The federal privacy rules for health information - including a right to get a copy of your own records, which is narrower and more practical than the privacy rule people usually mean.
The federal health privacy rules apply to health plans, health care clearinghouses and most health care providers, together with the contractors that handle protected health information for them. They restrict use and disclosure of that information without authorisation, subject to defined exceptions such as treatment, payment and health care operations.
The provision individuals use most is the right of access: a person may inspect and obtain a copy of their own records held in a designated record set, in the form and format requested where the records are readily producible that way, within a defined period and for no more than a cost-based fee. A request may not be conditioned on explaining why the records are wanted.
A point of frequent confusion is that these rules do not give an individual a private lawsuit against a provider for a breach. Enforcement runs through a complaint to the federal regulator, which can impose penalties. That is why a privacy problem is often pursued instead under state law - as negligence, breach of confidence, or under a state health-privacy or data-breach statute - with the federal rule supplying the standard rather than the cause of action.
Records requests that are refused, delayed well past the required period, or answered with a fee that looks unrelated to the cost of copying are worth raising - and getting the complete record is usually the first practical step in any medical claim, well before anyone decides whether there is one. Where information has actually been disclosed improperly, the useful advice is about state-law routes, because the federal statute is enforced by the regulator rather than by the individual.
These directory pages each list at least one currently published law firm. The list is generated when this page loads, so a page whose listings have lapsed drops out rather than becoming a dead link.