Your Patient Rights | HIPAA, Informed Consent & Healthcare Rights

Medically reviewed by Sarah Henriksen, RN, MSN
Health Education Editor · Last reviewed January 2025

Patients in the United States have meaningful legal rights that govern how their healthcare information is handled, how treatment decisions are made, and how they can seek recourse when rights are violated. Understanding these rights empowers patients to be active, informed participants in their own care.

HIPAA Privacy Rights

The Health Insurance Portability and Accountability Act (HIPAA) establishes federal standards for the protection of health information. Key patient rights under HIPAA include:

Right to access your health records — You have the right to inspect and obtain a copy of your medical records. Providers must respond to requests within 30 days. Fees for copying are limited.
Right to request corrections — You can request that your provider correct inaccurate or incomplete information in your records.
Right to an accounting of disclosures — You can request a list of who has received your health information.
Right to request restrictions — You can request limits on how your information is used or shared, though providers are not always required to agree.
Right to confidential communications — You can request that communications about your care be sent to specific addresses or by specific means.

Informed Consent

Informed consent is the ethical and legal requirement that providers obtain your voluntary agreement to treatment after explaining the proposed intervention, its risks and benefits, available alternatives, and the consequences of refusing treatment — in language you can understand. Informed consent applies to procedures, surgeries, and in some circumstances to medication prescribing. You have the right to refuse any treatment, and your refusal must be respected even if the provider disagrees with your decision.

Behavioral Health Privacy — Extra Protections

Mental health and substance use treatment records receive additional privacy protections beyond standard HIPAA. 42 CFR Part 2 (Part 2) provides heightened confidentiality for substance use disorder treatment records at programs receiving federal funding — these records generally cannot be disclosed without patient consent, with limited exceptions. Some states provide additional protections for mental health records beyond federal law.

Filing a Complaint

If you believe your HIPAA rights have been violated, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights at ocrportal.hhs.gov. State medical boards accept complaints about provider conduct. The Joint Commission accepts patient complaints about accredited healthcare organizations. Patient advocates — available through hospitals and some community organizations — can help navigate complaint processes.