Key points
- Your rights to an accurate record are enforceable, and the law sets the deadlines a clinic must meet.
- In the UK, a clinic must act on a request to correct inaccurate personal data within one month, extendable by two months for complex requests.1
- In the US, a provider must act on a request to amend a record within 60 days, with one extension of up to 30 days, and a refusal must explain how to disagree in writing.2
- US patients can also ask who their record was disclosed to over the past six years, outside routine treatment, payment and operations.4
- In a wai Profile every permission is explicit and revocable, and the data is never sold or used to train external models.5
Summary
You can ask any clinic that holds your health record to correct information that is wrong or incomplete, and it must respond within one month in the UK or 60 days in the US. You can also ask a clinic to limit sharing and to tell you who your record was disclosed to, and you decide which clinicians see a personal health record you control.
Every appointment reads from an accurate record, with your allergies and medicines right and only the clinicians you choose able to see it. UK and US law give you clear routes to correct an entry and control access, with deadlines the clinic must meet.
See it in your clinicThirty minutes on your own patients and doctors.
Request a demoSee how a wai Profile lists every permission you have granted, and how you withdraw one.
| Right | UK, under UK GDPR | US, under HIPAA |
|---|---|---|
| Ask for a correction | Verbally or in writing | May be required in writing, with a reason |
| Deadline to respond | One calendar month | 60 days |
| Extension | Up to two more months for complex requests | One extension of up to 30 days |
| If the clinic refuses | Reasons given, with the right to complain to the ICO | Written denial, statement of disagreement, complaint route |
| Others told of the change | Everyone the data was shared with, and the patient told who if asked | Persons the patient identifies, and others known to rely on the entry |
| Know who saw it | Ask for the recipients of a corrected record | Accounting of disclosures over six years, outside routine care |
The rights you hold over your record
Four rights do most of the work, covering access to your record, correction of mistakes, limits on sharing and a list of who it was shared with. The UK and the US word them differently.
A personal health record you keep yourself adds a practical control, deciding which clinicians can view it and for how long, as set out in our guide to sharing your record with a care team.
Correcting a record in the UK
Article 16 of the UK GDPR gives people the right to have inaccurate personal data corrected, and incomplete data completed, sometimes through a supplementary statement.1 The request can be made verbally or in writing, and the organisation has one calendar month to respond.1 It can extend that by two further months if the request is complex, provided it tells the patient within the first month and explains why.1
ICO guidance says that if a diagnosis is later shown to be wrong, the record should usually show both the first diagnosis and the final findings, because together they are an accurate account of the care given.1 A correction makes the current position clear and keeps the history.
While the clinic checks a disputed fact, the patient can ask for processing of that data to be restricted, and the ICO recommends restricting it as good practice anyway.1 Once a correction is made, the clinic must tell anyone it shared the data with, and tell the patient who they are if asked.1
Amending a record in the US
Under HIPAA, 45 CFR 164.526, a patient can ask a provider to amend information in their record. The provider may ask for the request in writing with a reason, as long as it says so in advance, and must act within 60 days.2 It can take one extension of up to 30 days if it explains the delay in writing.2
A provider can refuse when the information is accurate and complete, or when it did not create the record.2 A refusal must be in writing, give the reason, and explain the patient's right to file a statement of disagreement and how to complain, including to the Secretary of Health and Human Services.2
The provider must append or link your statement of disagreement to the disputed entry, so the next clinician sees your account alongside the original.2
Limiting who sees what
A US patient can ask a provider to restrict how their information is used or disclosed. The provider does not have to agree, with one firm exception. It must agree not to send information to a health plan about a service the patient paid for in full, where the disclosure is for payment or operations.3
Patients can also ask to be contacted at a different address or by a different method, and a provider must accommodate reasonable requests.3 They can ask for an accounting of disclosures over the previous six years, which the provider must supply within 60 days.4 Routine disclosures for treatment, payment and health care operations are excluded from that accounting.4
Permissions in a wai Profile
A wai Profile is the patient's own record. You grant each sharing permission explicitly and can withdraw it, the record can be exported or removed at any time, and the data is not sold or used to train external models.5
Clinical entries, such as a letter or a result, are corrected by the clinic that wrote them, because the author is responsible for the accuracy of its own record. Raise an error with that clinic using the rights above, and visits at a wai clinic sync back to the Profile.5 Profiles are open to everyone at set up your Profile.
Where to start
Ask each clinic you use for a copy of your record and check your name, date of birth, allergies, current medicines and active diagnoses first, since those entries shape the next decision. Take any question about what an entry means for your health to a clinician.
Put any correction in writing, quote the entry, say what is wrong and attach evidence, and note the date so you know when the deadline falls. Then review who can see your record and withdraw anything no longer needed. Our guide to personal health record apps in the UK covers keeping a copy you control.
Keep a copy of your record that you control, with every permission visible and revocable.
Frequently asked questions
Can I have a wrong diagnosis removed from my record?
The record is usually updated and kept. ICO guidance says it should normally show the first diagnosis and the final findings, because together they accurately describe the care given.1
How long does a clinic have to fix a mistake in my record?
What can I do if a US provider refuses to amend my record?
File a written statement of disagreement, which is linked to the entry, and complain to the provider or to the Secretary of Health and Human Services if you think the refusal is wrong.2
Can I stop my health plan seeing a treatment I paid for myself?
In the US, yes. A provider must agree not to disclose information to a health plan about a service you paid for in full, for payment or operations purposes.3
Can I find out who has seen my health record?
Who controls access to my wai Profile?
You do. You grant each permission and can withdraw it whenever you like, and the whole record can be exported or removed.5
Sources
- 1Information Commissioner's OfficeRight to rectificationRead 14 October 2026Read source
- 2Electronic Code of Federal Regulations, 202645 CFR 164.526, Amendment of protected health informationRead 14 October 2026Read source
- 3Electronic Code of Federal Regulations, 202645 CFR 164.522, Rights to request privacy protection for protected health informationRead 14 October 2026Read source
- 4Electronic Code of Federal Regulations, 202645 CFR 164.528, Accounting of disclosures of protected health informationRead 14 October 2026Read source
- 5wai, 2026wai Profiles, a personal health record for every patientRead 14 October 2026Read source
An accurate record, seen by the clinicians you choose.
Set up a wai Profile to keep your results and letters together and decide who sees them.
Partner with us
See it on your own patients, then build it with us
Thirty minutes on your own patients, doctors and rules, in your market. We reply within one working day, and the clinics that partner with us early shape what we build next.
Read how patient memory works in a clinic