Prevention & care
Medical records: portals, copies, corrections, results and privacy after sharing
On this page
A medical record contains information documented during care, such as visit notes, diagnoses, medicines and test results. A patient portal is one way to view or communicate about that information. The portal, the underlying record and a downloaded copy are related, but are not necessarily identical collections.[1]
Different forms of access answer different needs
| Term or situation | Meaning | Important boundary |
|---|---|---|
| Patient portal | A system for displaying information and communicating with a service | Ask for additional material when the displayed subset is insufficient[1] |
| Designated record set | The records covered by the specified US HIPAA access right | There are defined exclusions and denial provisions[2] |
| Electronic exchange | Access, exchange or use of electronic health information | Information-blocking rules and HIPAA access procedures are distinct[5] |
| Independent consumer app | A separate destination chosen for health information | HIPAA protection depends on the app’s relationship to covered services[6] |
Request the information and format you actually need
Under 45 CFR 164.524, a HIPAA-covered entity must normally act on an access request within 30 days. A permitted extension has limits and requires written reasons and an expected completion date. The right concerns a designated record set rather than every document a service possesses. The regulation also addresses readable formats and reasonable cost-based copying charges. These are US federal provisions, not a universal deadline or a determination about a particular refusal.[2]
Checking a record is a practical conversation
HHS advises checking whether information is correct and complete and asking for correction when something appears wrong or missing. Explain the specific entry and relevant date rather than requesting that every unfamiliar clinical term be deleted. A clinician may disagree with the requested change; an additional statement of disagreement can remain relevant. A diagnosis being investigated, a historical condition and an active condition also need different interpretation. Clarification should preserve useful history and the context in which an entry was made.[1]
Choose the scope of an adult supporter’s online access
For adults choosing support with England GP online services, family and carer access can be limited to the tasks and information agreed with the surgery. You can choose services, a starting date for visible history, and particular information to keep private. This does not remove your own access. Ask the surgery who currently has access and how to change or remove it; the NHS says removal can be requested at any time. Contact the surgery immediately if someone is pressuring you to share sensitive records.[7]
Evidence & uncertainty
Reading records can reveal information needing clarification, but it does not replace clinical interpretation. Research on patient-reported documentation errors measures what respondents noticed and perceived. It should not be converted into a claim that every apparent disagreement is an independently confirmed medical mistake.[3]
Selected-source overview · Independent review pendingPublished questions
Does my portal necessarily contain my complete record?
Selected-source overview · Independent review pending. Read the evidence context.
No. The displayed information can differ from the material you need. Identify the notes, results, reports and dates relevant to the request, then ask the service how to obtain additional copies or clarification.[1]
Evidence behind this answer
- Get it. Check it. Use it.
agency explanation · Date not stated
Selected relevant original official passages inspected · Access, checking completeness, correction and disagreement
This answer summarizes selected sources. An independent appraisal of the complete evidence has not been completed.
Does HIPAA mean a copy must appear immediately?
Selected-source overview · Independent review pending. Read the evidence context.
The federal access regulation normally requires action within 30 days and describes a limited extension. Electronic information-blocking obligations are a separate framework. The specific service, request and applicable rules matter.[2][5]
Evidence behind this answer
- 45 CFR 164.524: access to protected health information
regulation · Date not stated
Selected relevant original official passages inspected · Designated record set; 30-day action; extension; format and fees - Information blocking
agency regulatory explanation · Date not stated
Selected relevant original official passages inspected · Actors, knowledge standards, exceptions and case-by-case assessment
This answer summarizes selected sources. An independent appraisal of the complete evidence has not been completed.
Does something I disagree with prove a medical error?
Selected-source overview · Independent review pending. Read the evidence context.
No. The survey studied patient-perceived mistakes, not independent confirmation of every concern. Record wording can also describe uncertainty or history. Raise the specific entry so it can be assessed and corrected or explained.[3]
Evidence behind this answer
- Frequency and types of patient-reported errors in ambulatory notes
observational survey · 2020
Original publisher abstract and selected results/methods inspected; no independent full-text appraisal · Abstract; population and response rate; reported mistake types
This answer summarizes selected sources. An independent appraisal of the complete evidence has not been completed.
Does a flagged result in my portal diagnose a condition?
Selected-source overview · Independent review pending. Read the evidence context.
No. A result needs clinical context and interpretation. The immediate-results survey found strong preference for access alongside greater worry after abnormal findings. It did not establish that portal labels are standalone diagnoses.[4]
Evidence behind this answer
- Perspectives of patients about immediate access to test results
observational survey · 2023
Original publisher abstract and selected results/methods inspected; no independent full-text appraisal · Preference denominator; worry; portal-user sample
This answer summarizes selected sources. An independent appraisal of the complete evidence has not been completed.
Is every delayed result information blocking?
Selected-source overview · Independent review pending. Read the evidence context.
No. Defined actors, knowledge standards, the nature of interference and exceptions matter. ONC says that not meeting an exception does not automatically establish information blocking. A delay requires its actual context.[5]
Evidence behind this answer
- Information blocking
agency regulatory explanation · Date not stated
Selected relevant original official passages inspected · Actors, knowledge standards, exceptions and case-by-case assessment
This answer summarizes selected sources. An independent appraisal of the complete evidence has not been completed.
Does an independent app automatically keep HIPAA protection?
Selected-source overview · Independent review pending. Read the evidence context.
No. HHS distinguishes apps acting for a covered service from independent apps chosen by the individual. The latter may fall outside HIPAA for the received information. Check the app’s own privacy practices and applicable protections.[6]
Evidence behind this answer
- Covered-entity liability after sending information to a chosen app
agency regulatory explanation · 2019
Selected relevant original official passages inspected · Independent app versus covered entity/business associate
This answer summarizes selected sources. An independent appraisal of the complete evidence has not been completed.
Can I share appointment access without sharing my whole GP history?
Selected-source overview · Independent review pending. Read the evidence context.
England’s NHS guidance allows different types and limits of family and carer access. Ask the surgery to specify the services, history dates and record details you want shared.[7]
Evidence behind this answer
- How to give someone you trust access to your online health services
agency patient guidance · 2026
Complete original selected adult chapter and review footer read fresh. Related family/carer service chapters conservatively grouped as one work, not asserted to have been read. Added claims concern adults choosing support with England GP online services; no minor or incapacity rule generalized. · Complete adult-selected access chapter: services, chosen limits, history date, removing access and pressure to disclose
This answer summarizes selected sources. An independent appraisal of the complete evidence has not been completed.
Am I committed once I give someone GP proxy access?
Selected-source overview · Independent review pending. Read the evidence context.
No. England’s NHS guidance says you can remove it at any time by telling the GP surgery. Ask the surgery to confirm the current access settings.[7]
Evidence behind this answer
- How to give someone you trust access to your online health services
agency patient guidance · 2026
Complete original selected adult chapter and review footer read fresh. Related family/carer service chapters conservatively grouped as one work, not asserted to have been read. Added claims concern adults choosing support with England GP online services; no minor or incapacity rule generalized. · Complete adult-selected access chapter: services, chosen limits, history date, removing access and pressure to disclose
This answer summarizes selected sources. An independent appraisal of the complete evidence has not been completed.
Patient reports identify concerns, not a national error rate
A 2020 survey across three US healthcare organizations found that 4,830 of 22,889 note-reading respondents reported a perceived mistake, approximately 21%. Reported concerns included diagnoses, history and medicines. The response rate was about 22%, and respondents were predominantly White and well educated. The study did not independently adjudicate every reported mistake. People who read notes and answered an online survey may differ from those who did not. The finding supports a route for discussing possible errors; it does not establish the frequency in every health system.[3]
Immediate results can be welcome and worrying
In a 2023 survey at four US academic centers, 95.7% of respondents answering the preference question wanted immediately released results. Increased worry was more common after results perceived as abnormal. This is a survey of portal users, not a randomized demonstration that immediate release improves health or is equally helpful to everyone. A flagged value may need prior results, the reason for testing and clinician interpretation. Access and explanation should be considered together rather than making patients choose between information and support.[4]
A portal delay needs context before a legal conclusion
ONC describes information blocking as a practice involving specified actors and interference with access, exchange or use of electronic health information. Exceptions and knowledge standards matter. A practice outside an exception is not automatically information blocking; circumstances require assessment. These rules should not be collapsed into the HIPAA 30-day access process or a promise that every result appears instantly. Asking the service what is missing and how to obtain it is more useful than assuming the portal is the complete record.[5]
Privacy can change when a record leaves a covered service
HHS explains that information sent at a person’s direction to an app that is neither a covered entity nor its business associate is no longer protected by HIPAA in that app. An app provided on behalf of a covered entity is a different situation. Review the destination’s access, sharing and deletion policies before exporting. A healthcare origin does not automatically make every later holder subject to the same privacy rules. Other protections may apply, but they should be checked rather than inferred from a medical-looking interface.[6]
References
- Get it. Check it. Use it.
Agency explanation
HHS · Content/publication date: not stated
Accessed: 2026-10-13 UTC · Selected relevant original official passages inspected
Cited sections: Access, checking completeness, correction and disagreement - 45 CFR 164.524: access to protected health information
Regulation
eCFR · Content/publication date: not stated
Accessed: 2026-10-13 UTC · Selected relevant original official passages inspected
Cited sections: Designated record set; 30-day action; extension; format and fees - Frequency and types of patient-reported errors in ambulatory notes
Observational survey
Bell et al. · Content/publication date: 2020
Accessed: 2026-10-13 UTC · Original publisher abstract and selected results/methods inspected; no independent full-text appraisal
Cited sections: Abstract; population and response rate; reported mistake types - Perspectives of patients about immediate access to test results
Observational survey
Study authors / JAMA Network Open · Content/publication date: 2023
Accessed: 2026-10-13 UTC · Original publisher abstract and selected results/methods inspected; no independent full-text appraisal
Cited sections: Preference denominator; worry; portal-user sample - Information blocking
Agency regulatory explanation
ONC · Content/publication date: not stated
Accessed: 2026-10-13 UTC · Selected relevant original official passages inspected
Cited sections: Actors, knowledge standards, exceptions and case-by-case assessment - Covered-entity liability after sending information to a chosen app
Agency regulatory explanation
HHS · Content/publication date: 2019
Accessed: 2026-10-13 UTC · Selected relevant original official passages inspected
Cited sections: Independent app versus covered entity/business associate - How to give someone you trust access to your online health services
Agency patient guidance
NHS · Content/publication date: 2026
Accessed: 2026-10-20 UTC · Complete original selected adult chapter and review footer read fresh. Related family/carer service chapters conservatively grouped as one work, not asserted to have been read. Added claims concern adults choosing support with England GP online services; no minor or incapacity rule generalized.
Cited sections: Complete adult-selected access chapter: services, chosen limits, history date, removing access and pressure to disclose
Scope & review
- Population
- General readers coordinating care; clinical study populations and eligibility are source-specific
- Exposure or intervention
- Medical records
- Comparison
- Portal display versus formal record access; original entries versus requested corrections; source-specific access and privacy frameworks
- Outcomes
- Access, communication, care coordination and interpretation of selected research
- Timeframe
- Current source-specific procedures and selected historical studies; not an individual diagnosis or legal determination
- Jurisdiction
- US federal guidance and selected international research; NHS examples apply to England; local law, insurer and service rules differ
Selected-source educational explanation. Official guidance, original study findings and editorial interpretation are distinguished. No exhaustive search, independent systematic synthesis or qualified medical review has been completed.
Sources checked on their individual access dates. Selected sources were checked; ongoing surveillance and qualified review have separate statuses on the coverage page.
Revision history
- 2026-10-13 UTC: Added a selected-source guide to care access and coordination; qualified review remains pending.
- 2026-10-20 UTC: Added a bounded practical access explanation and distinct reader questions after full adjacent-scope audit and fresh selected-original reading. Prior prose and IDs preserved; older sources were not newly reappraised. Qualified review remains incomplete.
What this article still leaves open
- Which information is absent from a particular portal and needed for a specific care decision?
- How can services provide timely access and understandable explanation without widening inequity?
Suggest a correction
Submit a content correction to the editorial queue, or download a local note. Leave out personal medical details. Submitted text is stored privately with a browser receipt session and is visible to this browser and the editor. Clearing cookies removes access to your submission history. This is not an account or a medical service.
Your submitted corrections for this article
Explore the topic map
Browse the health domains connected to this article. The map also identifies topics whose articles remain unwritten.