Patient Access to Records: The Invisible Confidentiality Right

By Bruce G. Borkosky, Psy.D.
November 5, 2013

Confidentiality has been around since Hippocrates. In contrast, the patient’s right to obtain a copy of records (patient access) is a relatively recent concept. This may be a surprise, but patients have had a legal right to their records for only about 30 years. Prior to the 1970s, patients had no right to access their records. No state or federal statutes required it, and the AMA ethics code advised refusal of access. Some patients had to obtain a court order to gain access.

The APA has been a laggard here. The first mention of access rights occurred in 1992, but only in regard to test data and only as an exception to confidentiality. Psychologists could withhold records, except to patients; but psychologists were permitted to withhold access to patients if they determined the access was “inappropriate.” It wasn’t until the enactment of HIPAA that the ethics code began to address access rights.

Access not required by APA

Although HIPAA mandates access, official APA policy sees things differently. Here is a sampling:
The Forensic Guidelines state that a forensic patient has no right of access.

The Record Keeping Guidelines, the Association of State and Provincial Psychology Boards (ASPPB) Code of Conduct, ASPPB Model Act, Rights and Responsibilities of Test Takers and Guidelines for Test User Qualifications all refer to confidentiality but do not mention access rights.

Although the ethics code requires release of test data with a written release, records can be withheld by institutional policy or legal proceedings, courts and organizational clients. Finally, psychologists are not required to but “may” release records.

Practitioners often refuse access

This position by the APA may be part of the reason that access to records has been – and continues to be – controversial and a topic of heated listserv discussions. Psychologists refuse to release records to patients, third parties, the courts, non-psychologists and attorneys, sometimes enlisting the courts in their efforts (although courts are rarely supportive). Denial of access is a top HIPAA complaint against health care providers. Psychologists are urged to refuse release of test data to non-psychologists.

Access is required by law

This denial of access is surprising, because state and federal laws require access. All states except three (North Carolina, Iowa and Wyoming) have laws requiring access. Further, for the vast majority of psychologists who are regulated by HIPAA, HIPAA preempts any state laws that might limit access.

Finally, patient access is consistent with ethical principles:


The ethics code uses unusual wording for Principle E (normally referred to as autonomy), perhaps to emphasize that respect for autonomy requires more than acquiescence to the patient’s choices – it’s a positive obligation. One should actively enable the patient’s capacity for free choice, including disclosing information to the patient that increases understanding, fosters decision making and nurtures their capacity as a free agent.

Privacy, confidentiality, privilege, informed consent and access comprise these information-based facets of the autonomy right. Patients decide to consent to services, choose to share private information with the psychologist and then they determine whether (and with whom) to release that information to third parties.

Psychologists demonstrate respect for these rights by obtaining written informed consent to treatment and written authorization to release information. Exactly as we demonstrate respect for the patient in handling their information in these ways, we should also respect the patient enough to let them know what information is contained in those records. Further, access is consistent with informed consent – a patient must know what information is going to be released to determine whether to release the records.


A number of scholarly arguments have been offered as reasons to withhold access. Some scholars believe that the patient might be harmed by the information in the records. However, there is little empirical evidence of such harm, and there is evidence of no harm. On the other hand, patients may be harmed when access is refused. Records may contain errors, other professionals may need the records to perform their jobs and the patient may need access in order to make important decisions. When access is delayed or denied, the patient’s health, legal rights and/or freedom may be derogated.

Honesty (integrity)

Honesty refers to comprehensive, accurate and objective transmission of information, including patient understanding. When we withhold information, we convert our relationship with the patient from one of respect to paternalism; we make the patient dependent and vulnerable to a range of future harms. Others may wonder what we have to hide. Conversely, access to records increases openness and transparency and is itself clarifying.


Justice is a broad topic, far too wide-ranging for discussion here. In part, justice refers to fairness, protection of civil liberties, equal treatment, equitable distribution of services and guarding against bias and prejudice. Under various theories of justice, it can be argued that patients’ control over and access to their records, is just.

According to formal justice, equals should be treated equally. When some patients are permitted access to their records but others are not (e.g., clinical vs. forensic), equals are treated disparately and unjustly. Under Libertarian views of justice, patient-control over the distribution of records affirms the patient’s liberty and property rights. Courts have established the patient’s common law property right to the information in their records, so the transfer of this “property” is only just if it is freely chosen by the patient.

In summary, although required by law, psychologists often refuse to release records. Permitting access is the more ethical path, but it’s surprisingly absent from APA ethics and guidelines. Psychologists who believe that refusing to release records is ethical may face (in additional to legal sanctions) a serious ethical dilemma if working for an organization such as the Veterans Administration (using an internet-based patient access system). The APA should clarify this issue in future guidelines.

Note: This article with citations is available at


Bruce Borkosky, Psy.D., is a clinical and forensic psychologist in Sebring, Fla. He is available for consultation in the areas of licensing complaints, ethics, informed consent, records, confidentiality, privilege, access and HIPAA. His website is:
Share Button

Related Articles