Medical records contain information that can affect your insurance, your employment, your relationships and your sense of identity. They describe your body, your mind and your history in extraordinary detail. Yet most patients have only a vague idea of who can see their records, what rights they have to control access, and what to do when something goes wrong.
This guide covers the essentials of medical records privacy — your legal rights, the risks that matter, and the practical steps you can take to protect your information without making it inaccessible when you need it most.
Your core legal rights
In most countries, you have four fundamental rights over your health data:
- **The right to access** — you can request a copy of your records from any provider. Under HIPAA in the US, providers must respond within 30 days; under GDPR in Europe, within one calendar month.
- **The right to correct** — if your records contain inaccurate information, you can request a correction. The provider can decline if the record reflects their clinical view, but must note your objection.
- **The right to restrict** — in some circumstances you can request that a provider not share specific information with other providers, though this right is limited in emergency situations.
- **The right to know about breaches** — providers are legally required to notify you if your health data is compromised in a security incident above a certain scale.
The most common privacy risks
Understanding the actual risks — rather than abstract ones — helps you focus protective effort where it matters.
- **Unintended sharing between providers** — health information exchange systems are designed to improve care but can also result in records being visible to providers you've never seen. Know what consent you're giving when joining a shared record system.
- **Breaches at healthcare organisations** — hospitals and clinics are among the most frequently breached organisations. The data stolen in healthcare breaches is worth significantly more on criminal markets than financial data because it enables both medical fraud and identity theft.
- **Over-broad insurance access** — in some jurisdictions, life insurers and income protection insurers can request access to your full medical records as a condition of underwriting. Understanding what you disclose and when is important.
- **Third-party app permissions** — health apps that connect to your records (via Apple Health, Google Health or direct API access) may share data with advertisers or third parties. Always check the privacy policy before granting access.
- **Paper documents left unsecured** — physical records lying around a home or office are a privacy risk. Documents with diagnostic information should be shredded when they're no longer needed.
What to look for in a health platform's security
If you're using a digital health platform to store your records, the security of that platform is as important as its features. Look for:
- **Encryption at rest and in transit** — your documents should be encrypted both while stored and while being transmitted
- **No selling or sharing of data with advertisers** — health data is valuable; make sure the platform's business model doesn't depend on monetising it
- **Clear data export and deletion rights** — you should be able to take your data with you and delete it permanently
- **Multi-factor authentication** — any platform holding sensitive health data should support (and encourage) MFA
- **Transparent data location** — know which country your data is stored in and what legal regime governs it
Making your records accessible without making them insecure
The biggest privacy risk is also the inverse of access: if your health records are locked away and inaccessible, they can't help you in an emergency. The goal isn't maximum restriction — it's appropriate, controlled access.
Share records deliberately rather than broadly. When a provider asks for your 'full medical history', consider whether that's actually what they need or whether specific recent records are sufficient. A time-limited share link to a curated set of documents is more appropriate than a standing open access to your entire history.
Looms' sharing tools let you create time-limited, revocable links to specific records — you choose what's shared and for how long, and access automatically expires. This is a practical way to share exactly what a provider needs, without giving permanent access to everything.
What to do after a healthcare data breach
If you receive notification that your health data was compromised, take these steps immediately:
- **Check what was exposed** — the breach notification should specify what categories of data were affected. The response depends significantly on whether financial data, diagnostic data, or both were involved.
- **Freeze your credit** if financial information may have been included
- **Monitor for identity theft in healthcare** — a lesser-known but serious crime where fraudsters use your identity to claim medical services or prescription medications. Monitor your explanation-of-benefits statements for claims you don't recognise.
- **Change passwords** for any related accounts, especially if the breached system used the same credentials as other services you use
- **Report to the regulator** if you believe the organisation failed to protect your data adequately — in the US this is the HHS Office for Civil Rights; in the UK, the ICO