Medical information is among the most sensitive data you have, and it can surface online in more ways than most people expect: a hospital breach, a misdirected email, a health app that shares data with advertisers, a social media post by a relative or a people-search profile that infers a condition. Many people ask how to “remove medical records from the internet.” The honest answer begins with a distinction: your official records are not something you can delete, but exposed copies, leaked data and broker profiles are things you can act on. This guide explains the difference, your rights and what to do when your health information is where it should not be.
1. Two kinds of medical information
It helps to separate the official record from everything else.
| Type | Examples | Can you remove it? |
|---|---|---|
| Official medical records | Charts held by doctors, hospitals, insurers | No; retention is required by law, but you can correct and restrict |
| Patient portal and app data | Portals, telehealth, wearables | Often yes, by deleting account or data |
| Leaked or posted records | Breach dumps, posts, documents on websites | Sometimes, through takedown requests |
| Inferred health data | Marketing interests, broker profiles | Often, through opt-outs |
| Public filings | Court cases with medical details | Limited; depends on sealing rules |
Knowing which category you are dealing with determines the next step.
2. Your rights under HIPAA
The Health Insurance Portability and Accountability Act gives patients a set of rights over health information held by covered entities, such as providers, health plans and clearinghouses, and by their business associates. The U.S. Department of Health and Human Services explains these rights at hhs.gov. In general you can:
- Access your records and obtain copies, including electronic copies.
- Request amendments to correct errors.
- Request restrictions on certain uses or disclosures, though providers are not required to agree to all of them.
- Request confidential communications, such as sending messages to a different address or phone number.
- Receive an accounting of disclosures for certain uses of your information.
- File a complaint if you think your rights were violated.
HIPAA does not require a provider to delete your chart. State retention laws usually require records to be kept for years. It also does not cover most consumer health apps, fitness trackers and websites, which operate under their own privacy policies.
3. Step-by-step: reduce your medical exposure
Step 1: Know where your information lives
List your providers, insurers, pharmacies, patient portals, telehealth apps, wearables and health apps. Each is a separate holder of data.
Step 2: Secure your portals and accounts
Use unique passwords and two-factor authentication on every portal. Review who has proxy access, such as a family member, and remove those who no longer need it.
Step 3: Request what you need from providers
Ask for a copy of your records, correct inaccuracies and request confidential communications if your address or phone number is a concern. Ask your provider about restrictions you may request and how they handle disclosures.
Step 4: Review app and wearable permissions
Disable sharing with third parties, remove data you no longer need and delete apps you do not use. Our guides on what happens to your health data online and why your wearable data matters explain the risks.
Step 5: Search for exposed information
Search your name with terms like your provider, a condition or a medication, and check people-search sites for health-related details. Record any exposed documents.
Step 6: Request takedowns and search removal
For information posted on a website, contact the site owner with the exact URL and ask for removal. Request search-result removal for pages that show sensitive identifiers. See how to remove yourself from Google.
Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.
4. If your records were leaked or breached
Healthcare organizations are frequent targets of attacks. When a hospital or clinic is hit, patient data may be stolen and posted. Read about what has happened in patient info is often leaked by hospitals worldwide and the ransomware attack at a hospital in Wyoming.
If you receive a breach notice:
- Read the notice to learn what was exposed, such as names, birth dates, Social Security numbers, insurance IDs or diagnoses.
- Place a credit freeze if identifiers were exposed. See what is a credit freeze.
- Watch for medical identity theft: bills for services you did not receive, insurer statements you do not recognize or denied claims.
- Request your records and an accounting of disclosures from the provider.
- Be alert to phishing that mentions your provider or insurer.
- Report identity theft at IdentityTheft.gov.
- File a complaint with the HHS Office for Civil Rights if you believe the entity did not protect your information properly.
For general breach steps, see data breach response strategies and what is a data breach.
5. Health data outside the medical system
A lot of health information is created outside doctors’ offices.
- Apps and wearables record heart rate, sleep, cycles and fitness. Many are not covered by HIPAA.
- Search and browsing can reveal conditions you looked up.
- Retail purchases such as pharmacy and wellness products form marketing profiles.
- Social media posts and group memberships can reveal health status. See how attribute inference attacks expose your privacy online.
- Data brokers may sell inferred health interests or lists of people with certain conditions.
Because these are mostly outside HIPAA, your tools are privacy settings, deletion requests under state laws, and opt-outs. Review app permissions regularly; see how to find out if your newest phone app is sharing your private data.
6. Court and public records
Some medical details appear in court filings, such as disability claims, malpractice cases or custody disputes. Public records are typically hard to remove, but courts can seal records or allow redaction in some circumstances. Ask a lawyer or the court clerk about sealing options in your jurisdiction.
7. Talking to your provider about privacy
Many privacy problems in healthcare are solved by a conversation. Ask your provider how your information is stored, who in the practice can see it and whether you can limit what is shared with family members, employers or other outside parties. Ask how they handle email, text reminders and portal messages, and request confidential communications if you need messages sent to a specific address or number. If you pay for a service out of pocket, ask whether you can request that it not be disclosed to your health plan; certain rights apply in that situation.
Keep a short list of your requests and the responses. If something goes wrong, such as an unauthorized disclosure, the list makes your complaint to the provider’s privacy officer clearer. Providers are required to have a privacy officer, and raising an issue with that person first often resolves it faster than any outside process.
8. Three scenarios and what to do
Scenario 1: A relative posted about your diagnosis. Ask them to remove or edit the post, report it to the platform under privacy rules if they refuse and request search removal if it appears in results.
Scenario 2: Your hospital reported a breach. Freeze credit, request your records, watch your insurance statements and consider placing a fraud alert. Save the breach notice.
Scenario 3: A people-search profile hints at a health condition. Opt out of the profile and related sites. Review which apps and loyalty programs might be sharing data and reduce them.
9. What to expect: a realistic timeline
| Action | Typical time |
|---|---|
| Portal security upgrade | 30 minutes |
| Records request from a provider | Up to 30 days under HIPAA |
| Website takedown responses | Days to weeks, often none |
| Search result removal | Days to several weeks |
| Complaint investigation | Months |
10. Common mistakes
- Expecting a hospital to delete a medical chart.
- Ignoring a breach notice.
- Connecting health apps without reading privacy settings.
- Letting old proxy access stay active on portals.
- Posting health details publicly.
- Skipping broker opt-outs.
11. How Wiperts fits
Wiperts cannot change your official medical records, and no one can. What it can do is shrink the web of broker and people-search profiles around your name, address and phone number, where inferred and purchased data often live. The service scans more than 100 data brokers and people-search sites, submits removal requests, removes your personal results from Google and Bing, blurs your home on maps and monitors around the clock.
Check what brokers publish about you with the free diagnosis.
100% Free Diagnosis: Check Your Exposure
Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:
- First Name
- Last Name
- Select State
- Email Address
- Website
Scan Databases Now — no payment is needed to see your exposure report.
12. Key takeaways
- Official medical records cannot be deleted, but you can correct, restrict and control access.
- Exposed copies, leaks and broker profiles can often be targeted for removal.
- Most health apps and wearables fall outside HIPAA, so review their settings.
- Act quickly after a breach: freeze credit, request records and watch for medical identity theft.
Pick the Wiperts plan that fits your household
| Plan | Covers | One-time deep scrub | Then |
|---|---|---|---|
| Individual | 1 person | $89 | $14/month |
| Couples (most popular) | 2 people | $149 | $24/month |
| Family | Up to 4 people | $199 | $39/month |
Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal
13. Frequently Asked Questions
Can I delete my medical records?
Generally no. Healthcare providers must keep records for periods set by state law, and the official chart is not yours to erase. You can request corrections, restrict some disclosures and control access to your portal and apps.
What is HIPAA and what does it cover?
HIPAA is a federal law that protects health information held by covered entities such as providers, health plans and their business associates. It does not cover most apps, websites and wearables that you choose to use.
What can I do if my medical information is posted online?
Save evidence, ask the site to remove it, request removal from search results, notify the provider if the leak came from them and file a complaint with the HHS Office for Civil Rights if a covered entity disclosed it improperly.
How do I find out who has seen my records?
Under HIPAA you can request an accounting of certain disclosures from providers. You can also review portal access logs where offered and ask the provider about uses of your information.
Do health apps and wearables have the same protection?
Usually not. Many are not covered by HIPAA, and their data is governed by their privacy policies and by other laws. Review what they collect and share before you connect them.
Can data brokers have my health information?
They may hold inferred health interests or purchased data such as prescription-related marketing lists. Opting out of broker profiles reduces what is published, though it cannot erase official records.
Sources
Related Reading
- What Happens to Your Health Data Online?
- Why Hospitals Keep Leaking Patient Data and How to Protect Yourself
- Ransomware at a Wyoming Hospital: Lessons for Patients
- Data Breach Response Planner: What to Do in the First 30 Days
- What Is a Data Breach? Causes, Risks and What To Do
- How to Secure Privacy on Your Phone: A Practical 2026 Checklist
- Why Your Wearable Data Matters: Fitness Trackers, Smartwatches and Privacy
- How to Find Out If a Phone App Is Sharing Your Private Data
Ready to erase your footprint?
Stop letting data brokers profit from your personal life. Start your removal today.
Start Removing