to help manage your health information, use this checklist. Make sure it:

• Allows you to securely look at and store your health record
• Allows you to securely download your health record from your provider’s online portal
• Allows you to securely share your health record with a provider or caregiver
• Specifically states that it won’t use, sell, or otherwise share your personal health information without your permission

FREQUENTLY ASKED QUESTION

Do I have to pay for a health app?

There are many free health apps. However, if you want some of the more complex features — like information about different medications or the ability to track your health and wellness activities — you may have to pay a one-time fee or an annual subscription.

TROUBLESHOOTING TIP

Get data directly

Some health apps make you manually type in or scan in your health information. Electronically transferring your electronic health record directly into the app is often safer — and makes it easier to keep your health information accurate and up to date.

Take Control. Protect Your Health Information.

HIPAA protects your health information when it is held by most health care providers, health insurers, and other organizations operating on behalf of your health care provider or health plan.

However, it's also important to protect health information that you control. If you store health information on your personal computer or mobile device, exchange emails about it, or participate in health-related online communities, here are a few things you should know:

• While the HIPAA Privacy and Security Rules are in place to protect and secure your health information when it is held by your health care provider (such as your doctor or hospital) or health insurance company, those laws do not apply if you share your health information with an organization that is not covered by HIPAA. For example, if you post that information online yourself — such as on a message board about a health condition, it is not protected by HIPAA. Never post anything online that you don't want made public.
• Your doctor uses tools to protect and secure your health information at his or her office. You can do the same at home. If you have health information stored on your home computer or mobile device — or if you discuss your health information over email — simple tools like passwords can help keep your health information secure if your computer is lost or stolen.
• There are medical identity thieves that could try to use your personal and health insurance information to get medical treatment, prescription drugs, or surgery. The best way to protect yourself against this possibility is to make sure you verify the source before sharing your personal or medical information. Safeguard your medical and health insurance information and shred any insurance forms, prescriptions, or physician statements. For more information about medical identity theft, visit the Federal Trade Commission (FTC) website to learn how to protect yourself.
• If you store your health information online, you should be sure to read the website's privacy policy and terms of service. For practical additional tips to help you protect and secure your health information online, visit: OnGuardOnline.gov.

How can I file a complaint?

If you believe your information was used or shared in a way that is not allowed under the HIPAA Rules, or if you were not able to exercise your rights, you can file a complaint with your provider or health insurer. The notice of privacy practices you receive from them will tell you how to file a complaint. You can also file a complaint with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights or your State's Attorneys General Office.

If you believe that an online company that is not covered by HIPAA, such as a message board, has shared your health information in a way that conflicts with their privacy policy on their website, you can file a complaint with the Federal Trade Commission.

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule gives you, with few exceptions, the right to inspect, review, and receive a copy of your medical records and billing records that are held by health plans and health care providers covered by the Privacy Rule. Under HIPAA, they are required to provide you with a copy of your health information within 30 days of your request.

A provider cannot deny you a copy of your records because you have not paid for the health services you have received.

If you believe that your doctor or other health care provider violated your health information privacy right by not giving you access to your medical record, you may file a HIPAA Privacy Rule Complaint with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights. The easiest way to file a complaint is to go through the HHS Office for Civil Rights. You can also use this memo to demonstrate your rights.

Medical research helps us learn new information about health, illness, and disease and how we can improve health for everyone. You have been asked to join a clinical research study. If you agree to be in this study after learning about it, the research team will ask you to sign certain important forms. One of these may be an authorization form. This form may ask you to let your doctors or other health care providers give your personal health information to the research team. The authorization form could also ask you to let the research team use or share your personal health information with others for the research study. The research team might need to use and share different types of personal health information, such as:

Why am I being asked to sign an authorization form?

Many people have concerns about who can see and use information about them, particularly information about their health. The U.S. Government created a rule, called the Privacy Rule, under the Health Insurance Portability and Accountability Act (HIPAA) to help protect your personal health information from being used or shared when it shouldn't be.

Examples of Covered Entities

• Many hospitals
• Many doctors or nurses
• Some researchers
• Health insurers
• Medicare and Medicaid plans

Since 2003, most hospitals, doctors, and health plans that have your personal health information must follow the Privacy Rule. These hospitals, doctors, and health plans are called "covered entities."

People who work for "covered entities" also may have to follow the Privacy Rule. This usually means that research teams (such as scientists, nurses, and other hospital staff) that work for "covered entities" can use and share your personal health information for this study only after getting your okay. This also usually means that your doctor can't share your personal health information with the research team for this study unless you give your okay. You give your okay by signing the authorization form.

The research team may need information in your medical records for the research study. For example, they may need to know your medical diagnosis or know about allergies you may have. The research team may also need to collect health information about you from other health care providers because the information may be important to the study. For example, the research team may need to get your lab test results from your doctor.

What information will be in the authorization form?

The authorization form will tell you:

• Who will use, share, and receive your personal health information. This could be your doctor, other doctors and nurses taking care of you, or the researchers and other members of the research team. This could also be other institutions or companies that pay for the research.
• What personal health information is needed for the research study. This may include some or all of your medical records, information about the medicines you take, the results of blood tests or X-rays, and other health information.
• Why your personal health information will be used or shared. This part will describe the research study. It also may tell you the title of the research study.
• Your Right to change your mind and cancel your authorization at any time.
• Information on what happens if you do not sign the authorization form, how to cancel your authorization, and how long your information will be used or shared.

Will everyone who sees my personal health information have to protect it under the Privacy Rule?

Not always. There may be times when your personal health information is shared with someone who doesn't have to follow the Privacy Rule. Examples of people and organizations that may not have to follow the Privacy Rule are:

• Sponsors of the research study
• Makers of drugs for the study
• Some researchers

Even though some doctors, researchers, or organizations aren't covered entities under the Privacy Rule, many of them know it's important to keep your information private. They also may have to follow state or other national laws that protect your information.

I don't understand why the authorization form says that the Privacy Rule may not protect my personal health information if it's shared. Why does the authorization form say this?

There may be times when your personal health information is shared with some doctors, researchers, or organizations (such as makers of drugs for the study or study sponsors) that don't have to follow the Privacy Rule. The authorization form tells you that the Privacy Rulemay not protect your personal health information when it is shared with others so that you are aware of this before you decide to sign the form.

I am not sure if I should sign the authorization. What happens if I don't sign?

If you don't sign the form, you may not be able to join the research study. However, your decision to not sign the authorization form won't affect the regular treatment you receive from your regular doctors, nurses, or other professionals normally involved in your health care.

I want to let the research team have my personal health information so I can join the study. How do I give my authorization?

To give your authorization, you need to sign and date the authorization form. Signing the form means that you give your okay for the research team to use or share your personal health information for the research study. Signing the authorization form may also mean that you will give your doctor or hospital your okay to share your health information with the research team.

The authorization form might be given to you as a separate form, or it may be included with the informed consent form you must sign to become part of the study. In either case, the form will tell you how the research team or your doctor or hospital may use or share your personal health information for the study.

Once I have signed the authorization, can I change my mind and cancel it?

Yes, you may change your mind and cancel your authorization at any time.

How do I cancel my authorization?

You must cancel your authorization in writing. The authorization form will give you instructions on where to send the written notice or will direct you to another place to find this information. Once the research study team receives your written cancellation, it won't be allowed to collect, use, or share more personal health information about you except in limited cases. For example, they may need to use or share this information to make sure the research study is still reliable, to report when you canceled your authorization, or to report any unexpected health problems that started before you canceled your authorization.

Will I still be able to stay in the study if I cancel my authorization?

It's up to the research team to decide if you may stay in the research study if you cancel your authorization. Many times a research study can only be helpful if all of the people stay in the study and all of their information can be used and studied for the entire time of the study.

Can my doctor use my authorization for the research study as my okay to share my information for marketing?

No. The Privacy Rule does not allow a doctor or another "covered entity" to use your authorization to use or share your information for research as an authorization for marketing.

What can I do if I think someone has not protected my personal health information?

If you think your privacy rights under the Privacy Rule were violated, you may complain to the "covered entity" (such as the doctor or hospital you visit for the research study). You may also complain to the Office for Civil Rights (OCR). Your complaint must be in writing. To complain to OCR:

• Send the complaint electronically by email to OCRComplaint@hhs.gov, or as a letter or fax to the OCR regional office where the possible violation happened. These regional offices are on the map and chart shown on the back cover, or you can find them on the OCR website at http://www.hhs.gov/ocr/privacyhowtofile.htm.
• Print and fill out the form found on the above website or send the same information to the OCR regional office. Name the person or organization you are complaining about, and describe how you think they didn't follow the Privacy Rule.
• Send in your complaint within 180 days of when you learned about the possible violation.
• Make sure that any possible violation happened on or after April 14, 2003, which is when the Privacy Rule protection started.