Your Choices
Opting Out of NC HealthConnex
The N.C. General Assembly has created a way for patients to prevent information submitted to NC HealthConnex from being shared between participating health care providers, called “Opt Out.” If a patient submits an opt-out form to the NC HIEA, access to any information related to that patient maintained in the NC HealthConnex system will be blocked to health care providers who attempt to look up that patient.
Please be aware:
- Opting out of NC HealthConnex will not adversely affect your treatment by your physician, and you cannot be discriminated against if you do decide to opt out.
- If you change your mind about participating in NC HealthConnex, you can opt back in at any time by completing a new form and checking “Rescind opt-out.”
- If you choose to opt out, please complete the opt-out form linked below. Your provider may also be able to provide a form to you.
Please note that submitting an opt-out form does not mean that your data will not be submitted by your health care providers to NC HealthConnex. Providers who receive Medicaid or state funds for the provision of health care services are required by law to send data pertaining to health care services that are funded by the state, including through Medicaid and the State Health Plan. If your health care services are not paid for by the state, and you do not want your data to be disclosed to NC HealthConnex, you may be able to request that your provider restrict submission of your data. Please discuss this with your providers and refer to their policies on restricting disclosures of patient data for treatment, payment and health care operations as permitted under HIPAA in 45 C.F.R. 164.522(e)(3)(i).
If you are under the age of 18, please note the NC HIEA will not process your opt-out request unless your parent or legal guardian has signed your opt-out form, or you have been emancipated. If you are a minor and receive treatment for (i) venereal disease and other reportable diseases, (ii) pregnancy, (iii) abuse of controlled substances or alcohol and (iv) emotional disturbance, the NC HIEA permits providers to not submit data pertaining to those treatments to NC HealthConnex. Please speak with your health care provider to see if you are able to request that this information not be disclosed to NC HealthConnex. See N.C.G.S. 90-21.5 (Minor's consent sufficient for certain medical health services) and 145 C.F.R. §164.502 of HIPAA. It is important to note that providers themselves are required to not disclose this information to a parent or legal guardian unless medically necessary.
If you choose to opt out, please complete the opt-out form linked below. Your provider may also be able to provide a form to you.
Complete the form, and mail it to:
N.C. Health Information Exchange Authority
Mail Service Center 4101
Raleigh, NC 27699-4101
Other Choices
HIPAA requires that health care providers keep a record of all disclosures of your health information to other parties and provide this record to you for the past six years, with some exceptions. For instance, if your physician discloses your health information to another provider through the HIE network for treatment, payment or health care operations, your physician does not need to provide a record of those disclosures to you. However, health care providers do need to keep track of disclosures for certain reasons, such as public health, research and law enforcement purposes. Please see HIPAA regulation 45 C.F.R. 164.528 for all of the purposes excluded from the accountings of disclosures requirement.
You can ask your provider directly for an accounting of disclosures of your information, or if you prefer, you can fill out the following form to request a report from the NC HIEA. The NC HIEA will never disclose your protected health information if not permitted to do so by HIPAA. Please note that the NC HIEA is not required to provide a report on disclosures made before March 1, 2016, which is the date the NC HIEA started operating the HIE, or if not required to do so by HIPAA. The NC HIEA will respond to a request within 60 days of receipt or will notify you that the report is delayed and the reasons for the delay.
The North Carolina Health Information Exchange Authority (NC HIEA) is part of the Government Data Analytics Center of the North Carolina Department of Information Technology. Its primary purpose is to facilitate and administer the state’s health information exchange network for the secure electronic transmission of patient health information among health care providers, health plans, and health care clearinghouses. The NC HIEA does not employ any medical providers, administer medical services, address billing matters, or maintain a provider-patient relationship with any individual.
Consistent with its focus on technology, its statutory purpose, and N.C. Gen. Stat. § 90-414.6 (S.L. 2021-26), the NC HIEA cannot fulfill an individual’s requests for a copy of their medical records. Nor can the NC HIEA fulfill an individual’s request for a copy of their medical records when the request is submitted by a personal representative or by a third-party that is not connected to the NC HIEA (such as a mobile health application) that purports to act on behalf of the individual.
How to Request Copies of Your Medical Record from Your Provider
Individuals may seek a copy of their medical records directly from the medical provider or providers with whom they have or have had a relationship. Frequently, medical providers include directions on their website to help patients access or request their records. If an individual’s medical provider is a full participant in the NC HIEA, they can request that their medical provider also provide a copy of electronic health information that is available to them through NC HealthConnex. Learn more about whether your provider or your provider’s practice or organization has executed a full agreement with the NC HIEA here: https://hiea.nc.gov/patients/nc-healthconnex-participant-map.
Additional resources about how to access health records are available online:
- How to Get It - published by the Office of the National Coordinator for Health Information Technology (ONC), which is part of the U.S. Department of Health and Human Services (HHS).
- Your Medical Records - published by the Office of Civil Rights within HHS.
- My Military Health Records - published by the Military Health System.
If you require additional assistance or have questions, please contact the NC HIEA at 919-754-6912 or hiea@nc.gov.
The Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security, and Breach Notification Rules protect the privacy and security of health information and provide individuals with certain rights to their health information. Generally, HIPAA requires certain actors like health plans and most health care providers to provide individuals, upon request, with access to the protected health information (PHI) about them in one or more “designated record sets” maintained by or for the covered entity. This includes the right to inspect or obtain a copy, or both, of the PHI, as well as to direct the covered entity to transmit a copy to a designated person or entity of the individual’s choice.
To learn more about your rights under HIPAA, please review informational materials available from the U.S. Department of Health and Human Services (HHS):
- Your Rights Under HIPAA - published by the Office of Civil Rights (OCR) within HHS.
- HIPAA FAQs for Individuals - published by the OCR.
- Individuals’ Rights under HIPAA to Access Health Information 45 CFR § 164.524 - published by HHS.
- If an individual encounters difficulty while obtaining or accessing a copy of their protected health information, they may elect to submit a complaint to the OCR.
Through the 21st Century Cures Act and related regulations, the federal government has taken steps to improve health care information technology. One goal of this federal action is to improve patient’s ability to access their own electronic medical record. To that end, new rules prohibit certain actors and entities from “information blocking,” that is, engaging in practices that interfere with the access, exchange, or use of electronic health information. An actor may face consequences for breaking the Information Blocking Rule when it knows that its acts or omissions are unreasonable and likely to interfere with appropriate access, exchange, or use of electronic health information, unless the practice is required by law or an exception applies.
To submit an information blocking complaint to the federal government, visit the federal Information Blocking Reporting Portal maintained by the Office of the National Coordinator at the U.S. Department of Health and Human Services.