Department of Health Memorandum: Access to Patient Information

Patients and other qualified persons have a right to access patient information under Section 18 of the Public Health Law. Section 18 contains the procedures for making records available and the conditions under which a provider can deny access. If access is denied, the patients or other qualified persons are afforded the right of appeal to a Medical Record Access Review Committee (MRARC).

Basic Provisions

Section 18 of the Public Health Law applies to records maintained by health care facilities licensed by the Department of Health. These include hospitals, home care facilities, hospices, health maintenance organizations and shared health facilities. Its provisions also apply to health care practitioners, including physicians, physician assistants, specialist assistants, audiologists, chiropractors, dentists, dental hygienists, midwives, occupational therapists, optometrists, ophthalmic dispensers, physical therapists, physical therapist assistants, nurses, podiatrists, psychologists, social workers and speech pathologists. The law describes such facilities and practitioners as "providers." Health care practitioners not specifically included in this paragraph are not covered by Section 18 but may be covered by a regulation that is under the jurisdiction of the State Education Department (8 NYCRR Section 29.2).

The law permits access by "qualified persons." "Qualified persons" include the patient or an incapacitated adult patient's legal guardian. A parent or legal guardian of a minor may access the minor's records when the parent or guardian consented to the care and treatment described in the record or when the care was provided without consent in an emergency resulting from an accidental injury or the unexpected onset of serious illness. "Qualified persons" also include the executors and administrators of estates of deceased patients, and if there is no will, the distributees of the estate under the Estates, Powers and Trusts Law. An attorney representing a "qualified person" is also a "qualified person," provided that the attorney has a signed power of attorney authorizing the attorney to request medical records. Health care providers, insurance companies, other corporate entities and attorneys lacking a power of attorney are not qualified persons. Although they are not necessarily "qualified persons" under Section 18, health care agents and surrogates with authority to make health care decisions for patients under Public Health Law Articles 29‑C and 29‑CC have a right to receive medical information in order to make those decisions.

Section 18 requires that within 10 days of a written request for access to records, the provider must give the qualified person the opportunity to inspect the records. Providers must also provide copies of records if copies are requested within a reasonable time frame. Providers are permitted to charge reasonable fees to recover costs for inspections, shipping and copying. However, a qualified person cannot be denied access to information solely because of an inability to pay. No charge may be imposed under this section for providing, releasing, or delivering patient information or copies of patient information where requested for the purpose of supporting an application, claim or appeal for any government benefit or program.


The law also states that access to the following records or parts of records may be denied:

  • personal notes and observations maintained by the practitioner;
  • information that was disclosed to the practitioner under the condition that it would be kept confidential and it has been kept confidential since then;
  • information about the treatment of a minor that, in the opinion of the practitioner, should not be disclosed to the parents or guardians (a patient over the age of twelve may be told that his/her parents or guardians have requested the patient's records, and if the patient objects, the provider may deny the request);
  • information that the practitioner determines may reasonably be expected to substantially harm the patient or others;
  • substance abuse program records and clinical records of facilities licensed or operated by the Office of Mental Health (these records may be disclosed pursuant to a separate process in Section 33.16 of the Mental Hygiene Law);
  • information obtained from other examining or treating practitioners which may be requested from the other practitioners directly;
  • when other provisions of law prevent their release. For example, Section 17 of the Public Health Law prohibits the release of records to parents or guardians concerning the treatment of a minor for sexually transmitted disease or for performance of an abortion.

Section 18 requires a provider who denies access to part or all of a record to inform the qualified person which of the above reasons caused the denial.

Mammogram Films

Under Section 18 a qualified person has the right to obtain original mammogram films. The provider may not impose a copy charge for original mammograms, but may charge the actual documented cost for furnishing the films. Once the original films have been provided, the health care provider is no longer required to maintain a copy.

Appeals of Denials to Access to Medical Records and Patient Information

If a provider denies access to part or all of a record, the qualified person has the right to appeal the denial and the law requires the provider to inform the qualified person of that right. A Medical Record Access Review Committee (MRARC) designated by the Commissioner will review appeals.

Providers are required to give qualified persons, at the time of denial, a form approved by the Department. The form advises the qualified person of the right to appeal and the method for initiating an appeal. A copy of this form may be obtained from the Department's Access to Patient Information Coordinator (API Coordinator). Once obtained, providers may copy the form and give it to qualified persons. If providers wish to develop their own form, that form must contain the same information and be approved by the API Coordinator.

The qualified person sends this form to the API Coordinator. Upon receiving a request for appeal, the API Coordinator will inform the provider and chairperson of the MRARC. The provider has 10 days to forward the copies of the records and a brief explanation for the denial to the MRARC chairperson. The MRARC will meet to review the appeal within 90 days of receiving the records.

The MRARC will issue a written decision with copies to the provider and qualified person. The patient records will be returned to the provider. If the MRARC decides that the qualified person should have access to the records, the provider will be directed by the MRARC to grant the access.

Decisions of a MRARC, except for determinations regarding access to practitioners' personal notes and observations, may be challenged in the State courts. MRARC decisions regarding personal notes and observations are final.

The 1Denial of Access to Patient Information and Appeal Form - DOH-1989 is also available here.

Health Care Facilities

Under the law, if a patient requests records from a health care facility, the facility must consult with the "treating practitioner." The "treating practitioner" is the practitioner who has primary responsibility for the care of the patient. He/she must decide whether or not access to the information may be provided. Individual facilities must decide who the "treating practitioner" is for each request. If the requested records include multiple disciplines, the facility may choose to have either a single practitioner who had the primary responsibility for patient care decide the entire matter or have a practitioner in each profession make the determination for that practitioner's portion of the records.

Personal Notes and Observations

Section 18 of the Public Health Law permits providers to deny access to personal notes and observations. The law defines personal notes and observations as "a practitioner's speculations, impressions (other than tentative or actual diagnosis) and reminders, provided such data is maintained by a provider."

It has been suggested that handwritten portions of health care records may all be considered "personal notes and observations" and may be withheld from qualified persons, but this interpretation is overbroad. Consequently, Subpart 50-3 of the Department of Health's Rules and Regulations states "Handwritten notes and observations shall not be presumed to be personal notes and observations."

Information for Providers

Providers should thoroughly read the law and regulations to understand their rights and obligations.

Providers who deny access to part or all of the records are required to inform qualified persons of their right to appeal. An official denial and appeal form or an alternative form approved by the Department of Health's API Coordinator must be given to a qualified person at the time access to records is denied.

Relationship Between Section 18 and Federal Regulations

In some instances where a patient or a patient's personal representative has no right to access health information under state law, a right of access may nevertheless exist under federal law. Health care providers that are required to comply with the federal law known as the Health Insurance Portability and Accountability Act (HIPAA) generally must provide patients with access to all medical records and billing records. Many of the exceptions that exist in state law do not exist in the federal law; the federal law does, however, have an exception for psychotherapy notes.

Any qualified person who may access records on behalf of a patient under State law is a personal representative with a right of access under federal law. Parents have a right of access to their children's medical records under federal law to the same extent that they have that right under state law.

If a right of access exists under federal law, the procedure for exercising that right of access should be written in the provider's Notice of Privacy Practices. The provider should have a reviewing official to make final determinations. New York does not enforce HIPAA. HIPAA is enforced by the Office for Civil Rights in the United States Department of Health & Human Services.

Further Information

Persons seeking further information regarding this process may contact:

API Coordinator
New York State Department of Health – OPMC
150 Broadway, Suite 355
Albany, NY 12204-2719

For Physicians, Osteopaths, Physician Assistants, Specialist Assistants and other Health Care Providers (Chiropractors, Dentists, Nurses, Physical Therapists, Podiatrists, Psychologists, Social Workers, etc.) call:

  • 1-800-663-6114

If you would like information regarding records held by hospitals, direct your initial inquiry to the hospital. For additional information or assistance, call:

  • 1-800-804-5447

If you would like information regarding records held by facilities licensed or operated by the New York State Office of Mental Health, direct your initial written request to the director of the individual facility. For additional information or assistance, call:

  • 1-800-597-8481

If you have questions regarding substance abuse records, direct your initial inquiry to the individual facility. For additional information or assistance, call:

  • Public Information Office
    NYS Office of Alcoholism and Substance Abuse Services
    1450 Western Avenue
    Albany, NY 12203-3526

    1-518-473-3460