To correct errors in your medical records, submit a written amendment request to your healthcare provider under the HIPAA Privacy Rule. The provider has 60 days to either make the correction or send you a written denial explaining why. If they refuse, you have the right to file a statement of disagreement that stays attached to your record, and you can escalate to the federal government if the provider ignored the rules.
A wrong medication, an inaccurate diagnosis, or a billing entry for a procedure you never had can drive bad treatment decisions and denied insurance claims. The process for fixing it is straightforward once you know what providers are required to do and what they’re allowed to refuse.
Your Right to Request a Correction
The HIPAA Privacy Rule gives every patient the right to request amendments to their protected health information. That covers your “designated record set,” meaning the medical records, billing records, and other files a provider or health plan uses to make decisions about your care.1eCFR. 45 CFR 164.501 – Definitions If it’s in the file your doctor reads when treating you or your insurer reads when processing a claim, it’s covered.
The right to request an amendment isn’t the same as the right to have every request granted. A provider can deny the request on four specific grounds:
- They didn’t create the record. Usually the original author is the one who has to fix it, unless that person is no longer available.
- The information isn’t in the designated record set.
- The information is one you wouldn’t have the right to inspect in the first place, such as psychotherapy notes or materials compiled for litigation.
- They believe the entry is already accurate and complete. This is the most common denial and the one most likely to end in a dispute.
Providers also aren’t required to change clinical opinions or professional judgments. If your doctor diagnosed you with a condition and you disagree with the diagnosis, that isn’t what the amendment process is for.2eCFR. 45 CFR 164.526 – Amendment of Protected Health Information But if the record says you were diagnosed with Type 2 diabetes when the lab results clearly show otherwise, that’s a factual error worth pursuing.
Providers cannot charge you a fee to process an amendment request. The regulation contains no fee provision for amendments.
Get a Copy of Your Records First
You can’t fix an error you haven’t seen. HIPAA gives you the right to inspect and obtain a copy of your protected health information, and providers must respond to an access request within 30 days. They can take a single 30-day extension if they give you a written explanation for the delay.3eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information Most providers offer faster access through an online patient portal.
Read through carefully. Vague requests fail, so before you write to the provider, pin down the specific document or entry, the date of service, the name of the provider who authored it, the exact information that’s wrong, and what the record should say instead.
Supporting documentation carries the request. Gather anything that contradicts the incorrect entry: lab results from another facility, pharmacy records showing the actual medication prescribed, a letter from a different physician, imaging reports, or a discharge summary with the correct information. The person reviewing your request should be able to see the error, understand why it’s wrong, and know the fix at a glance.
How to Submit the Amendment Request
Your provider can require that amendment requests be in writing and include a reason supporting the change, as long as they’ve told you those requirements in advance. Most do. Write a formal letter that includes:
- Your full name, date of birth, and medical record number if you have it.
- The specific error and where it appears in your record.
- The correction you’re asking for.
- A reference to the supporting documents you’re attaching.
Keep the tone professional and factual. Emotional language and long narratives about how the error affected you don’t strengthen the request. Stick to what’s wrong, where it is, what it should say, and why your evidence proves it.
Every healthcare organization covered by HIPAA has to designate a privacy official responsible for these matters.4eCFR. 45 CFR 164.530 – Administrative Requirements Call the provider’s office and ask for the privacy officer or the Health Information Management department, and send your request there directly. That keeps it out of a general mailbox for weeks.
Send it certified mail with a return receipt, which gives you proof of delivery and a documented date if the timeline ever comes into dispute. Many providers also accept amendment requests through the secure messaging feature of their patient portal, which creates its own electronic record.5ASTP. Get It, Check It, Use It Keep a complete copy of everything you send.
The 60-Day Timeline and What Approval Looks Like
Your provider has 60 days from the date they receive your request to act on it. They can take a single 30-day extension, but only with a written explanation for the delay and a specific date they’ll respond by. No second extension is allowed.2eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
If the provider accepts the amendment, the original entry stays in the record. The correction is added by appending the new information or linking to it, not by deleting anything. The provider must notify you in writing that the change was made, and they have to make reasonable efforts to send the corrected information to anyone you identify as having received the wrong version, such as other doctors, specialists, or insurers, plus anyone the provider knows has the wrong information and might rely on it to your detriment.2eCFR. 45 CFR 164.526 – Amendment of Protected Health Information Ask for a copy of the amended portion of your record so you can confirm the correction was made properly.
If the Provider Denies Your Request
A denial has to come in writing, in plain language, and it has to explain the specific basis for the refusal. The provider must tell you which of the four permitted grounds they’re relying on and inform you of your right to respond.2eCFR. 45 CFR 164.526 – Amendment of Protected Health Information A vague denial that doesn’t clearly explain the reasoning may itself be a HIPAA violation.
Your first move is a written Statement of Disagreement. This is your chance to explain, in your own words, why the record is wrong and why the denial was unjustified. The provider must keep your statement attached to your medical record and include it, or an accurate summary, with any future release of the disputed information. The provider may write a rebuttal, which also gets attached. The disputed entry doesn’t change, but anyone who reads it also reads your side.
Filing a Complaint With HHS
If the provider violated the amendment rules by ignoring your request, missing the deadline, or issuing a denial without proper written explanation, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights, the federal agency that enforces the HIPAA Privacy Rule. Complaints can be filed electronically through the OCR Complaint Portal on the HHS website.6HHS.gov. Filing a Health Information Privacy Complaint
The critical deadline is 180 days. OCR will generally only act on complaints filed within 180 days of when the violation occurred.7HHS.gov. HIPAA What to Expect If a provider has been stonewalling, don’t wait until you’ve exhausted every informal option. The clock runs whether you know it or not.
Fixing Errors That Spread Beyond Your Provider
A corrected medical record at your doctor’s office doesn’t automatically update anywhere else the bad information already traveled. Insurance companies that underwrite life, disability, and long-term care policies often pull health data from third-party databases rather than directly from providers.
Insurance Underwriting Databases
The Medical Information Bureau (MIB) keeps coded health data that member insurance companies consult during underwriting. If an error was reported to MIB before you got it corrected, your MIB file may still carry the wrong information. Request a copy of your MIB Consumer File. If you find inaccurate entries, notify MIB in writing and explain what’s wrong. MIB forwards the dispute to the insurance company that supplied the data. If the company agrees, the record is corrected. If it stands by the original, you can add a statement of up to 400 words to your MIB file, which travels with your record to any insurer that requests it.
When Errors Come From Identity Theft
Medical identity theft mixes someone else’s conditions, prescriptions, or procedures into your file. That can affect the care you receive, the insurance benefits available to you, and your credit if the thief’s unpaid medical bills end up in collections under your name.8Federal Trade Commission. What To Know About Medical Identity Theft
Warning signs include debt collection calls for medical bills you don’t recognize, unfamiliar entries on your credit report, and explanation-of-benefits statements from your insurer for services you never had. If you suspect medical identity theft, file a police report and send copies to your health plan’s fraud department, your healthcare providers, and the three major credit bureaus. The standard HIPAA amendment process still applies to correcting the fraudulent entries in your medical record, and the police report strengthens your case and triggers additional protections under the Fair Credit Reporting Act for any debt that resulted from the theft. Check your credit reports for medical debt collection notices you don’t recognize and dispute those directly with the credit bureaus as well.