3d:"/_next/static/chunks/24jkfr7u9s_6l.js" 3e:"/_next/static/chunks/0fv-mr63cnuzi.js" 3f:"/_next/static/chunks/2drs39ix-1ees.js" 40:I[274158,["$6","$7","$8","$9","$a","$b","$c","$d","$e","$f","$10","$11","$12","$13","$14","$15","$27","$3d","$3e","$3f"],"default"] 43:I[27201,["$6","$7","$8","$9","$a","$b","$c","$d","$e","$f","$10","$11","$12","$13","$14","$15"],"IconMark"] 41:T3364,# View Only Medical Record Sharing: 4 Steps, but Screenshots Still Work ![Patient setting access for a medical report](https://media.babylovegrowth.ai/blog-images/organization-26020/1791860832408_Patient-setting-access-for-a-medical-report.jpeg) View-only settings can limit what someone can do with a shared medical record, but they cannot prevent every way of copying or forwarding it. Before you send anything, consider setting viewer-only permission, restricting access to named people, and turning on [audit logging for small businesses](https://sobalhealth.com/small-business-health-insurance-florida). [CISA](https://www.cisa.gov/resources-tools/services/bod-25-01-implementing-secure-practices-cloud-services-required-configurations) and [HHS](https://www.hhs.gov/hipaa/for-professionals/security/guidance/cybersecurity-newsletter-summer-2021/index.html) both back this approach, and a platform with suitable access controls and audit logging can help you manage sharing. *** > **TL;DR:** > > - Set folders to Viewer before uploading, then inspect each file individually, because inherited permissions can restore broader access without warning. > - Restrict each share to named recipients, use separate accounts, and confirm the platform records who opened files and when before relying on its audit trail. > - Disabling downloads, printing, and copying reduces casual sharing but cannot stop screenshots, screen photographs, or retyping; use a monitored portal for highly sensitive results. > - For temporary access, require sign in to a named account, set an expiration date, and revoke access or remove recipients once sharing ends. > - After records go to a third party app at a family member's request, HIPAA's Privacy Rule no longer limits how that app uses them. *** ## Table of Contents - [How view-only permissions actually work](#how-view-only-permissions-actually-work) - [Practical ways to create a view-only share](#practical-ways-to-create-a-view-only-share) - [How to track views and revoke access when you need to](#how-to-track-views-and-revoke-access-when-you-need-to) - [A short HIPAA-aware checklist for sharing medical records](#a-short-hipaa-aware-checklist-for-sharing-medical-records) - [What view-only controls can and cannot stop](#what-view-only-controls-can-and-cannot-stop) - [Our take on "view-only" as a security promise](#our-take-on-view-only-as-a-security-promise) - [Secure sharing with MedFiles.ai](#secure-sharing-with-medfilesai) - [FAQ](#faq) - [Sources](#sources) ## How view-only permissions actually work Google Drive offers [Viewer, Commenter, and Editor](https://support.google.com/drive/answer/2494822) permission levels. A Viewer can open and read a file but cannot change it, add notes, or (when configured correctly) download or print it. A Commenter can leave notes without altering the original. An Editor can change the file outright, which is never the right choice for sharing a lab report or imaging scan. Turning off download, print, and copy inside the document viewer blocks casual copying, but it will not stop someone determined to capture the screen. That distinction matters when you decide how sensitive a given record is. Folder permissions matter as much as file permissions. When you drop a new file into a folder, it typically inherits that folder's sharing settings. If the folder defaults to Editor access, every new file you add inherits that same open access, even if you meant to share it narrowly. - Set the folder's default permission to View only before adding sensitive files. - Use unique, named user accounts instead of shared logins, so an activity log can show exactly who opened a file and when. - Check each file individually after adding it to a shared folder, since inherited permissions can silently override your intent. ## Practical ways to create a view-only share You do not need special software to lock a record down to viewing only. The steps below work across most common file and cloud platforms. 1. **Share a single file as Viewer.** Open the sharing menu, select the specific people you want, set their role to Viewer, and avoid "anyone with the link" when you want to restrict access to specific people. 2. **Set folder-level defaults to View only.** Before uploading a batch of records, change the folder's sharing settings so every new file defaults to Viewer access rather than Editor. 3. **Use expiring links and passwords for temporary access.** Google Drive's sharing settings let you assign a Viewer role and, on some file types, disable downloading, printing, and copying for that recipient. 4. **Use a HIPAA-ready record platform for ongoing sharing.** Look for access controls, audit logs, and the ability to revoke access instantly, since these features matter more as you share records repeatedly with providers or family. **Pro Tip:** *Before you hit send, run through these settings: restrict access to specific people, set the role to Viewer, disable download, print, and copy where the tool allows it, and consider additional protections for anything time-sensitive.* A quick scenario: say you need to send a recent MRI report to a new specialist for a second opinion. Restrict the share to that doctor's email address, set the role to Viewer, disable downloading if the viewer supports it, and set the link to expire when access is no longer needed. That keeps the file visible only as long as it needs to be. ## How to track views and revoke access when you need to Check whether your sharing platform logs who opened a file and when, which can help you review who had access to a medical record. Check the activity or version history panel before and after sharing anything sensitive, and note the date, recipient, and reason for access somewhere you can retrieve it later. - Change a link's access level to Restricted when it is no longer needed. - Remove individual people from a shared file or folder rather than leaving a broad link active. - Re-check folder permissions after sharing, since adding a file to a previously shared folder can silently re-grant access you thought you had closed off. - Use separate, named accounts for each recipient so your audit trail clearly shows individual access, a point HHS guidance raises directly for accountability. Revocation is only reliable when you can see the full picture. If you manage caregiver access for a parent or dependent, our [guide to setting up caregiver access](https://medfiles.ai/en/articles/caregiver-access-medical-records) walks through granting and removing permissions step by step. ## A short HIPAA-aware checklist for sharing medical records Sharing a record does not transfer your responsibility for its security. HHS guidance is direct about this: once you grant access, you remain accountable for confirming the platform tracks who viewed what and when. **CISA recommends setting default sharing permissions to "View"** to prevent anonymous or unintended file changes through external sharing links, a practice worth applying to any folder holding health records. - Confirm the platform logs access by unique user ID, not a shared login, so you can trace exactly who viewed a record. - Default new shares to "specific people" rather than "anyone with the link," matching the scoped access that CISA's SharePoint guidance recommends. - Set folder and file permissions to View only as the default, not Editor, before you add anything sensitive. - If a family member asks you to forward their records to a third-party app, let them know that once data leaves a HIPAA-covered system for a third-party app at their request, the Privacy Rule no longer restricts how that app uses it. None of this requires technical expertise, just a habit of checking settings before you click share. ## What view-only controls can and cannot stop Disabling download, print, and copy options reduces accidental oversharing, but it cannot stop someone from taking a photo of their screen or retyping what they see. Google's own help documentation confirms these digital restrictions are not absolute protections against a determined recipient. - For highly sensitive results, consider an in-person review or a monitored clinician portal instead of an unsupervised link. - Add a watermark with the recipient's name to discourage casual screenshots. - Keep expiration windows short, often a matter of days, and require sign-in to a named account rather than an open link. **Pro Tip:** *Match the control to the stakes: a routine prescription list can travel as a simple view-only link, but a psychiatric evaluation or genetic test result deserves a monitored portal or a password-protected, short-lived link.* ## Our take on "view-only" as a security promise Plenty of people treat a view-only toggle like a lock on a door, something that makes a file safe once it is switched on. It is closer to a speed bump. It stops casual mistakes, like someone forwarding a file they shouldn't, but it was never built to stop a screenshot or a photo taken with a second phone. ![View-only limits sharing but cannot stop capture](https://media.babylovegrowth.ai/blog-images/organization-26020/1791860836238_View-only-limits-sharing-but-cannot-stop-capture.jpeg) The more useful mental shift is to stop asking "is this file locked down" and start asking "who can see this, for how long, and can I prove it." Audit logs and expiring access matter more than any single toggle, because they turn sharing into something you can track and undo, not just something you hope holds. Caregivers and patients who get this right tend to treat sharing settings the way they treat medication schedules: checked on a routine, not set once and forgotten. > *— Team* ## Secure sharing with MedFiles.ai MedFiles.ai offers [secure sharing](https://medfiles.ai/en/secure-sharing). Review the platform's security information and sharing settings to understand how records are protected and what access you can control. Before sharing with a caregiver, check whether the platform lets you limit their access to the records they need. ![Medfiles](https://csuxjmfbwmkxiegfpljm.supabase.co/storage/v1/object/public/blog-images/organization-26020/1775900480670_medfiles.jpg) Our [security and privacy page](https://medfiles.ai/en/security) details the encryption and access controls behind every share, and our [pricing page](https://medfiles.ai/en/pricing) explains the available plans. When you are ready for ongoing analysis and broader family sharing, see the current plans and prices at Medfiles. Explore the available account options and set up view-only sharing if the features meet your needs. This article is general information, not a substitute for advice from a qualified doctor. Consult a qualified healthcare professional about your own circumstances before acting on anything here. ## FAQ ### Why can't I see an album or record that was shared with me? The sender may have restricted the share to a specific email address that doesn't match the one you're using, or the link may have expired. Check that you're signed into the account the sender invited, and ask them to confirm the share is still active. ### Can you tell if someone has viewed your shared record? Many platforms log access by date, time, and user, which lets you confirm when a shared file was opened. This depends on the platform supporting unique user accounts and activity logs rather than anonymous link access. ### Can anyone see records I've shared, or only the people I choose? If you restrict sharing to specific people rather than "anyone with the link," only those named recipients can open the file. Setting the default to specific people, as CISA recommends, keeps access from spreading beyond who you intended. ### How do I see records that were shared with me? Check the shared or "shared with me" section of whichever platform the sender used, since most services place incoming shares in a dedicated folder. If you were invited by email, look for an access link in that message instead of searching your own account. ### Does MedFiles.ai keep a record of who viewed a shared file? Check the secure sharing page for information about MedFiles.ai's sharing and audit features. Specific logging detail varies by plan, so check the secure sharing page for current feature specifics. ## Sources - [Cisa](https://www.cisa.gov/resources-tools/services/bod-25-01-implementing-secure-practices-cloud-services-required-configurations) - [Hhs](https://www.hhs.gov/hipaa/for-professionals/security/guidance/cybersecurity-newsletter-summer-2021/index.html) - [Share files from Google Drive - Computer - Google Drive Help](https://support.google.com/drive/answer/2494822) ## Recommended - [U.S. Patients: Use HIPAA Rights to Upload and Secure Medical Records](https://medfiles.ai/en/articles/upload-medical-records) - [Set Up Caregiver Access to Medical Records in 5 Steps](https://medfiles.ai/en/articles/caregiver-access-medical-records) - [For Patients: Share Medical Records Online Fast With FHIR, SMART Links](https://medfiles.ai/en/articles/medical-record-sharing-online)42:T440c,

Patient setting access for a medical report

View-only settings can limit what someone can do with a shared medical record, but they cannot prevent every way of copying or forwarding it. Before you send anything, consider setting viewer-only permission, restricting access to named people, and turning on audit logging for small businesses. CISA and HHS both back this approach, and a platform with suitable access controls and audit logging can help you manage sharing.

TL;DR:

Set folders to Viewer before uploading, then inspect each file individually, because inherited permissions can restore broader access without warning.

Restrict each share to named recipients, use separate accounts, and confirm the platform records who opened files and when before relying on its audit trail.

Disabling downloads, printing, and copying reduces casual sharing but cannot stop screenshots, screen photographs, or retyping; use a monitored portal for highly sensitive results.

For temporary access, require sign in to a named account, set an expiration date, and revoke access or remove recipients once sharing ends.

After records go to a third party app at a family member’s request, HIPAA’s Privacy Rule no longer limits how that app uses them.

Medfiles

Keep Medical Records Organized for Sharing

MedFiles securely stores and organizes medical documents, with sharing capabilities for healthcare providers and family members when records need to be accessed.

Visit MedFiles

How view-only permissions actually work
Practical ways to create a view-only share
How to track views and revoke access when you need to
A short HIPAA-aware checklist for sharing medical records
What view-only controls can and cannot stop
Our take on “view-only” as a security promise
Secure sharing with MedFiles.ai
FAQ
Sources

How view-only permissions actually work

Google Drive offers Viewer, Commenter, and Editor permission levels. A Viewer can open and read a file but cannot change it, add notes, or (when configured correctly) download or print it. A Commenter can leave notes without altering the original. An Editor can change the file outright, which is never the right choice for sharing a lab report or imaging scan.

Turning off download, print, and copy inside the document viewer blocks casual copying, but it will not stop someone determined to capture the screen. That distinction matters when you decide how sensitive a given record is.

Folder permissions matter as much as file permissions. When you drop a new file into a folder, it typically inherits that folder’s sharing settings. If the folder defaults to Editor access, every new file you add inherits that same open access, even if you meant to share it narrowly.

Set the folder’s default permission to View only before adding sensitive files.
Use unique, named user accounts instead of shared logins, so an activity log can show exactly who opened a file and when.
Check each file individually after adding it to a shared folder, since inherited permissions can silently override your intent.

You do not need special software to lock a record down to viewing only. The steps below work across most common file and cloud platforms.

Share a single file as Viewer. Open the sharing menu, select the specific people you want, set their role to Viewer, and avoid “anyone with the link” when you want to restrict access to specific people.
Set folder-level defaults to View only. Before uploading a batch of records, change the folder’s sharing settings so every new file defaults to Viewer access rather than Editor.
Use expiring links and passwords for temporary access. Google Drive’s sharing settings let you assign a Viewer role and, on some file types, disable downloading, printing, and copying for that recipient.
Use a HIPAA-ready record platform for ongoing sharing. Look for access controls, audit logs, and the ability to revoke access instantly, since these features matter more as you share records repeatedly with providers or family.

Pro Tip: Before you hit send, run through these settings: restrict access to specific people, set the role to Viewer, disable download, print, and copy where the tool allows it, and consider additional protections for anything time-sensitive.

A quick scenario: say you need to send a recent MRI report to a new specialist for a second opinion. Restrict the share to that doctor’s email address, set the role to Viewer, disable downloading if the viewer supports it, and set the link to expire when access is no longer needed. That keeps the file visible only as long as it needs to be.

How to track views and revoke access when you need to

Check whether your sharing platform logs who opened a file and when, which can help you review who had access to a medical record. Check the activity or version history panel before and after sharing anything sensitive, and note the date, recipient, and reason for access somewhere you can retrieve it later.

Change a link’s access level to Restricted when it is no longer needed.
Remove individual people from a shared file or folder rather than leaving a broad link active.
Re-check folder permissions after sharing, since adding a file to a previously shared folder can silently re-grant access you thought you had closed off.
Use separate, named accounts for each recipient so your audit trail clearly shows individual access, a point HHS guidance raises directly for accountability.

Revocation is only reliable when you can see the full picture. If you manage caregiver access for a parent or dependent, our guide to setting up caregiver access walks through granting and removing permissions step by step.

Sharing a record does not transfer your responsibility for its security. HHS guidance is direct about this: once you grant access, you remain accountable for confirming the platform tracks who viewed what and when.

CISA recommends setting default sharing permissions to “View” to prevent anonymous or unintended file changes through external sharing links, a practice worth applying to any folder holding health records.

Confirm the platform logs access by unique user ID, not a shared login, so you can trace exactly who viewed a record.
Default new shares to “specific people” rather than “anyone with the link,” matching the scoped access that CISA’s SharePoint guidance recommends.
Set folder and file permissions to View only as the default, not Editor, before you add anything sensitive.
If a family member asks you to forward their records to a third-party app, let them know that once data leaves a HIPAA-covered system for a third-party app at their request, the Privacy Rule no longer restricts how that app uses it.

None of this requires technical expertise, just a habit of checking settings before you click share.

What view-only controls can and cannot stop

Disabling download, print, and copy options reduces accidental oversharing, but it cannot stop someone from taking a photo of their screen or retyping what they see. Google’s own help documentation confirms these digital restrictions are not absolute protections against a determined recipient.

For highly sensitive results, consider an in-person review or a monitored clinician portal instead of an unsupervised link.
Add a watermark with the recipient’s name to discourage casual screenshots.
Keep expiration windows short, often a matter of days, and require sign-in to a named account rather than an open link.

Pro Tip: Match the control to the stakes: a routine prescription list can travel as a simple view-only link, but a psychiatric evaluation or genetic test result deserves a monitored portal or a password-protected, short-lived link.

Our take on “view-only” as a security promise

Plenty of people treat a view-only toggle like a lock on a door, something that makes a file safe once it is switched on. It is closer to a speed bump. It stops casual mistakes, like someone forwarding a file they shouldn’t, but it was never built to stop a screenshot or a photo taken with a second phone.

View-only limits sharing but cannot stop capture

The more useful mental shift is to stop asking “is this file locked down” and start asking “who can see this, for how long, and can I prove it.” Audit logs and expiring access matter more than any single toggle, because they turn sharing into something you can track and undo, not just something you hope holds.

Caregivers and patients who get this right tend to treat sharing settings the way they treat medication schedules: checked on a routine, not set once and forgotten.

— Team

MedFiles.ai offers secure sharing. Review the platform’s security information and sharing settings to understand how records are protected and what access you can control. Before sharing with a caregiver, check whether the platform lets you limit their access to the records they need.

Medfiles

Our security and privacy page details the encryption and access controls behind every share, and our pricing page explains the available plans. When you are ready for ongoing analysis and broader family sharing, see the current plans and prices at Medfiles. Explore the available account options and set up view-only sharing if the features meet your needs.

This article is general information, not a substitute for advice from a qualified doctor. Consult a qualified healthcare professional about your own circumstances before acting on anything here.

FAQ

Why can’t I see an album or record that was shared with me?

The sender may have restricted the share to a specific email address that doesn’t match the one you’re using, or the link may have expired. Check that you’re signed into the account the sender invited, and ask them to confirm the share is still active.

Can you tell if someone has viewed your shared record?

Many platforms log access by date, time, and user, which lets you confirm when a shared file was opened. This depends on the platform supporting unique user accounts and activity logs rather than anonymous link access.

Can anyone see records I’ve shared, or only the people I choose?

If you restrict sharing to specific people rather than “anyone with the link,” only those named recipients can open the file. Setting the default to specific people, as CISA recommends, keeps access from spreading beyond who you intended.

How do I see records that were shared with me?

Check the shared or “shared with me” section of whichever platform the sender used, since most services place incoming shares in a dedicated folder. If you were invited by email, look for an access link in that message instead of searching your own account.

Does MedFiles.ai keep a record of who viewed a shared file?

Check the secure sharing page for information about MedFiles.ai’s sharing and audit features. Specific logging detail varies by plan, so check the secure sharing page for current feature specifics.

Sources

1b:[null,null,["$","$L40",null,{"article":{"id":967580,"title":"View Only Medical Record Sharing: 4 Steps, but Screenshots Still Work","slug":"view-only-record-sharing","languageCode":"en","content_markdown":"$41","content_html":"$42","meta_description":"Share medical records with viewer access, named recipients, and audit logs. Use HIPAA aware checks, revoke access, and learn what controls cannot stop.","excerpt":"View Only Medical Record Sharing: 4 Steps, but Screenshots Still Work\n\n! Patient setting access for a medical report\n\nView-only settings can limit what someone can do with a shared medical record, but they cannot prevent every way of copying or forwarding it.","hero_image_url":"https://media.babylovegrowth.ai/blog-images/organization-26020/1791860832408_Patient-setting-access-for-a-medical-report.jpeg","orgWebsite":"https://medfiles.ai","created_at":"2026-10-13T03:07:33.797Z","updated_at":"2026-10-13T03:07:38.235Z","published_at":"2026-10-13T03:07:33.797Z","published":false,"published_url":"","seedKeyword":"view-only record sharing","keywords":["revoke access to shared records","revoke medical record access","view-only permissions","restricted access sharing","read-only file sharing","how to share records securely","view-only data access","document sharing restrictions","view-only record sharing","best practices for document sharing","data privacy in record sharing"],"jsonLd":null,"faqJsonLd":null}}]] 1e:null 24:[["$","title","0",{"children":"View Only Medical Record Sharing: 4 Steps, but Screenshots Still Work | MedFiles.ai"}],["$","meta","1",{"name":"description","content":"Share medical records with viewer access, named recipients, and audit logs. Use HIPAA aware checks, revoke access, and learn what controls cannot stop."}],["$","meta","2",{"name":"keywords","content":"medical history,digital health,medical documents,telemedicine,clinical records,personal health,historial médico,salud digital"}],["$","link","3",{"rel":"canonical","href":"https://medfiles.ai/pt/articles/view-only-record-sharing"}],["$","link","4",{"rel":"alternate","hrefLang":"es","href":"https://medfiles.ai/es/articles/view-only-record-sharing"}],["$","link","5",{"rel":"alternate","hrefLang":"en","href":"https://medfiles.ai/en/articles/view-only-record-sharing"}],["$","link","6",{"rel":"alternate","hrefLang":"pt","href":"https://medfiles.ai/pt/articles/view-only-record-sharing"}],["$","link","7",{"rel":"alternate","hrefLang":"fr","href":"https://medfiles.ai/fr/articles/view-only-record-sharing"}],["$","link","8",{"rel":"alternate","hrefLang":"ca","href":"https://medfiles.ai/ca/articles/view-only-record-sharing"}],["$","link","9",{"rel":"alternate","hrefLang":"x-default","href":"https://medfiles.ai/en/articles/view-only-record-sharing"}],["$","meta","10",{"property":"og:title","content":"View Only Medical Record Sharing: 4 Steps, but Screenshots Still Work"}],["$","meta","11",{"property":"og:description","content":"Share medical records with viewer access, named recipients, and audit logs. Use HIPAA aware checks, revoke access, and learn what controls cannot stop."}],["$","meta","12",{"property":"og:site_name","content":"MedFiles.ai"}],["$","meta","13",{"property":"og:image","content":"https://media.babylovegrowth.ai/blog-images/organization-26020/1791860832408_Patient-setting-access-for-a-medical-report.jpeg"}],["$","meta","14",{"property":"og:image:alt","content":"View Only Medical Record Sharing: 4 Steps, but Screenshots Still Work"}],["$","meta","15",{"property":"og:type","content":"article"}],["$","meta","16",{"property":"article:published_time","content":"2026-10-13T03:07:33.797Z"}],["$","meta","17",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","18",{"name":"twitter:title","content":"View Only Medical Record Sharing: 4 Steps, but Screenshots Still Work"}],["$","meta","19",{"name":"twitter:description","content":"Share medical records with viewer access, named recipients, and audit logs. Use HIPAA aware checks, revoke access, and learn what controls cannot stop."}],["$","meta","20",{"name":"twitter:image","content":"https://media.babylovegrowth.ai/blog-images/organization-26020/1791860832408_Patient-setting-access-for-a-medical-report.jpeg"}],["$","link","21",{"rel":"shortcut icon","href":"/favicon.ico"}],["$","link","22",{"rel":"icon","href":"/favicon.ico","sizes":"48x48"}],["$","link","23",{"rel":"icon","href":"/favicon.png","type":"image/png","sizes":"any"}],["$","link","24",{"rel":"icon","href":"/favicon.png","type":"image/png","sizes":"32x32"}],["$","link","25",{"rel":"icon","href":"/favicon.png","type":"image/png","sizes":"16x16"}],["$","link","26",{"rel":"apple-touch-icon","href":"/apple-touch-icon.png","sizes":"180x180","type":"image/png"}],["$","$L43","27",{}]]