Electronic Code of Federal Regulations
45 CFR 164.524 — Access to protected health information
The current HIPAA access provision.
Medical records
GuideWeSpeakLaw EditorialUpdated August 24, 2026Sources reviewed
The chart, billing record and official facility data can establish what was documented. They cannot replace a qualified review of the care or prove causation by themselves.
Verification ledger
Electronic Code of Federal Regulations
The current HIPAA access provision.
U.S. Department of Health and Human Services
HHS guidance on designated record sets and access requests.
Centers for Medicare & Medicaid Services
What hospital-level Care Compare data covers.
Health Resources and Services Administration
The de-identification and statistical-use limits of the public NPDB data.
HIPAA generally gives an individual access, with limited exceptions, to protected health information about that person in a covered provider's or health plan's designated record set. That can reach more than the clinical chart, including billing, payment, claims, insurance, laboratory, imaging and clinical-note records used to make decisions about the person.
Ask for the records in the form and format you need when the rule allows it, and keep the request and response. The access rule does not require the provider to create a new explanation or analysis that is not already in the record.
Arrange visits, orders, test results, messages, medication lists and bills by date. Note missing date ranges or attachments, but do not rewrite the chart or turn an unfamiliar entry into a diagnosis. A clean timeline helps a qualified reviewer see what the record says and what it does not contain.
Records can establish documentation and sequence. They do not, on their own, establish the applicable professional standard, a departure from it or whether an act caused a particular outcome.
CMS Care Compare publishes hospital-level process, outcome, patient-experience and other quality measures for covered Medicare-certified hospitals. Those measures can provide facility context, but they are not an evaluation of one patient's care or one clinician's conduct.
The National Practitioner Data Bank's public file is even more limited for individual research: it is de-identified, designed for statistical analysis and may not be used to identify a practitioner, entity or patient. It is not a named-doctor lookup tool.
Store medical records securely and share only what is needed with people you choose. When checking a clinician's license or public discipline, use the current official licensing board for the relevant state and match identifiers carefully; this national page does not infer an individual's status from aggregate data.
Updated August 24, 2026. No corrections are recorded.