As crucial as medical history can be to improving someone’s health, patient files have never been well organized. Before the advent of electronic records, they were almost impossible to read: scraps of paper with physician notes, photocopies of handwritten prescriptions. And instead of following you from one practice to the next or across every stage of life, files usually only had information from that individual doctor’s treatment. Change providers and your record was no longer available; over time, it was even thrown away.

How much time depends on the state: In New York, healthcare practitioners must retain medical records for six years after the last visit and in New Jersey and Connecticut, it’s seven—for electronic or paper files. And even electronic medical records (EMRs) aren’t collective across providers: Sometimes physicians in the same health system can access each other’s notes, but visit someone out of network and they’ll create a brand new record. In an age where everything else in our lives can be stored on a single phone, electronic health record systems are abysmally behind. To help patients navigate, we’ve put together this brief guide with common patient questions about EMRs:

Why should I access my electronic health records?
There are all kinds of reasons patients should have a copy of their medical records: to make sure information is correct, in case they have to change primary care providers, or if they need a second opinion. But most importantly, this file is about you and your body. You should know what it says.

How often can I access my electronic medical record?
The only limit to how many times a patient can ask for their medical record is generally how much they’re willing to pay. Back in the paper days, doctors typically provided one copy for free, but charged after that. Just because files are now electronic doesn’t mean it won’t still cost you: The amount varies from state to state with New Jersey permitting up to $1 per page with a $100 limit. In New York, it’s less: Up to 75 cents per page, but no limit. Doctors cannot withhold records from any patient yet to pay their bill.

How can I get an electronic copy of my medical file?
While processing EMRs doesn’t take nearly as long as making physical copies, practices still follow older delivery windows. Federal law says providers have 30 days after request. In New York, 10 to 14 days can be expected. You should also specifically ask for electronic delivery. Even if records are digital, some health systems still manually print them, making delivery take longer and running patients into those nasty copy fees. Interoperability is also a problem. There are multiple software companies on the market creating EMRs and practices are free to choose whichever they prefer. While you should offer your copy to any new doctor — just as you would a paper file — depending on the electronic health record system that your last doctor used, new providers may or may not be able to open it. And you definitely won’t be able to open native file formats at home. HealthIT.gov recommends requesting a PDF via CD or thumb drive.

Veterans receive enhanced pdfs by default through the Department of Defense’s Blue Button program, available through their My HealtheVet Personal Health Record online account. A simple text file (.txt) option is also available, as well as a way for them to download specific information by date or class.
If your provider offers an online portal, make sure to look for the lock symbol next to the website address before you use it. This means the site’s security certificate is valid. If that tiny padlock isn’t there, transfer may no longer be safe.

Should my doctor be concerned about data security?
Yes. Ask your provider if office software is regularly patched for malware updates. Are electronic medical records password protected? Are they stored in accordance with data security best practices? When hospitals do get hacked, Michael Ebert from KPMG’s healthcare and life sciences group says attacks are usually “aimed at stealing their technology so devices can be copied”—in other words, the bad guys want intellectual property, not your personal health data. But if EMRs are linked to a connected medical device — say a smart IV that automatically adds readings to your electronic medical record — your patient information can get stolen, too.

How can I safely store my electronic health record at home?
The odds of hackers going after EMRs at home is remarkably low. According to Dr Michael Nowatkowski, information security professor at Augusta University’s Cyber Institute, “High-profile individuals may be at greater risk than the general public,” particularly politicians, business leaders, and “celebrities or wealthy individuals that could be ransomed.” If that’s not you, don’t expect the bad guys to steal your electronic health record any time soon.

That doesn’t mean your information shouldn’t still be stored privately, though. Make sure your home wifi network is password protected. Try keeping your file on the secure cloud instead of directly on a device. This way, if your computer is ever stolen, you’ll still have a copy and the bad guys won’t. Your doctor should send EMRs pre-encrypted, but if your electronic medical record doesn’t already require a password to open, add one.

Who owns my electronic health data?
It’s your health, but according to The Centers for Disease Control and Prevention (CDC), it’s not your data. Raj Sharma, CEO of blockchain-based medical records system Health Wizz, says this is because doctors create or author the info your record contains when they put it in there: “Intellectual property laws protect ‘original works of authorship,’” he writes for Forbes, “Medical records represent professional medical opinions of a physician or a medical institution” and no one can own another person’s opinion.

What else do I need to know?
Today’s EMRs do make it easier for practices to combine medical histories across multiple providers, but electronic health record systems still aren’t perfect. As the CDC website cautions, “They are only as good as the people who input it.” Just as with paper files, doctors vary in what they include in electronic health records. Some aren’t as thorough with notation and others might be less comfortable using computers. Diagnosis codes can always be entered incorrectly and follow-up visits under-explained. Most practices also don’t scan in older, written records, so electronic health record systems tend to only track the new stuff. Remember EMRs don’t make healthcare providers perfect—just paper-free.