Take your health record with you, or remove it, whenever you choose

Your copy and the clinic's record

The clinic's medical record documents the care it gave and the decisions it took, and the law expects it to stay accurate and complete. Your personal health record is the copy you keep, gathered from your clinics and your devices, and you decide who sees it and when it goes.

Getting a copy and moving it

In the UK, the right to data portability lets a person receive personal data they provided to an organisation in a structured, commonly used and machine-readable format, and ask for it to be sent directly to another organisation.² It applies where processing rests on consent or a contract and is carried out by automated means, and the organisation must respond within one month.² Where no sector format is in common use, the ICO points to open formats such as CSV, XML and JSON.²

In the US, HIPAA gives a right to inspect and obtain a copy of health information held in a designated record set, with narrow exceptions such as psychotherapy notes.⁴ The covered entity must act within 30 days, and may extend once by no more than 30 days with a written reason.⁴

With a personal health record, you hold the account and export it yourself at any time.

What the right to erasure covers

UK GDPR gives a right to have personal data erased, which is not absolute and must be answered within one month.¹ It applies, for example, when data is no longer needed for its original purpose or when consent was the lawful basis and has been withdrawn.¹

The right does not apply to special category data processed for medical diagnosis or the provision of health or social care under the responsibility of a professional bound by professional secrecy, and it does not apply where the law requires the processing.¹

HIPAA gives a right to ask for an amendment, which the covered entity must act on within 60 days, and it may refuse if the record is accurate and complete.⁵

What your clinic keeps by law

In England, CQC Regulation 17 requires registered providers to maintain securely an accurate, complete and contemporaneous record for each person, including the care given and the decisions taken.⁷ Deleting your personal copy leaves that record in place.

In the US, HHS states that the HIPAA Privacy Rule sets no medical record retention period, and that state laws generally govern how long records are kept, with safeguards required for as long as they are held, so periods vary by state.⁶

The ICO notes that a record of an earlier diagnosis later found wrong is still an accurate record of treatment, so the usual remedy is an added note with the up-to-date finding.³ Ask your clinic for that note, keep a copy in your own record, and take any question about your health itself to a clinician.

Leaving with a wai Profile

A wai Profile can be exported or removed entirely at any time. Every sharing permission is explicit and revocable, and nothing in it is sold or used to train external models.⁸ Removing a Profile removes your own copy, and the clinics that treated you keep their records under their own rules.

You can open a Profile today at set up your Profile. How a personal record sits beside a clinic portal is covered in personal health records and patient portals.

Where to start

First, decide which record you mean, your own copy or the clinic's. Second, for your own copy, export it before you change anything, and keep the file somewhere safe. Third, for the clinic's record, ask in writing for a copy, name the date range, and note the date you sent it, so the one-month or 30-day clock is clear.

Fourth, if something in a clinic record is wrong, ask for a correction or an added note. Fifth, if you want your own record gone, remove it, keeping the export if you may need it later. How to ask your clinic for a health profile brings future visits into a record you control, so your next results arrive in a record that goes wherever you do.

Frequently asked questions