Health Record Rights Index · United States
The Carters: an American family, four records
Meet the Carters, an American family. Beth, a made-up mother, looks after four health records: her own, her teenage daughter's, her mother's and her husband's. Under US federal rules in force in 2026, she can get a copy of her own within 30 days. For the other three, the rules change from person to person. Pick a person, or scroll to read all four.
A made-up story built from real law and published studies.
Skip to the whole family
Beth
The family health manager
1
Meet the family
Meet Beth Carter. She runs the household. That means four health records: her own, her daughter's (she's 14), her mother's and her husband's. All four live in the US, so their records fall under US law, including HIPAA, the federal health privacy law.
On our US page, a made-up woman named Sam saw one week of care leave pieces of her record in six places. Beth keeps track of four people.
Four people. Different rules for each.
2
Her own record is the easy one
Like Sam, Beth can get a copy of her own record within 30 days, or 60 if the office says in writing why it needs more time.
For everyone else she looks after, the rules change from person to person.
Let's take them one at a time.
The details
The right to a copy is in the federal privacy rule, 45 CFR 164.524, as on the US page. Therapy notes kept apart from the main record are not included.
Sources: 45 CFR 164.524 (eCFR).
Her daughter
Can my parents see my record?
3
Usually yes. But not always.
Beth's daughter is 14. Usually, a parent can see a child's record and speak for her.
But some care a teen can agree to on her own under state law may be kept from the parent.
Which care, and from what age? It depends on your state.
The details
The federal rule, 45 CFR 164.502(g)(3)(i), starts: "If under applicable law a parent, guardian, or other person acting in loco parentis has authority to act on behalf of an individual who is an unemancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative". Then the exception: "such person may not be a personal representative of an unemancipated minor, and the minor has the authority to act as an individual, with respect to protected health information pertaining to a health care service, if: (A) The minor consents to such health care service; no other consent to such health care service is required by law, regardless of whether the consent of another person has also been obtained; and the minor has not requested that such person be treated as the personal representative".
The rule has two more cases: care the teen may get without a parent's consent by law, and care where the parent agreed the doctor and teen could keep it confidential. State law can allow or forbid sharing with parents; if it is silent, a licensed clinician decides. Substance use treatment records have their own federal consent rules (42 CFR Part 2). Our state study is checking questions like these; results will be on the US page.
Sources: 45 CFR 164.502(g)(3), eCFR version September 1, 2026.
4
A parent's portal login can stop at 13
Some health systems change a parent's access to the patient portal in the teen years.
At one large children's hospital, parent accounts shut off when a child turned 13. Parents had to sign up again.
Rules like this can vary from one health system to the next. Ask yours.
The details
Steitz and others, Journal of Adolescent Health, 2026: "This study evaluated how automatic patient portal deactivation at age of 13 years, which requires re-enrollment, influences portal access". That study is about one children's hospital and its clinics.
5
The school nurse's record
Her asthma plan at school is kept by the school nurse.
If her school gets federal education money and the nurse works for the school, those records are usually school records under a school privacy law called FERPA, not HIPAA, the health privacy law.
Same inhaler. Different law.
The details
Joint guidance from the US health and education departments (2019): "a student's health records, including immunization records, maintained by an educational agency or institution (such as by an elementary or secondary school nurse) would generally constitute education records subject to FERPA".
Under FERPA, parents generally have a right to see their child's education records, until the student turns 18. A school clinic run by a hospital or health center may be under HIPAA instead.
Sources: HHS and Department of Education, Joint Guidance on FERPA and HIPAA (2019 update).
Grandma
Grandma gets sick
6
One night in the ER
One night Grandma can't catch her breath, and she goes to the ER. Beth is an hour away, on the phone.
If Grandma can't speak for herself, the ER may tell Beth what she needs to know to help with Grandma's care.
May, not must. It's the staff's call.
The details
The federal rule, 45 CFR 164.510(b)(3): "If the individual is not present, or the opportunity to agree or object ... cannot practicably be provided because of the individual's incapacity or an emergency circumstance, the covered entity may, in the exercise of professional judgment, determine whether the disclosure is in the best interests of the individual and, if so, disclose only the protected health information that is directly relevant to the person's involvement with the individual's care".
So the staff can share what is relevant to Beth's part in Grandma's care. They do not have to.
Sources: 45 CFR 164.510(b)(3), eCFR version September 1, 2026.
7
Talking is not the same as seeing
A phone call is not the same as seeing Grandma's record or using her patient portal.
For that, Beth needs Grandma's written OK, or legal power to make her health choices. Most often that is a health care power of attorney or a guardianship. In some states a close relative has that power by default. State law decides.
The best time to sign these papers is before a crisis.
The details
The federal rule, 45 CFR 164.502(g)(2): "If under applicable law a person has authority to act on behalf of an individual who is an adult or an emancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation".
Grandma can also sign a written permission letting Beth see some or all of her records. Patient portals usually have their own sign-up for a helper, set up portal by portal.
Which papers work depends on your state. Many health care powers of attorney take effect only when the person can no longer decide. For a written OK, ask the provider for its HIPAA authorization form. A provider may also refuse to treat someone as the patient's representative if it believes that would put the patient at risk (164.502(g)(5)).
Sources: 45 CFR 164.502(g)(2), eCFR version September 1, 2026.
8
Her doctors don't always connect
Grandma's heart doctor, the hospital and her home-care nurse may each keep their own record.
After a hospital stay, people often get care somewhere else. In 2023, only 16% of US hospitals said they sent care summaries to most or all of those places.
So a medicine list can fall out of date.
Source: ASTP/ONC Data Brief 71, 2023 hospital survey.
The details
ASTP/ONC Data Brief 71 (2023 survey of US hospitals): "Only 16% of hospitals reported sending summary of care records to most or all long-term/post-acute care providers". Long-term and post-acute care is care after a hospital stay.
Out-of-date medicine lists are a known problem. A 2005 review of 22 studies (Tam and others, CMAJ) found, in the five studies that separated mistakes from deliberate changes: "These studies found that 27%- 54% of patients had at least 1 medication history error" at hospital admission. That can happen; it is not a measure of Grandma's care. The studies are from before most US hospitals used electronic records.
Sources: ASTP/ONC Data Brief 71 (2023 survey, published 2024); Tam VC and others, CMAJ, 2005.
Her husband
He gets hurt at work
9
Lifting boxes
Beth's husband hurts his back lifting boxes at work. An ambulance takes him to the nearest hospital.
A week later, he sees a back specialist at a different health system.
Two hospitals. Two records.
10
Will his records follow him?
Will the second health system get the first one's notes and care summary into its own system? It depends on the two hospitals. Scans travel separately.
In a 2025 survey, 79% of US hospitals said outside records go into their own system without retyping.
About 1 in 5 did not say they do.
Source: ASTP/ONC Quick Stat, AHA hospital survey, 2025.
The details
ASTP/ONC Quick Stat (AHA survey of US non-federal acute care hospitals): 79% integrated outside records in 2025, and "with 76% of hospitals engaging in all four measured interoperability domains" (sending, receiving, finding and adding outside records).
The survey asks whether a hospital does each task at all, not how often or for whom.
Sources: ASTP/ONC Quick Stat, Electronic Health Information Exchange by Hospitals (2025).
11
Who else may see it
He was hurt at work. So his state's law may let records about the injury go to the workers' comp insurer. No one has to ask him first.
Beth, his wife, has no automatic right to see his record.
To see it, she needs his written OK. He can also ask for a copy to be sent to her.
The details
The federal rule, 45 CFR 164.512(l): "A covered entity may disclose protected health information as authorized by and to the extent necessary to comply with laws relating to workers' compensation or other similar programs".
Being his wife does not by itself give her the right to act for him. He can sign a permission form (an authorization). A health care power of attorney often takes effect only if he cannot decide for himself (state law). His providers may share what is relevant to her part in his care, if he is there and does not object (164.510(b)(2)). HIPAA does not cover the workers' comp insurer's own file.
Sources: 45 CFR 164.512(l); 164.502(g)(2); 164.510(b).
The whole family
Everything in one picture
12
Everything Beth juggles
Here is everything Beth juggles, in one picture. Each row is a person. Each column is a place that may hold a piece of their record.
One easy row. Three with paperwork, gaps or a different law.
| Person | Doctor | Hospital | Pharmacy | Health insurer | Patient portal | School nurse | Home care |
|---|---|---|---|---|---|---|---|
| Beth (herself) | Can see | Can see | Can see | Can see | Can see | No record | No record |
| Her daughter, 14 | Usually | Usually | Usually | Usually | Parent may need to sign up again | FERPA: usually | No record |
| Grandma | Papers | Papers | Pick up meds | Papers | Helper login | No record | Papers |
| Her husband | His OK | His OK | Pick up meds | Bills: maybe | His OK | No record | No record |
- Her daughter, 14: Care she can agree to on her own may be private, depending on state law. Bills and benefit statements usually go to the policyholder, unless she asks for them to be sent elsewhere.
- Grandma: In some states a close relative can act for her by default. Staff may tell Beth what she needs to help. A pharmacy may let her pick up Grandma's medicines. Gap: 16% of US hospitals said they sent care summaries to most or all places for care after a stay (2023).
- Her husband: His workers' comp insurer may get injury records without his OK, as state law allows. His health plan may talk with her about his bills. Gap: about 1 in 5 US hospitals did not say outside records go into their system without retyping (2025).
Our summary of the federal rules in general, for this made-up family. Your state, and each provider's own policy, can change the picture. Therapy notes and substance use treatment records have their own rules. Sources: 45 CFR 164.502(g), 164.510(b), 164.512(l), 164.524; FERPA joint guidance; ASTP/ONC Data Brief 71 and Quick Stat; Steitz BD and others, J Adolesc Health, 2026.
13
Which papers does Beth need?
Your turn. Four quick questions. No sign-up. Your answers are not stored.
Then see how 198 countries and territories compare, on our home page.
Your answers stay on this page. We count only that the quiz was started and finished, and which result it gave, never your answers. Sharing sends one line about the law, never your answers.
14
So, is it easy?
Beth looks after four records. For the other three people, she needs papers, a separate login for each portal, a staff member's OK, or an answer that depends on her state. And their doctors' systems don't always connect.
In a national survey, 76% of US hospitals said they did all four kinds of record sharing it measures in 2025, up from 70% in 2023.
Sharing is getting better. The gaps are still real.
Source: ASTP/ONC Quick Stat, AHA hospital survey, 2023 and 2025.
- Students: follow one score back to its source.
- Researchers: the data (DOI) · the paper (DOI) · the paper on SSRN · the code
- Reporters: the press kit, or press@supertruth.ai
- Everyone: tell us what we got wrong · see every change we have made
- Compare countries: see how 198 countries and territories compare · the United States in depth
The details
The 76% and 70% come from the ASTP/ONC Quick Stat series (all four domains: 70% in 2023, 76% in 2025).
SuperTruth, which made this index, sells health data verification products. See the paper's disclosures.
Sources: ASTP/ONC Quick Stat (2025).