In 1996, Congress gave itself three years to pass a law that would preserve the privacy of medical records, particularly records that are transmitted electronically. If it failed to complete the task in the assigned time, the job was to go to the Department of Health and Human Services (HHS).
Congress missed its deadline this past August, and now the HHS is hard at work writing appropriate regulations. Nothing is final, but the HHS recently made some proposals. Health plans, hospitals, doctors, clinics, and the like would be able to transmit your medical records without your permission for purposes of treatment, payment, and public interest -- medical research, for example. But for other purposes, the sender must first receive your permission. The HHS also would give you the right to review and correct your medical file, to learn who has looked at it, and to sue those who have your records but do not abide by the HHS's privacy rules.
Note however that the HHS has authority to protect only electronic records. Federal protection of paper files requires another act of Congress. If the HHS keeps to its schedule, the medical records protections will be settled in February. Congress will take longer to pass a patient protection act and Medicare drug coverage. Don't expect them before next fall.