State laws and accreditation requirements dictate the form, ownership, and substance of medical records, as well as requirements for storage, access, and confidentiality. There are limited exceptions to these requirements but they are highly circumscribed. Federal law also outlines requirements to ensure the privacy of patient-identifiable information. Thus, providers must be aware of these rules both to protect patient information from being abused and to understand the affirmative obligations they have so as to avoid the significant penalties associated with breach of these provisions.