Medical Records Consent

Medical records are the physical property of the hospital. However, the patient controls the release of the information contained in the record. Authorization to access medical records must be less than one year old. 

Who Can Access My Medical Records?

In general, you must give permission for anyone – other than a member of your health care team – to access to your medical record. By law, your records may be disclosed without your permission under certain circumstances such as for treatment, payment, or operations.

By law, only the adult (age 18 or older) patient or a legally designated representative has the authority to release the information contained in a medical record about them, regardless of who is paying the bills. Legally designated representatives include court-appointed guardians or others with power of attorney for the patient. For children under age 18, only a parent or court-appointed guardian may authorize the release of medical information.

The next of kin or personal representative of the estate may request those records. It may be necessary to verify the patient’s death and the identity of the next of kin.

All Release of Information (ROI) forms can be found on the ROI Forms page.

If you suspect that someone is looking at your medical record without your permission, report this to the privacy officer appointed by your health care provider or URMC’s Office of Integrity and Compliance:

• Call Integrity Hotline: (585) 756-8888
• Submit online report