While it might seem obvious patients should be able to see their own medical information, some states made it difficult for patients to get their records if the medical care providers did not want to comply with a patient's request to see the records. The HIPAA privacy rule makes it clear that patients do have a right to see their records, with certain very limited exceptions for mental health records that might injure the patient. HIPAA also allows the patient to ask that the record be corrected if it contains mistakes. The right to ask for corrections or additions to the records is important because medical records sometimes have mistakes in them which can lead to injuries. make it impossible to get insurance reimbursement for the care, and even make the patient uninsurable. The hospital does not have to change the record if it disagrees, but it must record the patient's compliant.

If the patient is a minor or is legally incompetent, their legal representative or parent has access to their PHI and must also authorize its release on behalf of the patient. State law will control whether the incompetent patient has personal access to their medical records. HIPAA generally follows state law rules on access to records by minors, but there is some confusion as to the HIPAA requirements when the state allows the minor to consent to care but also allows the parent access to the minor's medical records.

Access to the records is subject to the administrative needs of the hospital. This means that you can get a copy, but you cannot walk off with the original because the medical care provider must retain the original records for their own legal obligations. This provision does not provide access to all records about the patient, only those concerning provision of medical care.[65 FR 82554] Many states have laws that prevent patients from getting access to protected hospital quality assurance records and medical staff credentialing records.[ State ex rel. Faith Hosp. v. Enright,706 S.W.2d 852 (Mo. 1986) ] These laws allow hospitals and other medical care institutions to investigate problems with patient care without having the investigations used against them in medical malpractice litigation. This is another example of the trade-off between the rights of individual patients and the rights of society: the individual patient's ability to bring a successful lawsuit is limited so that dangerous practices can be investigated to prevent injuries to other patients.