To request your medical records, contact the provider’s medical records or health information management department, fill out their authorization form, and specify what you want and how you want to receive it. Federal law under the HIPAA Privacy Rule gives you the right to inspect and get copies of records held by any doctor, hospital, clinic, or health plan, and the provider has 30 calendar days to respond.1U.S. Department of Health and Human Services. Individuals’ Right under HIPAA to Access their Health Information Knowing how to request your medical records the right way, and what to do when a provider drags its feet, is what turns a frustrating process into a routine one.
How to Submit the Request
Start with the provider’s medical records department, health information management office, or patient services desk. Most providers post an authorization form on their website or keep one at the front desk. You’ll be asked for your full name, date of birth, and contact information.
Specifying the date range and the types of records you want speeds things up and can reduce your bill if you only need part of your chart. You can usually submit the completed form by mail, fax, in person, or through a secure patient portal.
HIPAA does not itself require a written request, but providers are allowed to require one as long as they tell you.2eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information Nearly all of them do, so expect to sign a form.
Choosing Your Format
You pick how you receive the records. If your records are stored electronically and you ask for an electronic copy, the provider must give it to you in the electronic format you request, as long as it’s readily producible. If not, you and the provider agree on a readable electronic alternative.2eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information You can also request paper copies or ask to inspect the records in person without taking any home.
Sending Records to Someone Else
You can direct a provider to send your records straight to a third party: a new doctor, an attorney, an insurer, or a health app. The request must be in writing, signed by you, and clearly identify the recipient and where to send the copy.3eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information A provider cannot refuse just because the records are going to a third party rather than to you.
What You Can and Can’t Get
Your request covers what HIPAA calls the “designated record set,” meaning everything the provider uses to make decisions about your care: clinical notes, lab results, imaging reports, referral letters, treatment plans, and billing and claims information.4eCFR. 45 CFR 164.501 – Definitions From a health plan, you can also access enrollment, payment, and claims processing information.
Two things are excluded. Psychotherapy notes are a mental health professional’s personal notes about counseling sessions, kept separate from the rest of the chart. The exclusion is narrow: prescription records, session start and stop times, treatment frequency, test results, and diagnosis or progress summaries are not psychotherapy notes and remain accessible.5GovInfo. 45 CFR 164.501 – Definitions Information gathered in anticipation of a lawsuit or other legal proceeding is also excluded.2eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
What It Costs
Providers can charge a reasonable, cost-based fee. Allowable charges include the labor to copy the records, paper or electronic media, postage if you want mailed copies, and the cost of preparing a summary if you agreed to receive one instead of the full file.2eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information The fee cannot include staff time spent searching for and pulling your records.
For electronic copies of records already stored electronically, HHS offers a simpler option: providers can skip the cost calculation and charge a flat fee of no more than $6.50 per request, which covers labor, supplies, and postage combined.6U.S. Department of Health and Human Services. Is $6.50 the Maximum Amount That Can Be Charged That $6.50 is not a universal cap. Paper copies or records requiring more involved processing may cost more depending on the provider’s actual expenses. Some state laws set their own per-page fee limits for paper copies, generally in the range of $0.25 to $1.00 per page.
How Long the Provider Has to Respond
The provider has 30 calendar days from receiving your request to act on it, which means either giving you the records or issuing a written denial.7U.S. Department of Health and Human Services. How Timely Must a Covered Entity Be in Responding to Individuals’ Requests for Access to Their PHI
If the provider cannot meet that deadline, it may take one additional 30-day extension, but only by sending you a written explanation of the delay and a specific date by which you’ll receive the records. That notice has to reach you inside the original 30-day window. The extension is available only once per request.7U.S. Department of Health and Human Services. How Timely Must a Covered Entity Be in Responding to Individuals’ Requests for Access to Their PHI
Getting Records Through a Patient Portal
For most routine requests, the fastest route is your provider’s patient portal. Since April 2021, the 21st Century Cures Act has prohibited health care providers, health IT developers, and health information networks from engaging in “information blocking,” meaning they cannot unreasonably interfere with your ability to access, exchange, or use your electronic health information.8HealthIT.gov. Information Blocking That’s why most health systems now release lab results, imaging reports, and clinical notes directly to portals without delay.
If your test results appear online before your doctor calls to discuss them, the Cures Act is why. There are narrow exceptions, such as preventing harm to a patient, but the default is immediate electronic access.
If a Provider Denies Your Request
Denials are uncommon for routine requests, but they happen. HIPAA splits denial reasons into two groups based on whether you can appeal.
Denials You Cannot Appeal
A provider can deny access without any review process for psychotherapy notes and litigation materials, for research participants who agreed to suspend access during a clinical trial that includes treatment, for inmates when release would threaten facility safety or security, for federal Privacy Act records held by a federal agency, and when releasing information would reveal a confidential source who provided it under a promise of confidentiality.2eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
Denials You Can Appeal
In three situations, a provider may deny access but must offer review by a different licensed health care professional who was not involved in the original decision. Those situations are when a clinician determines that giving you the records is reasonably likely to endanger the life or physical safety of you or someone else; when the records reference another person (not a provider) and release would likely cause that person substantial harm; and when a clinician believes giving the records to your personal representative would likely cause substantial harm to you or someone else.
In each case, the provider must give you a written denial explaining the reason and telling you how to request review.3eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information The reviewing professional’s decision is binding. If they disagree with the original denial, the provider must grant access.
If You’re Ignored or Overcharged
This is where many people give up. If a provider misses the 30-day deadline (or the 60-day deadline with an extension) without giving you records or a written denial, that’s a HIPAA violation. So is charging excessive fees, demanding an inconvenient format, or simply going silent on follow-up calls.
Put your complaint in writing to the provider’s privacy officer or compliance department. Reference the right of access under 45 CFR 164.524 and include the date of your original request. A written escalation often produces results within a week or two because privacy officers know what’s at stake. HHS has resolved over 25 enforcement actions specifically targeting providers that failed to honor access requests.9U.S. Department of Health and Human Services. Five Enforcement Actions Hold Healthcare Providers Accountable
If the provider still won’t respond, file a complaint with the Office for Civil Rights (OCR) at HHS. The complaint must be filed within 180 days of when you learned about the violation, though OCR can extend that deadline for good cause. You can submit it online through the OCR Complaint Portal at ocrportal.hhs.gov, by email to OCRComplaint@hhs.gov, or by mail. Include your contact information, the name and address of the provider, and a description of what happened and when. A provider cannot retaliate against you for filing a complaint; if it does, tell OCR right away.10U.S. Department of Health and Human Services. How to File a Health Information Privacy or Security Complaint
Fixing Errors You Find
Once you have your records, you may spot a wrong medication, an incorrect diagnosis, or a procedure logged on the wrong date. HIPAA gives you the right to request an amendment. The provider has 60 days to act on the request, with one possible 30-day extension if it sends you a written explanation of the delay.11eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
If the provider accepts your amendment, the original information isn’t deleted. The correction gets appended so both versions are visible. The provider may require the request in writing and ask you to explain why the change is warranted.
Providers can deny an amendment in four situations: the information wasn’t created by that provider (and the original creator is available to make the change), the information isn’t part of your designated record set, the information isn’t accessible to you under HIPAA’s right of access, or the provider determines the existing information is already accurate and complete.11eCFR. 45 CFR 164.526 – Amendment of Protected Health Information If your amendment is denied, the provider must tell you in writing and explain how to file a statement of disagreement, which then travels with your record going forward.