Is access to healthcare records a problem?

Did you know that HIPAA (the Health Insurance Portability and Accountability Act) not only protects your healthcare records privacy, it also protects your access to your healthcare records in a safe and easy manner? If you did not, you are not alone. Unfortunately, despite having this law in place, some patients encounter significant hurdles when they try to access their healthcare records. Our team of 5 students from Harvard University is working with the Department of Health and Human Services (HHS) to streamline the process of helping patients access their health records. (read more about our project here).

Our first instinct was to try and understand this problem from people who have the most frequent interactions with the healthcare system — patients (especially those who require long term or frequent care), healthcare providers (doctors, hospital administrators, etc.) and patient advocates — to understand their experience with the healthcare records system. However, as we started to talk more amongst ourselves about what healthcare record access meant to us individually, we began to notice that within our group, some of us cared much more than others about having easy access to our healthcare records. We began to recognize that this could be reflective of the broader society, which made us realize that we should talk to people who do not have frequent interactions with the healthcare system; people who rarely thought about having access to their healthcare records.

People We Talked To

To explore the experience of the “average” person, we talked with people who were at South Station, shopping malls and areas around Harvard Square. We also reached out to friends at school and relatives who lived in different states. We ended up talking to many people from different demographics, professional backgrounds and different levels of engagement with the healthcare system, which gave us wide range of viewpoints to think about.

To understand the view point from within the medical community, we talked to legal experts, patient advocates and doctors. Some of the experts we talked to include:

Daniel Sands  MD Co-founder, Society for Participatory Medicine

Daniel Sands MD Co-founder, Society for Participatory Medicine

Regina Holliday,  Patient rights advocate

Regina Holliday, Patient rights advocate

Deven McGraw  Chief Regulatory Officer, Ciitizen

Deven McGraw Chief Regulatory Officer, Ciitizen

Finally, to expand our reach, we leveraged the power of the internet to conduct an online survey that asked people what they thought about their healthcare data. With the help of friends on Twitter, we received over 180 responses in the first two weeks.


After three weeks of talking to people and analysing the online survey results, we’ve gained a lot of unique insights from talking to people with a wide range of different perspectives. Here are 5 key takeaways we had: 

1. There’s a general lack of engagement and understanding surrounding health data.

“UPMC sends so much stuff to be honest. The information is there all of the time. I don’t really know and I don’t have any interest to be frank.” 

For many people we spoke to, especially those who were young and had little pre-existing healthcare conditions, the thought of accessing their healthcare records only crossed their minds when they were asked for it (i.e. when they moved, for school, etc.). These requests tend to be one-off requests. While many acknowledged that the process could be tedious, long-drawn and painful, they usually just went through it once and forgot about it.Many people were not aware what rights they had to access that information. 

2. People are concerned about their data being used for employer and insurance discrimination and identity theft.

“A hospital can get screwed no problem [in regards to losing health data].”

Understandably, many people are worried about having sensitive information leaked and for the world to see. However, beyond the point of keeping personal information and medical records private, many people were much more worried about the downstream implication of that healthcare data leak — would someone be able to use that information to discriminate against them? 

3. There is power in knowing your rights under HIPAA.

“If you can’t see the data, you can’t make choices.” 

When patients don’t know what rights they are entitled to - for example, that they can request their providers email them their healthcare records - they interact with the healthcare system in a very passive manner, accepting whatever restrictions placed upon them with little idea of what a reasonable alternative could be. If patients are aware of the rights they have under HIPAA, they are likely to feel more confident using them to make certain requests when they speak to their doctors. This gives them more agency over their own healthcare. 

4. Health operates on a spectrum.

“I’ve only had like two surgeries in my lifetime. I just kind of rely on the doctors.”

 As we engaged with more healthcare advocates and empowered patients, it became increasingly clear that we all transition along the spectrum between healthy and unhealthy throughout our lives. Most people, in the healthier years of their lives, rarely think about needing access to their healthcare records. However, as they or their loved ones fall ill, or grow older, interacting with the healthcare records system—and learning how to navigate the complexities — becomes increasingly difficult to avoid. 

5. The world is complex and so is the Electronic Health Records (EHR) infrastructure.

“We have a topsy turvy system. No other country has this. No other country has what we are going through.”

The social, cultural and political complexities of our reality are mirrored in the intricacies of our EHR infrastructure. As healthcare providers shift to digitized records, the EHR systems hospitals put in place may not always be connected to one another because of how complicated the whole process is: getting the EHR systems up and running, to transferring piles and piles of medical data from converting physical copies into digital ones, and to ensuring there is sufficient security for data protection.

Some Parting Thoughts 

The one key insight for our team was that health operates on a spectrum.People transition between healthy and unhealthy states throughout their lives, and this affects how they care about many things, including healthcare. Even if they don’t care about healthcare now, it is likely that they eventually will have to. While this is an obvious point, it frames how we need to approach solutions. 

Having this point made clear during our user research made us rethink the ambivalence some of us felt earlier about having easy access to our own healthcare records. It is true; many of us are healthy and young, and we may not see a need to access our healthcare records now. But what happens when we eventually fall ill at some point in time in our lives, and suddenly need all the past medical data that we thought was insignificant? Would we know where, or how, to get them? Would we be able to anticipate the difficulties we might face in getting them, especially under time pressure? 

Thinking along these lines helped us uncover a group of people that overlapped between the two initial groups that we identified — people who were transitioning from being healthy to being sick, and may need to start access and transferring their healthcare records more frequently — and we decided that it might be interesting to follow this thread and think about ways we could help to make this transition easier for them.

Bobby, David, Jen, Manasi, Rridhee