Who has access to your medical records?

1. You, yourself, may access your own medical records (except for -- maybe -- a psychotherapists notes). This may require a request from you in writing, or it may not.
2. Healthcare providers may request access to your record without permission, assuming they're treating you. You may request that your records not be passed along, but this request is not a requirement.
3. Payers -- your insurance company, for instance, may request some of your medical records in order to process payment or billing. They are entitled to "the minimum necessary" amount of info required to do their job.
4. Your medical records may be viewed in the process of "Operations", so the IT department in a hospital, for instance, may need to see some of your records in order to print them out. They are not allowed to reveal anything therein.
5. Your records may be subpoenad by a court of law or a grand jury. You have the right to request the court seal your records after deliberations. The court will almost always comply.
6. Healthcare providers may offer the relevant parts of your record to law enforcement in the event they are subpoenad to do so, or as supporting evidence in reporting a crime they are legally required to disclose.
7. Covered Entities (who have legitimate copies of your healthcare records) have the option to reveal those records (except psychotherapy notes) to police with an Administrative Letters.
8. Covered Entities may optionally reveal your records to law enforcement if said revelation is in the interests of National Security (although this clause is legally delicate and, barring an accompanying court order, likely will not stand the first challenge).
9. If you are deceased, your survivors may petition the court to open your closed records. This is not always done.
10. Any medical data about you may be revealed to or by anyone as long as the data being revealed does not include Individually Identifiable Healthcare Information (IIHI). So data can be revealed if nothing in the dataset can be used to specifically identify you. For instance, it's okay to say a patient was treated for the common cold in January, but NOT okay to say your name, birthdate, address, driver's license number, etc.

Added: And. . . of course, to anyone you specifically name in writing.