What Is an Electronic Health Record (EHR) and Who Can See It?

Every time you see a doctor, get a lab test or fill a prescription, something gets added to a record you’ve probably never seen in full. That record follows you from visit to visit, and pieces of it flow to specialists, labs, pharmacies and insurers.

So what exactly is an electronic health record, who gets to look at it, and what can you do if something in it is wrong? Here’s a plain-English guide to your chart, your rights and the tools you can use to keep an eye on both.

What an electronic health record is

The federal Office of the National Coordinator for Health IT (ONC) describes an EHR as a digital version of a patient’s paper chart: a comprehensive, long-term record of your health history that authorized providers can access. The key word is longitudinal. An EHR is meant to build up over years and, ideally, travel with you between care settings.

You’ll also hear a few related terms:

ONC notes that many people use EMR and EHR interchangeably, and in everyday conversation that’s fine. The important point is that there isn’t one master record. Your hospital, your primary care practice and your dermatologist may each keep their own EHR about you, on different software from vendors such as Epic, Oracle Health or athenahealth.

What’s in your chart

A typical EHR holds far more than visit notes. Expect to find:

• Demographics: name, birth date, address, emergency contacts and insurance details
• Problem list: current and past diagnoses
• Medications: current prescriptions, past prescriptions and doses
• Allergies and reactions
• Immunizations
• Vital signs: blood pressure, weight, height, heart rate
• Lab and imaging results, plus imaging reports
• Clinical notes: visit notes, specialist consults, hospital discharge summaries
• Orders and referrals
• Billing and coding data: the diagnosis and procedure codes sent to your insurer
• Messages: many portal messages become part of the record

Some information is kept with extra protection, such as a therapist’s separate psychotherapy notes, and some substance use disorder treatment records fall under stricter federal rules.

Key takeaway: Your EHR is not one file. It’s many records held by every organization that has treated or billed you, and each one can be shared under specific rules.

Who can see your EHR

The HIPAA Privacy Rule, enforced by the US Department of Health and Human Services (HHS), controls how doctors, hospitals, health plans and their contractors use and share your information. Here’s who typically has access and why.

Your care team

Doctors, nurses, therapists and other clinicians treating you can access your record. HIPAA allows providers to share information with each other for treatment without your written authorization, including referrals and consultations. That’s what lets an emergency department see your medication list.

Billing staff and your health plan

Billing teams use your record to code visits, and your insurer receives diagnoses and procedure codes to process claims. HIPAA permits sharing for payment.

Operations staff and contractors

Quality reviewers, compliance teams, auditors and contractors (called business associates, such as an EHR vendor or billing company) may access data to run the organization. For many of these uses, HIPAA’s “minimum necessary” standard requires organizations to limit access to what’s needed for the job.

Public health and legal requirements

Providers may report certain information to public health agencies, such as specific infectious diseases, and may disclose information when required by law, such as a valid court order.

Family and caregivers

Providers may share relevant information with family members involved in your care unless you object. For full access, such as a caregiver logging into your portal, you’d typically grant proxy access or a family member would need legal authority. Our guide to patient portal proxy access covers this.

Who generally can’t see it without your permission

Your employer, a life insurance company, marketers and most consumer apps generally need your written authorization to get your records from a HIPAA-covered provider. One caveat: once you send records to an app you chose yourself, HIPAA usually no longer protects that copy. Read more in our guide to whether your health app is covered by HIPAA.

How EHR systems control and track access

Under HIPAA’s Security Rule, organizations that hold electronic health information must put safeguards in place, including access controls and audit controls that record activity in systems containing health data. In practice:

• Staff log in with unique credentials, and access is usually based on role.
• Every view, edit and print is typically logged in an audit trail.
• Hospitals often monitor for “snooping,” such as staff opening records of coworkers, neighbors or celebrities without a work reason.

If you suspect someone accessed your chart without a reason, contact the organization’s privacy officer and ask them to review access. If you’ve been notified of a data breach, see our step-by-step breach checklist.

Your rights over your EHR

HIPAA gives you several specific rights. These are the 4 most useful.

A note on the accounting of disclosures: it excludes routine disclosures for treatment, payment and health care operations, and disclosures you authorized. It’s most useful for spotting unusual releases, such as to a lawyer, a government agency or a researcher.

The 21st Century Cures Act added more. Its information blocking rules, which have applied to health care providers since April 5, 2021, prohibit practices that unreasonably interfere with access to electronic health information. That’s a big reason many test results and notes now appear in your patient portal soon after they’re finalized, sometimes before your doctor has reviewed them with you.

How to request a correction

Errors in a chart are more common than people think: an old medication that was stopped, an allergy you don’t have, a diagnosis recorded in the wrong place. These can matter for future care and insurance.

1. Get a copy of the record so you can point to the exact entry. Our guide to getting copies of your medical records online explains how.
2. Ask about the process. Many providers require amendment requests in writing; they must tell you this in advance.
3. Write a clear request. Identify the entry, date and what’s wrong, and include supporting documents if you have them.
4. Wait for the response. The provider has 60 days to act, with one possible 30-day extension.
5. If approved, the provider must update the record and make reasonable efforts to inform people you identify who received the incorrect information.
6. If denied, the provider must explain why in writing. You can submit a statement of disagreement, which gets attached to the disputed record.

A provider can deny an amendment if, for example, the information is accurate and complete, or if they didn’t create it. In that case, take the request to the provider that did.

Where to start

You can learn a lot about your own EHR in under an hour:

1. Log in to each patient portal you use and review your problem list, medications and allergies.
2. Download a summary record from each, or add them to your phone; see our guide to adding records to Apple Health or Android.
3. Flag anything wrong to the provider in writing.
4. Read the Notice of Privacy Practices from your main providers. It explains how they use your data and who to contact.
5. If anything looks off, ask the privacy officer about access logs or request an accounting of disclosures.

If you run a practice rather than visit one, our guides on choosing an EHR for a small practice and HIPAA compliance for software cover the other side.

The bottom line

Your electronic health record is the running story of your health, kept by every organization that treats or bills you. HIPAA limits who can see it and why, and it gives you strong rights to read it, get copies, see certain disclosures and fix mistakes. Check your chart at least once a year, especially your medication and allergy lists, because the people treating you rely on it.

This is general information, not legal or medical advice.

Sources

• ONC: Benefits of EHRs — definition of an EHR and how it differs from an EMR
• HHS: Summary of the HIPAA Privacy Rule — permitted uses for treatment, payment and operations; minimum necessary
• eCFR: 45 CFR 164.526, Amendment of protected health information — amendment timelines, denials and statements of disagreement
• eCFR: 45 CFR 164.528, Accounting of disclosures — 6-year look-back, exceptions, timing and fees
• HHS: Individuals’ right under HIPAA to access their health information — right of access and 30-day timeline
• ASTP/ONC: Information blocking applicability dates — April 5, 2021 start date