According to US Health and Human Services, if my provider keeps an electronic medical record, I have the right to view an electronic copy of my records. However, this guidance is unclear on one thing: If my clinic stores my record in its system as a Clinical Data Architecture file, do I have the right to view my record as a Clinical Data Architecture file? Or can the provider legally refuse such a request as long as they are willing to give me my medical data in a different electronic format - such as a Word document?

2 Answers 2


Under HIPAA, you have the right to

  • Ask to see and get a copy of your health records from most doctors, hospitals, and other health care providers such as pharmacies and
    nursing homes, as well as from your health plan.

  • Get either a paper or, if the records are kept electronically, and electronic copy of your records.

Also, according to 45 CFR 164.524(c)(2)(i),

The Privacy Rule requires a covered entity to provide the individual with access to the PHI in the form and format requested, if readily producible in that form and format, or if not, in a readable hard copy form or other form and format as agreed to by the covered entity and individual.

Therefore, to answer your question, you have the right to recieve an electronic copy of your records in the format you request, "if readily producible in that form and format." Otherwise, you will have to agree upon a format. In your scenario, is seems that the Clinical Data Architecture file is not readily available and producible, so you may have to settle for a Word or PDF doc.

Note: There are limited circumstances when an individual may be denied access to their records. Examples include:

The request is for psychotherapy notes, or information compiled in reasonable anticipation of, or for use in, a legal proceeding.

An inmate requests a copy of her PHI held by a covered entity that is a correctional institution, or health care provider acting under the direction of the institution, and providing the copy would jeopardize the health, safety, security, custody, or rehabilitation of the inmate or other inmates, or the safety of correctional officers, employees, or other person at the institution or responsible for the transporting of the inmate. However, in these cases, an inmate retains the right to inspect her PHI.

The requested PHI is in a designated record set that is part of a research study that includes treatment (e.g., clinical trial) and is still in progress, provided the individual agreed to the temporary suspension of access when consenting to participate in the research. The individual’s right of access is reinstated upon completion of the research.

The requested PHI is in Privacy Act protected records (i.e., certain records under the control of a federal agency, which may be maintained by a federal agency or a contractor to a federal agency), if the denial of access is consistent with the requirements of the Act.

The requested PHI was obtained by someone other than a health care provider (e.g., a family member of the individual) under a promise of confidentiality, and providing access to the information would be reasonably likely to reveal the source of the information.

  • So if the provider uses CDA internally, but the technical staff can't access the file directly, the provider is not required to comply?
    – moonman239
    Commented Mar 9, 2017 at 22:08
  • When you say "provider" do you mean the hospital, or your health insurance company? Same for "technical staff". Ultimately, who are you contacting for your records?
    – Michael
    Commented Mar 9, 2017 at 22:16
  • @MichaelC. In medicine, "provider" refers to a clinical professional responsible for making treatment decisions and dispensing medical advice, etc.; usually a medical doctor (aka physician) but it could also be a nurse practitioner or physician assistant. The term should not be conflated with the facility at which care is provided (eg: sole proprietorship office, clinic, hospital, etc.).
    – Michael
    Commented May 9, 2017 at 17:43

The electronic access requirement is more about portability (ie: not needing to carry/mail/fax/whatever stacks of paper) than it is about convenience or interoperability. That is, the rule is not intended to require providers to give you (or any patient) data that is in a format. From the HHS website:

Where an individual requests an electronic copy of PHI that a covered entity maintains electronically, the covered entity must provide the individual with access to the information in the requested electronic form and format, if it is readily producible in that form and format. When the PHI is not readily producible in the electronic form and format requested, then the covered entity must provide access to an agreed upon alternative readable electronic format. [Emphasis theirs.]

In other words, of the options they have available to them you may select which format (or for simplicity of workflow, they may just put all available formats on the same media). You may request the data in a particular format but in all likelihood, the facility you are requesting from will only have two or three output formats readily available. There is no requirement for them to accomodate requests for formats outside those that are readily producible. Options typically include: PDF, TIFF (ie: just pictures of text), CCD/CCDA/CDA (which is an XML-like structure of data that is moderately useful for import into other systems).

You do not have any right to gain access to the data as it is stored in the proprietary database of their electronic health records system.

I'm not sure if this answers your question completely - please feel free to follow up and/or clarify.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .