Patients have the right to view and obtain copies of their medical records with only a few exceptions.

An authorization generally applies when an organization wishes to use or disclose a patient’s protected health information for a purpose other than treatment, payment, or healthcare operations, or for legally required purposes. In this case, a patient must sign a HIPAA-compliant authorization form that specifically grants permission to the organization.