Lupus Treatment Records Under HIPAA: Your Privacy and Access Rights

Your lupus care generates detailed documentation across clinics, labs, imaging centers, and pharmacies. HIPAA gives you powerful tools to see, get, and manage those records while setting guardrails on how they are shared. This guide explains your Individual Right of Access, what is and is not included, how to request copies, how to correct errors, and when written authorization is required.

Rights to Access Protected Health Information

Under HIPAA, you have the Individual Right of Access to inspect, obtain copies of, or direct transmission of your Protected Health Information (PHI) maintained in a Designated Record Set. The Designated Record Set includes medical and billing records and any other records a provider or health plan uses to make decisions about you.

For lupus treatment, this typically covers rheumatology notes, nephrology consults, lab results (e.g., ANA, anti-dsDNA, complements, urinalysis), imaging, infusion records, medication lists, care plans, and billing details. You may request your records in the form and format you prefer if they are readily producible, such as secure portal download, PDF, or another electronic format.

A Protected Health Information Disclosure to you under the access right does not require a separate authorization, and the minimum necessary standard does not limit what you receive. Covered Entities Obligations include timely fulfillment, identity verification, and providing a reasonable, cost-based fee for copies when applicable.

• Form and format: You can ask for electronic copies if the provider maintains the information electronically.
• Directing to a third party: You may instruct the provider to send your records to a person or organization you specify in a signed, written request.
• Fees: Only reasonable, cost-based fees for labor, supplies, and postage are permitted for copies you request.

Excluded Information Types

HIPAA’s access right is broad, but some materials are outside scope. These exclusions protect psychotherapy process notes and ensure legal strategies are not exposed through medical record requests.

• Psychotherapy Notes Exclusion: Separate, private notes of a mental health professional documenting or analyzing a counseling session.
• Legal Proceedings Exception: Information compiled in reasonable anticipation of, or for use in, legal proceedings.
• Non-decision records: Administrative data, quality assurance or peer-review files, and business planning documents not used to make decisions about you.
• Other specifically restricted materials: For example, certain laboratory quality control records or data sets not part of the Designated Record Set.

Requesting Lupus Treatment Records

Use a clear, written request that names the records you want and how you want to receive them. Referencing your “Individual Right of Access to my Designated Record Set” helps route your request correctly.

1. Identify the holder of your PHI: rheumatology and nephrology clinics, hospitals, labs, imaging centers, and your health plan (all are covered entities).
2. Describe the scope: specify dates, providers, and types of lupus records (notes, labs, imaging, medication history, infusion records, billing).
3. Choose form and delivery: request secure portal download, encrypted email, mail, or pickup; ask for a single, complete electronic file when possible.
4. Third-party directive: if you want records sent to a care coordinator or another provider, include a signed instruction naming the recipient and destination.
5. Verify identity: be prepared to show ID as requested; you should not face unreasonable barriers.
6. Discuss fees and timing: request a cost estimate and confirm expected delivery dates before paying.
7. Track and escalate as needed: if timelines slip, follow up with the privacy office; you may receive partial fulfillment while excluded items are withheld.

Amendment of Medical Records

If you find errors or omissions—such as an outdated diagnosis, missing infusion dates, or incorrect medication allergies—you may request a Medical Record Amendment. This right applies to PHI in the Designated Record Set and triggers specific Covered Entities Obligations.

• How to request: submit a written amendment that identifies the entry, explains why it is inaccurate or incomplete, and provides supporting documentation if available.
• If accepted: the provider appends the amendment (they do not delete the original) and makes reasonable efforts to inform others who rely on the information; you may list specific recipients.
• If denied: common reasons include the record was not created by the provider, is not part of the Designated Record Set, is accurate and complete, or falls under the Psychotherapy Notes Exclusion or Legal Proceedings Exception.
• Your rebuttal rights: you may submit a “statement of disagreement,” and the provider may write a brief response; future disclosures include your statement or a summary.

Timelines and Extensions

HIPAA sets firm deadlines for both access and amendments so you can coordinate care and keep lupus management on track.

• Access requests: providers must act within 30 calendar days. If they need more time, they may take one 30-day extension with written notice explaining the delay and a new completion date.
• Third-party directives: the same 30-day timeline applies to sending your records to a person or organization you designate.
• Amendment requests: providers must respond within 60 days, with a one-time 30-day written extension allowed.
• Form and format: even with extensions, you retain the right to receive records in the requested readily producible format.

Sharing Information Under HIPAA

HIPAA allows certain uses and disclosures of PHI without your authorization to keep care moving while safeguarding privacy. For lupus, this often supports coordination among specialists, infusion centers, labs, and specialty pharmacies.

• Treatment, payment, and healthcare operations (TPO): providers can share information for your care, billing, and operational needs. The minimum necessary standard applies to payment and operations, but not to treatment.
• Required or permitted by law: public health reporting, health oversight, certain law enforcement or judicial disclosures, organ procurement, workers’ compensation, and to avert a serious threat.
• People involved in your care: with your agreement or when you do not object, limited information may be shared with family or friends assisting you.
• Research: allowed with your authorization or under an approved waiver with safeguards.

Outside these categories, a Protected Health Information Disclosure generally requires your written permission.

Patient Authorization Requirements

Your written authorization is required for many non-routine disclosures, including marketing communications, sale of PHI, most disclosures to employers or life insurers, sharing psychotherapy notes (with narrow exceptions), and many research uses when a waiver is not in place.

What a valid authorization includes

• Description of the information to be used or disclosed and its purpose.
• Who may disclose the information and who may receive it.
• Expiration date or event (for example, “end of treatment episode”).
• Your signature and date, plus a statement of your right to revoke in writing.
• A notice that disclosed information may be re-disclosed by the recipient and may no longer be protected by HIPAA.
• Whether treatment, payment, or plan enrollment is conditioned on signing (usually it is not, except in limited situations).

You may revoke an authorization at any time for future uses or disclosures. Revocation does not undo disclosures already made in reliance on your prior authorization.

FAQs.

How can I request access to my lupus treatment records?

Send a written request to each provider or health plan stating that you are exercising your Individual Right of Access to your Designated Record Set. Specify dates, types of records, preferred electronic format, and where to send them (to you or a named third party). Ask for a cost estimate and confirm the 30-day timeline up front.

What information is excluded from HIPAA access rights?

The access right does not include psychotherapy process notes (Psychotherapy Notes Exclusion), information compiled for legal proceedings (Legal Proceedings Exception), or files not used to make decisions about you (for example, certain quality assurance or business planning documents). Providers may still share a summary when appropriate, but they are not required to release excluded items.

How long do providers have to respond to record requests?

Providers must act within 30 calendar days. If they cannot meet that deadline, they may take one additional 30-day extension by sending you a written notice explaining the reason and giving a new completion date. The same timing applies when you direct records to a third party.

Can I request corrections to my medical records?

Yes. Submit a written Medical Record Amendment request that identifies the entry, explains what is wrong, and provides supporting information. The provider must respond within 60 days (with one 30-day extension allowed). If they deny the request, you can file a statement of disagreement that travels with future disclosures of the disputed entry.