From HIPAA to TEFCA: how your health records became yours to request

The legal right to your records is broad, and since late 2023 there is a national network that can deliver them. Getting there took almost 30 years.

It starts in a hospital record room

I was born at Edgewater Hospital on Chicago's Far North Side. The hospital closed in December 2001 after it came to light that it had been defrauding Medicare, and Medicare stopped paying it.¹

The patients' records stayed behind. For more than a decade they sat in the empty building, moldy and water-damaged, with Social Security numbers inside. In May 2014 demolition crews began hauling them out to be shredded, enough to fill at least six truck-size dumpsters.²

That was the hospital acting as custodian of our records. When the custodian failed, the records failed with it.

How the law caught up

Year	What changed	What it meant for you
1996	HIPAA passed	Privacy and security rules for health data
2000 to 2003	HIPAA Privacy Rule	A right to see and get a copy of your records
2009	HITECH Act	Money and pressure to move hospitals onto electronic records
2016	21st Century Cures Act	Blocking access to electronic records became a violation
April 5, 2021	Information blocking rules apply	Providers and vendors must not interfere with your access3
October 6, 2022	Full scope of electronic records	The rules cover all your electronic health information, not just a core data set3
December 12, 2023	TEFCA goes live	A national network of networks, with a purpose built for patients4
January 1, 2027	Payer APIs due	Most insurers must share claims and prior authorization data through standard APIs5

The government is, by spending, close to an insurance company with an army. When it tells the industry to build an API, the industry builds it.

How you can get your records today

1. Patient portals. Still the most common route, one institution at a time.
2. A HIPAA access request. The provider must act within 30 days, with one 30-day extension allowed, and must give you an electronic copy when the records are electronic.⁶
3. Apps using standard APIs (FHIR). The Cures Act rules require certified record systems to let apps you choose pull your data.
4. TEFCA Individual Access Services. One of TEFCA's six exchange purposes lets you request and receive your own records across the network through an app or service you choose, instead of asking each office.⁴

The rules have teeth. Health IT developers and networks found to block information can face penalties of up to $1 million per violation.⁷

The honest caveat

The right is broad and the network exists. But not every record is reachable yet. Identity matching, missing data and slow responses still get in the way.

The system was built for institutions to exchange data about patients. Individual access is the start of a system where patients can command the exchange themselves.

Keep reading: where Libby is going and what changes when all your records are in one place.

Footnotes

1. Gapers Block. The saga of Edgewater Medical Center. February 20, 2014. The December 2001 closing and the Medicare fraud. Gapers Block ↩

2. DNAinfo Chicago. Edgewater Medical Center's old records hauled out of site, will be shredded. May 8, 2014. The moldy, water-damaged records, the Social Security numbers and the six dumpsters. DNAinfo ↩

3. Office of the National Coordinator for Health IT. What are the applicability dates and enforcement dates of the information blocking regulations? HealthIT.gov ↩ ↩²

4. Office of the National Coordinator for Health IT. Data liquidity, affordability and access: the history and growth of TEFCA. The December 12, 2023 go-live, the six exchange purposes and Individual Access Services. HealthIT.gov ↩ ↩²

5. Centers for Medicare & Medicaid Services. CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) fact sheet. CMS ↩

6. 45 CFR 164.524, Access of individuals to protected health information. eCFR ↩

7. HHS Office of Inspector General. Information blocking. HHS-OIG ↩