Under HIPAA, do I have the legal right to see the electronic records themselves?
<p>According to US Health and Human Services, if my provider keeps an electronic medical record, I have the right to view an electronic copy of my records. However, this guidance is unclear on one thing: If my clinic stores my record in its system as a Clinical Data Architecture file, do I have the right to view my record as a Clinical Data Architecture file? Or can the provider legally refuse such a request as long as they are willing to give me my medical data in a <em>different</em> electronic format - such as a Word document?</p>

<p>Under <a href="https://www.hhs.gov/sites/default/files/righttoaccessmemo.pdf" rel="nofollow noreferrer">HIPAA</a>, you have the right to </p>

<blockquote>
  <ul>
  <li><p>Ask to see and get a copy of your health records from most doctors,    hospitals, and other health care providers such as pharmacies and<br>
  nursing homes, as well as from your health plan. </p></li>
  <li><p>Get either a paper or, if the records are kept electronically, and       electronic copy of your records.</p></li>
  </ul>
</blockquote>

<p>Also, according to <a href="https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/" rel="nofollow noreferrer">45 CFR 164.524(c)(2)(i)</a>, </p>

<blockquote>
  <p>The Privacy Rule requires a covered entity to provide the individual
  with access to the PHI in the form and format requested, if readily
  producible in that form and format, or if not, in a readable hard copy
  form or other form and format as agreed to by the covered entity and
  individual.</p>
</blockquote>

<p>Therefore, to answer your question, you have the right to recieve an electronic copy of your records in the format you request, "if readily producible in that form and format." Otherwise, you will have to agree upon a format. In your scenario, is seems that the Clinical Data Architecture file is not readily available and producible, so you may have to settle for a Word or PDF doc. </p>

<p>Note: There are <a href="https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/" rel="nofollow noreferrer">limited circumstances</a> when an individual may be denied access to their records. Examples include: </p>

<blockquote>
  <p>The request is for psychotherapy notes, or information compiled in
  reasonable anticipation of, or for use in, a legal proceeding.</p>
  
  <p>An inmate requests a copy of her PHI held by a covered entity that is
  a correctional institution, or health care provider acting under the
  direction of the institution, and providing the copy would jeopardize
  the health, safety, security, custody, or rehabilitation of the inmate
  or other inmates, or the safety of correctional officers, employees,
  or other person at the institution or responsible for the transporting
  of the inmate.  However, in these cases, an inmate retains the right
  to inspect her PHI.</p>
  
  <p>The requested PHI is in a designated record set that is part of a
  research study that includes treatment (e.g., clinical trial) and is
  still in progress, provided the individual agreed to the temporary
  suspension of access when consenting to participate in the research. 
  The individual’s right of access is reinstated upon completion of the
  research.</p>
  
  <p>The requested PHI is in Privacy Act protected records (i.e., certain
  records under the control of a federal agency, which may be maintained
  by a federal agency or a contractor to a federal agency), if the
  denial of access is consistent with the requirements of the Act.</p>
  
  <p>The requested PHI was obtained by someone other than a health care
  provider (e.g., a family member of the individual) under a promise of
  confidentiality, and providing access to the information would be
  reasonably likely to reveal the source of the information.</p>
</blockquote>

<p>The electronic access requirement is more about portability (ie: not needing to carry/mail/fax/whatever stacks of paper) than it is about convenience or <a href="https://en.wikipedia.org/wiki/Interoperability" rel="nofollow noreferrer">interoperability</a>. That is, the rule is not intended to require providers to give you (or any patient) data that is in a format. From the <a href="https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/" rel="nofollow noreferrer">HHS website</a>:</p>

<blockquote>
  <p>Where an individual requests an electronic copy of PHI that a covered entity maintains <em>electronically</em>, the covered entity must provide the individual with access to the information in the requested electronic form and format, if it is readily producible in that form and format. When the PHI is not readily producible in the electronic form and format requested, then the covered entity must provide access to an agreed upon alternative readable electronic format. [Emphasis theirs.]</p>
</blockquote>

<p>In other words, of the options they have available to them you may select which format (or for simplicity of workflow, they may just put all available formats on the same media). You may request the data in a particular format but in all likelihood, the facility you are requesting from will only have two or three output formats readily available. There is no requirement for them to accomodate requests for formats outside those that are <em>readily producible</em>. Options typically include: PDF, TIFF (ie: just pictures of text), CCD/CCDA/CDA (which is an XML-like structure of data that is moderately useful for import into other systems). </p>

<p>You do not have any right to gain access to the data as it is stored in the proprietary database of their electronic health records system. </p>

<p>I'm not sure if this answers your question completely - please feel free to follow up and/or clarify. </p>

united-states health