Physical Rehabilitation Records Privacy: What HIPAA Covers, Your Rights, and Who Can See Your Info

HIPAA Privacy Rule Overview

What the Privacy Rule does

The HIPAA Privacy Rule sets national standards for how health information is used and disclosed. It protects your physical rehabilitation records and other Protected Health Information while allowing necessary sharing for care, payment, and operations.

What counts as Protected Health Information in rehabilitation

Protected Health Information (PHI) includes any data that identifies you and relates to your rehabilitation: evaluations, treatment plans, progress notes, therapy goals, home exercise instructions, functional assessments, billing details, and scheduling data. PHI is protected in any format—paper, electronic, images, and spoken communications.

Who is covered

Covered Entities include rehabilitation providers (such as physical, occupational, and speech therapy clinics), health plans, and healthcare clearinghouses. Business associates—vendors like billing companies, transcription services, and cloud EHR providers—must also protect PHI through contracts and safeguards.

Permitted uses and disclosures

Without your written permission, PHI may be used or disclosed for treatment, payment, and healthcare operations. Other permitted disclosures include those required by law, public health reporting, certain law enforcement and judicial requests, and averting serious threats. The “minimum necessary” standard limits non-treatment uses to the least PHI needed to accomplish the task.

Electronic Health Transactions and HIPAA applicability

Most providers fall under HIPAA when they conduct Electronic Health Transactions, such as submitting claims, checking eligibility, or obtaining prior authorizations electronically. If your therapist bills insurers or exchanges eligibility or claim status data electronically, HIPAA’s Privacy Rule applies to your records.

Rights to Access Physical Rehabilitation Records

Your right of Medical Record Access

You have the right to inspect or get copies of your rehabilitation records maintained in a provider’s designated record set. This typically includes clinical and billing records used to make decisions about you, such as evaluations, daily notes, outcome measures, and discharge summaries.

Formats and delivery options

You may receive records on paper or electronically. If the records are kept electronically, you can request an electronic copy in a readily producible format (for example, PDF via portal, secure email, or encrypted media). You can also direct the provider to send a copy to a third party of your choice when your request clearly identifies the recipient and destination.

Timelines and fees

Providers must respond to access requests within 30 days and may take one additional 30-day extension with written explanation. Fees must be reasonable and cost-based, limited to labor for copying, supplies, and postage when applicable. Providers cannot charge for searching or retrieving your records.

Other related rights

• Request restrictions: You may ask a provider not to share specific PHI. If you pay in full out of pocket for a service, you can require that information not be disclosed to your health plan for payment or operations related to that service.
• Confidential communications: You can request PHI be sent to a different address or by an alternative means for privacy.
• Amendments and accounting: You may request corrections to your records and ask for an accounting of certain disclosures.

Limits and Exceptions to Access

Psychotherapy Notes Exception

HIPAA excludes psychotherapy notes—separate, private notes by a mental health professional—from the standard right of access. Most physical rehabilitation notes are not psychotherapy notes, so this exception generally does not limit access to typical therapy documentation.

Information compiled for legal proceedings

Materials prepared in anticipation of, or for use in, legal actions are excluded from access. Providers may maintain such files separately from clinical documentation used for your care.

Research-related temporary suspension

If you participate in research that includes treatment and you agreed in writing to suspend access during the study, your access may be temporarily delayed until the research is complete.

Risk of harm or privacy of others

A licensed professional may deny access if releasing the information is reasonably likely to endanger your life or physical safety or that of another person. Access can also be limited to protect the confidentiality of a third party mentioned in the record.

Special situations

• Inmates: Access may be restricted if providing copies would jeopardize health, safety, security, or rehabilitation in a correctional setting.
• Personal representatives: A legal representative typically has the same access rights as the individual, but access can be denied if doing so is not in the individual’s best interest (for example, in cases of domestic violence or abuse).
• Minors: Parents or guardians often act as personal representatives, but state laws and specific services (such as certain reproductive or behavioral health services) can alter access.

Guidelines for Covered Entities

Privacy Rule Compliance essentials

• Maintain and distribute a clear Notice of Privacy Practices explaining uses, disclosures, and patient rights.
• Designate a privacy official, train the workforce, apply sanctions for violations, and maintain complaint processes.
• Execute Business Associate Agreements with vendors that handle PHI, and monitor their performance.
• Apply the minimum necessary standard to non-treatment uses and disclosures and document role-based access.

Authorization for Disclosure

When a use or disclosure is not permitted by HIPAA or other law, obtain a written Authorization for Disclosure. A valid authorization specifies what will be disclosed, to whom, for what purpose, the expiration date or event, and how it may be revoked. Keep copies and track expirations.

Release-of-information workflow

• Verify identity using reasonable methods without creating barriers (for example, no in-person requirement when remote options suffice).
• Clarify scope (date ranges, specific documents) and preferred format; provide a cost estimate when fees apply.
• Fulfill within 30 days or issue a timely written extension with the reason and a new date.
• Document disclosures, apply the minimum necessary rule where appropriate, and log denials and appeal rights.

Quality and documentation practices

• Record legible, decision-useful evaluations, progress notes, and outcome measures that support care, payment, and audits.
• Separate administrative or peer-review materials from the designated record set to avoid over-disclosure.
• Maintain clear amendment and correction procedures with prompt written responses.

Safeguards for Protected Health Information

Administrative safeguards

• Perform risk analyses, implement policies, train staff regularly, and manage incident response and breach notification.
• Define role-based access controls and sanction policies to enforce Privacy Rule Compliance.

Physical safeguards

• Secure workstations and paper files; control facility access; and use locked storage for printed PHI.
• Dispose of PHI securely via shredding or certified media destruction and maintain device and media controls.

Technical safeguards

• Use unique user IDs, strong authentication, and multi-factor access to EHRs.
• Encrypt ePHI in transit and at rest when feasible; apply audit logs, automatic logoff, and patch management.
• Limit data sharing to authorized users and monitor business associate connections.

Practical tips for patients

• Use secure patient portals when offered and enable multifactor authentication.
• When requesting email delivery, ask for encryption; if you prefer unencrypted email, acknowledge the risks.
• Review your records for accuracy and request corrections promptly.

Procedures for Requesting and Receiving Records

Step-by-step process

1. Identify the holder of your records (rehab clinic, hospital department, or health plan) and locate its medical records or health information management office.
2. Define the scope: specify dates of service, document types (evaluations, daily notes, discharge summaries), and whether you need billing records.
3. Choose the format: paper, CD/USB, portal download, or secure email; request accessible formats if you have a disability.
4. Submit a written request including your name, DOB, contact info, scope, format, delivery method, and destination if directing to a third party.
5. Verify identity through reasonable steps (for example, driver’s license, portal verification) without unnecessary barriers like notarization unless required by law.
6. Track timelines: expect completion within 30 days; if delayed, the provider must give a written reason and a new date.
7. Review fees: pay only reasonable, cost-based charges for copying and delivery; ask for an estimate up front.
8. Receive and review your records; if something is missing or incorrect, request an amendment and keep copies of your correspondence.
9. Escalate if needed: use the provider’s complaint process first. If unresolved, you may file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.

Key takeaways

• Your physical rehabilitation records are PHI protected by HIPAA, with broad access rights and clear timelines.
• Covered Entities may use PHI for treatment, payment, and operations, but most other sharing requires your Authorization for Disclosure.
• Access can be limited in defined circumstances, including the Psychotherapy Notes Exception, legal proceedings, and specific safety risks.
• Strong administrative, physical, and technical safeguards help keep your information secure throughout its life cycle.

FAQs.

What types of physical rehabilitation information are protected under HIPAA?

HIPAA protects any identifiable information related to your rehab care, including evaluations, treatment and progress notes, outcome measures, test results, imaging tied to your therapy, home exercise instructions, schedules, billing records, and communications with your therapist. These protections apply to paper, electronic, and verbal PHI.

How can I request access to my rehabilitation records?

Submit a written request to the provider that holds your records. Specify your identity details, dates of service, documents needed, and preferred format (paper or electronic). You may ask the provider to send the records directly to a third party you designate. The provider must respond within 30 days and may charge only reasonable, cost-based fees for copying and delivery.

Who is allowed to view my physical rehabilitation records?

Your records may be used or disclosed by Covered Entities and their business associates for treatment, payment, and healthcare operations. With your permission or a valid authorization, others may receive your PHI. Certain disclosures can occur without authorization when required by law, for public health, or to prevent serious threats, and providers must apply the minimum necessary standard for non-treatment uses.

Are there any situations where access to my records can be denied?

Yes. Access can be denied for psychotherapy notes, information compiled for legal actions, certain research-related delays, and when a licensed professional determines release would likely endanger life or safety or violate another person’s confidentiality. In correctional settings or specific personal-representative situations, access may also be limited. In many cases, you have the right to a review of the denial.