Answers

What is a personal health record (PHR)?

Some PHRs come from your provider or health plan and others from employers or other companies, and that difference decides whether HIPAA's Privacy Rule applies.

Arun Verma, co-founder of Triangle · 2026-10-17

This is not clinical evidence and not medical advice. It does not replace your care team. Discuss anything here with your clinician before you act on it.

What is a personal health record (PHR)?

ONC defines a personal health record as an electronic application you can use to maintain and manage your health information in a private, secure and confidential environment. The same definition covers information for others you are authorized to manage. ONC says PHRs contain the same types of information as EHRs: diagnoses, medications, immunizations, family medical history and provider contact information. They are designed to be set up, accessed and managed by patients. ONC says the information can come from a variety of sources, including clinicians, home monitoring devices and you. The Office for Civil Rights (OCR) at HHS says there is no universal definition, but in general a PHR is an electronic record in which you control access to your health information.

How is a PHR different from the record my provider keeps?

Your provider's electronic health record (EHR) is held and maintained by the provider. A PHR is the record that, in general, you control access to, OCR says, and the two should not be confused. ONC adds that an EHR contains information from all the clinicians involved in a patient's care. You may have charts at several doctors' offices, and one at any hospital where you have stayed. A PHR that a provider or health plan offers may show you only part of what that organization holds. OCR says that in many cases you may be able to view, but not edit, the information the provider or plan assembled, though you may be able to add and edit your own entries. Such a PHR may also not update automatically from all your providers, and may not move with you if you switch. A fair question for a provider's office is which parts of your chart its PHR shows.

What goes into a PHR?

It depends on the PHR. OCR says a PHR may include common information such as medical diagnoses, medications and test results. MedlinePlus says you could start with items such as your name, birth date, blood type and emergency contact information; dates and results of tests and screenings; major illnesses and surgeries, with dates; your medicines and how long you have taken them; any allergies; and any history of illnesses in your family. Depending on the type, a PHR may also let you track information for your children or others whose care you manage, schedule appointments and get reminders about them, and message your providers securely.

How do records get into a PHR?

The route depends on the PHR and on who holds the records. ONC's 2011 consumer guide says that in some cases doctors and hospitals can send a copy of the records they keep on you to your web-based PHR, and in others you may get an electronic copy from your provider or health plan and upload it. When a covered entity does not offer the PHR, the HIPAA Privacy Rule still governs how information it holds gets in, OCR says. With your written authorization, a covered entity may send the information directly to the PHR's administrator, in cases where the PHR company is able to or has agreed to take it that way. It may also give the information to you to enter. A fair question for a provider's office is whether it can send records straight to the PHR you chose or only give you a copy.

Who controls a PHR?

OCR says PHRs focus on giving you the ability to manage your health information and to control, to varying extents, who can access it. With a PHR offered by a provider or plan, you may be able to decide who else gets access, such as a spouse, family member or another provider. ONC's 2011 consumer guide says a PHR company may release your PHR data for various reasons, including, in some cases, as its business practice, such as selling it to research and marketing organizations. The guide adds that you can contact the company to ask whether you can opt out.

Does HIPAA cover a PHR?

Sometimes, depending on who offers it. OCR says the HIPAA Privacy Rule applies to PHRs offered by covered providers and health plans, and does not apply to PHRs offered by employers (separate from the employer's group health plan) or by vendors directly to individuals. Those are governed by the privacy policies and practices of whoever offers or administers them, and by any other applicable laws. A "HIPAA-compliant" label does not change that. OCR notes that some of these PHRs may advertise themselves that way even though the Privacy Rule does not apply to or protect the information in them. The ASTP/ONC fact sheet lists health information stored in a PHR that is not offered through a HIPAA-covered provider or plan among its examples of information HIPAA does not cover.

What happens if I send my records to an app I chose?

They can end up outside HIPAA. HHS says that once a covered entity sends health information, at your direction, to an app that is neither a covered entity nor a business associate, the information is no longer subject to HIPAA's protections. If you chose the app and it was not provided by or on behalf of the provider, the provider would not be liable under HIPAA for the app's later use or disclosure of the information, and would have no HIPAA liability if the app later has a breach. An app a provider offers or uses for its own services is different. HHS says the provider could be liable under HIPAA if that app impermissibly discloses the information, because of the business associate relationship.

What do the FTC's rules cover?

The FTC Act and the Health Breach Notification Rule can reach some companies that HIPAA does not cover. The FTC says the FTC Act applies to HIPAA-covered organizations and to companies that are not required to follow HIPAA, and prohibits unfair or deceptive practices, including misleading consumers about what happens to their health information. Its business guidance also warns against false or misleading claims of being "HIPAA Compliant" or "HIPAA Secure." The FTC says its Health Breach Notification Rule requires certain businesses and nonprofits not covered by HIPAA to notify their customers, the FTC and, in some cases, the media after a breach of unsecured, individually identifiable health information. Its July 2024 amendments make clear that makers of health apps, connected devices and similar products must comply. The FTC says a breach is not limited to cybersecurity intrusions: a company's sharing of covered information without a person's authorization also triggers notification. It says notice to affected people is due without unreasonable delay and within 60 calendar days after the breach is discovered, and that the Rule applies only to unsecured information, which HHS defines to include information that is not encrypted or destroyed.

How can I judge a PHR's privacy?

ONC's 2011 consumer guide says privacy policies explain a company's practices but do not ensure privacy. For a PHR outside HIPAA, OCR points to things such as how your information is safeguarded, what purposes it is used and disclosed for, and how much control you keep over access. The same guide describes a PHR Model Privacy Notice that puts some answers in one standard layout for companies that post one. Questions you could put to any PHR company: Does it release your data for marketing or research? Does it keep an activity log you can review? Does it store data only in the United States? What happens to your data after you close or transfer your PHR? The guide notes that companies that do not use the notice may or may not have reasonable security measures in place.

Sources

• ASTP/ONC HealthIT.gov: Health IT and HIE Frequently Asked Questions (last updated April 1, 2026): ONC defines a personal health record, or PHR, as an electronic application through which patients can maintain and manage their health information (and that of others for whom they are authorized) in a private, secure, and confidential environment.
• ASTP/ONC HealthIT.gov: Health IT and HIE Frequently Asked Questions (last updated April 1, 2026): ONC says PHRs contain the same types of information as EHRs (diagnoses, medications, immunizations, family medical histories, and provider contact information) but are designed to be set up, accessed, and managed by patients.
• ASTP/ONC HealthIT.gov: Health IT and HIE Frequently Asked Questions (last updated April 1, 2026): ONC says PHRs can include information from a variety of sources including clinicians, home monitoring devices, and patients themselves.
• HHS OCR: Personal Health Records and the HIPAA Privacy Rule (PDF): OCR says there is currently no universal definition of a PHR, and that in general a PHR is an electronic record of an individual's health information by which the individual controls access to the information and may have the ability to manage, track, and participate in his or her own health care.
• HHS OCR: Personal Health Records and the HIPAA Privacy Rule (PDF): OCR says a PHR should not be confused with an electronic health record (EHR), which is held and maintained by a health care provider.
• ASTP/ONC HealthIT.gov: Health IT and HIE Frequently Asked Questions (last updated April 1, 2026): ONC says EHRs contain information from all the clinicians involved in a patient's care.
• MedlinePlus: Personal Health Records: MedlinePlus says you may have charts at several doctors' offices, and a chart at a hospital if you have been in the hospital; these charts are your medical records and may be on paper or electronic.
• HHS OCR: Personal Health Records and the HIPAA Privacy Rule (PDF): OCR says that with a PHR offered by a health care provider or health plan, in many cases an individual may not be given access to the entirety of his or her health record and may only have the ability to view and not update or edit the information assembled by the provider or plan, though these PHRs also may allow individuals to add their own information and to update or edit this self-entered information.
• HHS OCR: Personal Health Records and the HIPAA Privacy Rule (PDF): OCR says a PHR offered by a health care provider or health plan may not be a comprehensive record because it may not be automatically updated with information from all of the individual's providers or plans, and may not be portable when the individual switches health care providers or health plans.
• HHS OCR: Personal Health Records and the HIPAA Privacy Rule (PDF): OCR says a PHR may provide a longitudinal health history and may include common information such as medical diagnoses, medications, and test results.
• MedlinePlus: Personal Health Records: MedlinePlus says you could start a personal health record with items such as your name, birth date, blood type, and emergency contact information; dates and results of tests and screenings; major illnesses and surgeries, with dates; your medicines and how long you have taken them; any allergies; and any history of illnesses in your family.
• HHS OCR: Personal Health Records and the HIPAA Privacy Rule (PDF): OCR says that, depending on the type of PHR, individuals also may be able to track the health information of their children or others whose care they manage, schedule and receive reminders about upcoming appointments or procedures, and communicate with their health care providers through secure messaging systems.
• ASTP/ONC HealthIT.gov: Consumer Guide to Understanding and Using the PHR Model Privacy Notice on PHR Company Data Practices (PDF, 2011): ONC's 2011 consumer guide says that in some cases doctors and hospitals can send a copy of the health records they keep on you to your web-based PHR, and that in other cases you may be able to get an electronic copy of your records from your health care provider or health plan and upload it.
• HHS OCR: Personal Health Records and the HIPAA Privacy Rule (PDF): OCR says the Privacy Rule still regulates how an individual's health information held by a HIPAA covered entity enters a PHR that a covered entity does not offer.
• HHS OCR: Personal Health Records and the HIPAA Privacy Rule (PDF): OCR says that, in cases where the entity offering the PHR is able to or has agreed to input information directly into the PHR for the individual, a covered entity is permitted to disclose an individual's health information directly to the entity administering the PHR if the covered entity has the individual's written authorization.
• HHS OCR: Personal Health Records and the HIPAA Privacy Rule (PDF): OCR says a covered entity may instead provide the information directly to the individual, who can enter it into the PHR.
• HHS OCR: Personal Health Records and the HIPAA Privacy Rule (PDF): OCR says PHRs universally focus on providing individuals with the ability to manage their health information and to control, to varying extents, who can access it.
• HHS OCR: Personal Health Records and the HIPAA Privacy Rule (PDF): OCR says that with a PHR offered by a covered provider or plan, the individual may be able to control who else has access to the information in the PHR, such as a spouse, family member, or another health care provider.
• ASTP/ONC HealthIT.gov: Consumer Guide to Understanding and Using the PHR Model Privacy Notice on PHR Company Data Practices (PDF, 2011): ONC's 2011 consumer guide says a PHR company may release your PHR data for various reasons, including, in some cases, as its business practice, such as selling it to research and marketing organizations.
• ASTP/ONC HealthIT.gov: Consumer Guide to Understanding and Using the PHR Model Privacy Notice on PHR Company Data Practices (PDF, 2011): ONC's consumer guide says that if you do not want your PHR data released for certain purposes, you can contact the PHR company to learn whether it gives you the opportunity to opt out.
• ASTP/ONC HealthIT.gov: Consumer Guide to Understanding and Using the PHR Model Privacy Notice on PHR Company Data Practices (PDF, 2011): ONC's consumer guide says the PHR Model Privacy Notice has a section on what the PHR company does with your PHR data once you close your account and transfer your PHR information to another PHR company.
• HHS OCR: Personal Health Records and the HIPAA Privacy Rule (PDF): OCR says PHRs that are subject to the Privacy Rule are those that a covered health care provider or health plan offers.
• HHS OCR: Personal Health Records and the HIPAA Privacy Rule (PDF): OCR says the Privacy Rule does not apply to PHRs that are not offered by covered health plans or providers, for example PHRs offered by employers (separate from the employer's group health plan) or by PHR vendors directly to individuals.
• HHS OCR: Personal Health Records and the HIPAA Privacy Rule (PDF): OCR says PHRs not offered by covered entities are governed by the privacy policies and practices of the entities offering or administering them, as well as by any other applicable laws.
• HHS OCR: Personal Health Records and the HIPAA Privacy Rule (PDF): OCR says some PHRs not offered by covered entities may advertise that they are "HIPAA-compliant," but the Privacy Rule does not apply to or protect the health information within them.
• ASTP/ONC HealthIT.gov: Health IT: How to Keep Your Health Information Private and Secure (fact sheet): The ASTP/ONC fact sheet lists, among its examples of health information not covered by HIPAA, information patients store in a personal health record (PHR) that is not offered through a health provider or health plan covered by HIPAA.
• HHS: HIPAA FAQ 3009, covered entity liability for an app the individual chose (created 04/18/19; last reviewed May 9, 2019): HHS says that once health information is received from a covered entity, at the individual's direction, by an app that is neither a covered entity nor a business associate under HIPAA, the information is no longer subject to the protections of the HIPAA Rules.
• HHS: HIPAA FAQ 3009, covered entity liability for an app the individual chose (created 04/18/19; last reviewed May 9, 2019): HHS says that if the individual's app was chosen by the individual and was not provided by or on behalf of the covered entity, the covered entity would not be liable under the HIPAA Rules for the app's subsequent use or disclosure of the information, and would have no HIPAA responsibilities or liability if the app later experiences a breach.
• HHS: HIPAA FAQ 3009, covered entity liability for an app the individual chose (created 04/18/19; last reviewed May 9, 2019): HHS says that if the app was developed for, or provided by or on behalf of, the covered entity, the covered entity could be liable under the HIPAA Rules for a subsequent impermissible disclosure because of the business associate relationship.
• FTC: Collecting, Using, or Sharing Consumer Health Information? Look to HIPAA, the FTC Act, and the Health Breach Notification Rule (August 2024): The FTC says the FTC Act prohibits unfair or deceptive acts or practices, including misleading consumers about what is happening with their health information, and that its obligations apply to HIPAA-covered entities and business associates as well as to companies that collect, use, or share health information and are not required to comply with HIPAA.
• FTC: Collecting, Using, or Sharing Consumer Health Information? Look to HIPAA, the FTC Act, and the Health Breach Notification Rule (August 2024): The FTC's business guidance says not to make false or misleading claims that you are "HIPAA Compliant," "HIPAA Secure," "HIPAA Certified" or the like.
• FTC: Complying with FTC's Health Breach Notification Rule (business guidance; edited January 2025): The FTC says its Health Breach Notification Rule requires certain organizations (both businesses and nonprofits) not covered by HIPAA to notify their customers, the FTC, and in some cases the media if there is a breach of unsecured, individually identifiable health information.
• FTC: Complying with FTC's Health Breach Notification Rule (business guidance; edited January 2025): The FTC says its July 2024 amendments make clear that makers of health apps, connected devices, and similar products must comply with the Rule.
• FTC: Complying with FTC's Health Breach Notification Rule (business guidance; edited January 2025): The FTC says a breach under the Rule is not limited to cybersecurity intrusions, and that incidents of unauthorized access, including a company's disclosure of covered information without a person's authorization, trigger notification obligations.
• FTC: Complying with FTC's Health Breach Notification Rule (business guidance; edited January 2025): The FTC says that if a vendor of personal health records or a PHR related entity experiences a breach of unsecured personal health information, it must notify each affected person without unreasonable delay and within 60 calendar days after the breach is discovered.
• FTC: Complying with FTC's Health Breach Notification Rule (business guidance; edited January 2025): The FTC says the Rule applies only to unsecured health information, defined by HHS to include any information that is not encrypted or destroyed.
• HHS OCR: Personal Health Records and the HIPAA Privacy Rule (PDF): OCR says that when selecting a PHR not offered by a covered entity, individuals should evaluate its privacy policies to decide if they are comfortable with the protections and rights offered, such as how their information will be safeguarded, for what purposes it will be used and disclosed, and the extent to which the individual will control access.
• ASTP/ONC HealthIT.gov: Consumer Guide to Understanding and Using the PHR Model Privacy Notice on PHR Company Data Practices (PDF, 2011): ONC's consumer guide says privacy policies do not ensure privacy, but explain the privacy and security practices of a company.
• ASTP/ONC HealthIT.gov: Consumer Guide to Understanding and Using the PHR Model Privacy Notice on PHR Company Data Practices (PDF, 2011): ONC's 2011 consumer guide says a PHR company's Privacy Notice that follows the Model Notice is expected to look the same on any company's website, and that its Release section asks whether the company releases your data for marketing and advertising, medical and pharmaceutical research, reporting about company and customer activity, insurers and employers, and developing software applications.
• ASTP/ONC HealthIT.gov: Consumer Guide to Understanding and Using the PHR Model Privacy Notice on PHR Company Data Practices (PDF, 2011): ONC's consumer guide says the Model Notice's Secure section covers whether the company has security measures, stores PHR data in the United States only, and keeps activity logs that you can review.
• ASTP/ONC HealthIT.gov: Consumer Guide to Understanding and Using the PHR Model Privacy Notice on PHR Company Data Practices (PDF, 2011): ONC's consumer guide says that PHR companies that do not use the Model Privacy Notice may or may not have the security measures it describes.

Start your 7-day free trialtilde is made by Triangle. 7-day free trial, then $9 a month. Cancel anytime.