Home › Privacy guides › Who sees your records
Who can see your study records?
Study records pass through several sets of hands, each with a defined reason. Some people see records with your name; most see only coded data. This guide goes through the usual list and explains why each group is there.
§1 The study team at the site
The principal investigator, study coordinators, nurses and pharmacists at the site see your full records, including your name. They need them to care for you during the study and to record data accurately. They are bound by the site’s privacy rules and their professional duties.
§2 The funder of the research
Whichever company, university or agency runs the study usually receives coded data only. Its staff analyze results without knowing names. In some situations, such as a serious side effect report, it may receive more detail, but still under the study code where possible.
§3 Monitors and auditors
Monitors visit sites or connect remotely to compare the coded forms with original records, checking that nothing was copied wrongly. To do that they need to look at records that include your name. They are not allowed to take copies away, and they sign confidentiality agreements.
§4 The ethics board
The institutional review board that approved the study may look at records to make sure participants are protected and rules are followed. This rarely involves individual files, but the right to do so is usually listed in the consent form.
§5 Regulators
The FDA and, for international studies, regulators in other countries can inspect study records to confirm that results are reliable and that people were treated properly. Inspections may include records with names. Regulators keep this information confidential under their own rules.
§6 Data and safety monitoring boards
Many larger trials have an independent board that reviews safety data while the study is running. The board typically works with coded, pooled data and may see which group people are in, but it does not need names to do its job.
§7 Labs and service companies
Central labs, imaging readers and technology vendors handle parts of the data. They usually receive coded information and sign agreements limiting what they can do with it. Ask the study team which outside companies are involved and what they receive.
§8 Other researchers through data sharing
After a study ends, de-identified data may be shared with other scientists through data-sharing platforms, so more questions can be answered. Researchers usually have to apply and agree to strict terms. The consent form should tell you whether this is planned.
§9 If records are seen by someone who should not see them
Sites must investigate when records are accessed or released without permission. Under HIPAA, hospitals and clinics generally have to notify affected people of a breach of unsecured health information without unreasonable delay, and no later than 60 days after discovering it. If you receive a notice, it should explain what was exposed and what steps to take. You can also ask the study’s ethics board how the problem is being handled.
§10 You and your own doctor
You can usually ask for copies of your study records, though some blinded studies delay access to certain results until the study ends to protect the comparison. With your permission, the study team can share relevant results with your own doctor, which helps keep your regular care complete.
Case study (invented)
Lucia checks the list
Lucia, 56, is in a two-year osteoporosis study. A friend tells her that drug companies see everyone’s medical files. Lucia takes out her consent form and finds the list of people who may view her records: the study team, monitors, the ethics board, the FDA and the organization funding the study.
At her next visit she asks the coordinator what each group sees. The coordinator explains that the funder receives only coded data, that monitors look at her chart at the site to check accuracy, and that the study will send a summary of her bone scans to her own doctor because she ticked that option.
Access checklist
- Find the list of who may view records
- Ask which groups see your name
- Ask what the funder receives
- Ask whether data will be shared after the study
- Ask which outside companies are involved
- Ask how to get copies of your records
- Ask whether any results are held back until the end
- Decide whether to share results with your own doctor
Summary table
| Who | Why they look | What they usually see |
|---|---|---|
| Study team | Care and accurate records | Full records with your name |
| Funder | Analysis of results | Coded data |
| Monitors | Checking accuracy | Site records, viewed on site |
| Ethics board | Protecting participants | Records if needed |
| Regulators | Confirming reliability | Records during inspections |
| Other researchers | New analyses after the study | De-identified data |
Definitions
- Principal investigator
- The doctor leading the study at a site.
- Monitor
- A person who checks study data against original records.
- Audit
- A formal check of how a study was run.
- Inspection
- A review of study records by a regulator.
- Data sharing
- Making study data available to other researchers.
- Right of access
- Your right to see and copy your health information.
Ask the study team
- Which groups will see records with my name?
- What does the organization funding the study receive?
- Will my data be shared with other researchers after the study?
- Which outside companies handle my data?
- How can I get copies of my own records?
- Can my results be sent to my own doctor?
This Windowira guide is general information, not legal or medical advice. The study team and the consent form describe how your own data is handled. Reviewed November 9, 2026. Notice a mistake? support@windowira.com or 877-551-0031.