Pulmonary Function Test Records: Your Privacy Rights, HIPAA Rules, and Who Can See Your Results

Understanding HIPAA Privacy Protections

What counts as Protected Health Information

Your pulmonary function test records are Protected Health Information because they identify you and relate to your health status, care, or payment. Spirometry traces, diffusion capacity values, clinician interpretations, and billing details all qualify as PHI when they can be tied to you.

Who must follow HIPAA

HIPAA applies to Covered Entities—health plans, most health care providers, and clearinghouses—and their Business Associates that handle PHI on their behalf. These organizations must safeguard your pulmonary function test records and limit use and disclosure to what is permitted or required by law.

Core privacy principles

• Minimum necessary: staff should access only what they need to do their jobs.
• Individual rights: you can access, get copies, and request corrections to information used to make decisions about you.
• Accountability: entities must track certain disclosures and provide an Accounting of Disclosures on request.

Accessing Pulmonary Function Test Records

How to make a request

You can request your pulmonary function test records from the provider or facility that performed or maintains them, such as a hospital, pulmonary lab, or your clinician’s office. Ask for records from the “designated record set,” which includes medical and billing records used to make decisions about you.

Timelines, formats, and fees

• Timeframe: the entity must act on your request within 30 days, with one 30‑day extension if they provide written reasons and a new date.
• Format: you can receive paper or electronic copies in the format you request if readily producible; otherwise, in a mutually agreeable form.
• Third‑party delivery: you may direct the entity to send your records to a designated person or organization in writing.
• Fees: only reasonable, cost‑based fees for labor, supplies, and postage are allowed. Access cannot be denied because of unpaid bills for care.

Direct access from laboratories

Under the Clinical Laboratory Improvement Amendments, most clinical laboratories can release your test reports directly to you. If your pulmonary function testing was performed by a CLIA‑certified lab, you may request the report from that lab in addition to your clinician.

Right to Request Corrections

What you may ask to amend

If you believe your pulmonary function test records are inaccurate or incomplete, you may request an amendment to any information a Covered Entity maintains and uses to make decisions about you, including test summaries and interpretations.

How decisions are made

• Timing: the entity must respond within 60 days, with one 30‑day extension if they explain the delay in writing.
• If accepted: the amendment is added to your record, and the entity must inform you and, when relevant, share the amendment with others who rely on the information.
• If denied: you receive a written denial stating the reason (for example, the record is accurate as is or was not created by that entity).

If your request is denied

You may submit a written statement of disagreement. The entity can write a rebuttal, but your statement must be linked to the disputed record, and future disclosures must include the amendment or your disagreement.

Accounting of Disclosures

What an accounting includes

You may request an Accounting of Disclosures for certain releases of your pulmonary function test records over the past six years. The list shows when PHI was disclosed, to whom, what was shared, and why.

Disclosures you will not see listed

• Uses for treatment, payment, and health care operations within Covered Entities.
• Disclosures made to you or based on your valid Patient Authorization.
• Incidental disclosures and certain national security or correctional disclosures as permitted by law.

How to request an accounting

• Submit a written request to the provider or facility’s privacy office.
• Timing: you should receive the accounting within 60 days, with one 30‑day extension if needed.
• Costs: the first accounting in any 12‑month period is typically free; reasonable fees may apply for additional requests.

Authorized Access to Records

Who may see your results without additional permission

• Your treating providers and their workforce for treatment, payment, and operations.
• Health plans for coverage and payment purposes.
• Business Associates that support these activities under written safeguards.
• Personal Representatives, such as a court‑appointed guardian or an executor for a deceased patient, subject to limits under state and federal law.

When Patient Authorization is required

For uses or disclosures outside HIPAA’s permitted purposes—such as many marketing activities or sharing with non‑involved third parties—the entity must obtain your written Patient Authorization, which you may revoke prospectively.

Family, caregivers, and special cases

Providers may share relevant information with family or caregivers involved in your care if you agree or do not object. Employers generally cannot obtain PHI from a Covered Entity without your authorization. Minors and sensitive services may have additional state‑specific rules that affect who can access pulmonary function test records.

Limitations on Access

Denials without a right to review

• Psychotherapy notes and information compiled for legal proceedings.
• Records not part of the designated record set (for example, quality improvement files or raw training materials).

Denials with a right to review

• A licensed professional determines that access is reasonably likely to endanger life or physical safety of you or another person.
• Access would cause substantial harm to another person referenced in the record.
• A personal representative’s access could endanger the individual, such as in certain abuse or neglect situations.

Temporary Access Suspension

During a research study, access may be temporarily suspended if you agreed to the suspension in your research consent. Access must be restored when the study ends or the suspension period stated in your consent expires.

Privacy in Clinical Trials

Authorizations and waivers

Research teams typically rely on your research authorization to use or disclose pulmonary function test records for the study. An Institutional Review Board or Privacy Board may approve a waiver or alteration of authorization when specific criteria are met, such as minimal privacy risk and impracticability of obtaining authorization.

Data minimization and sharing

Studies often use de‑identified data or a limited data set under a data use agreement to reduce privacy risk. Sponsors and monitors may review identifiable data only as necessary for research integrity, safety, or regulatory obligations.

After the trial

When a Temporary Access Suspension ends, you regain your right to access records in the designated record set, including pulmonary function test results created during the trial, consistent with HIPAA and any applicable state laws.

FAQs.

What rights do I have regarding my pulmonary function test records under HIPAA?

You have the right to access, inspect, and obtain copies within 30 days (with one 30‑day extension if needed), to request corrections to inaccurate or incomplete information, and to receive an Accounting of Disclosures for certain releases over the prior six years.

Who can legally access my pulmonary function test results?

Your treating providers and health plans may access them for treatment, payment, and operations. Business Associates may access them under safeguards. Personal Representatives may access them as allowed by law. Others generally need your written Patient Authorization unless a specific HIPAA permission or requirement applies.

How can I request corrections to my pulmonary function test records?

Send a written amendment request to the provider or facility that maintains the records, explaining what is incorrect or incomplete and why. They must respond within 60 days (with one 30‑day extension). If accepted, the amendment is added and shared as appropriate; if denied, you can submit a statement of disagreement.

When can access to my pulmonary function test records be denied?

Access can be denied for items outside the designated record set, psychotherapy notes, or legal‑proceeding materials. Denials with review may occur if release is likely to endanger someone or substantially harm another person referenced. Access may also be paused during a research study if you agreed to a Temporary Access Suspension.