When a doctor closes their practice, the medical records don’t disappear — someone becomes their custodian, and your job is to find that person and send a written request. To get medical records from a doctor who closed, start by identifying who took over the files (a successor practice, a hospital system, a professional records custodian, or the physician’s estate), then submit a HIPAA right-of-access request in writing. If no one will produce your records, your state medical board and the federal Office for Civil Rights are the escalation points.
Track Down Who Has the Records
Begin with the office itself. Closed practices often post a notice on the door or change the phone recording to name the new custodian. If the doctor joined another practice or a hospital system absorbed the office, that organization likely took the patient files along with the business.
Check your mail and email. Physicians are expected to notify active patients before closing, and that notice usually names the custodian and explains how to request a transfer. Search online for the doctor’s name with “closed” or “retired.” Old practice websites can sometimes be viewed through the Wayback Machine at archive.org, and local news or community health boards occasionally list forwarding details.
If none of that works, contact your state medical board. Physicians are required to notify the board when closing a practice, and boards often keep information about where records were sent or can provide the physician’s address of record. Have the doctor’s full name, the practice name if different, and the approximate dates you were a patient. The board can also confirm whether the license is still active, which sometimes reveals that the doctor simply relocated.
If the Doctor Died or Went Bankrupt
A physician’s death changes the trail. If another doctor took over the practice, the new provider inherited the records. If no one did, the files may be held by the deceased doctor’s estate. Your local probate court can identify the executor, who can then be asked for the records. Depending on how much time has passed, the estate may have arranged for storage — or, if retention periods have lapsed, destruction.
In bankruptcy, a court-appointed trustee manages the practice’s assets, which can include patient files. The trustee’s contact information is part of the public bankruptcy filing, searchable through the federal PACER system or available from the local bankruptcy court clerk. Professional records custodians sometimes step in during these transitions to maintain access and legal compliance.
Whether Your Records Still Exist
The older your records, the less certain their survival. HIPAA itself sets no minimum retention period; state law does, and the periods vary. Most states require adult records to be kept somewhere between five and seven years after the last date of service, though some states set no specific statutory minimum for physicians.1U.S. Department of Health and Human Services. Does the HIPAA Privacy Rule Require Covered Entities to Keep Patients’ Medical Records for Any Period of Time? Pediatric records are typically kept longer, often until the child reaches the age of majority plus additional years, which can mean 10 to 20 years after the date of service.
A separate federal rule covers Medicare. Any physician or supplier who billed Medicare must keep documentation for seven years from the date of service.2eCFR. 42 CFR 424.516 – Additional Provider and Supplier Requirements for Enrolling and Maintaining Active Enrollment Status in the Medicare Program That floor can outlast a shorter state requirement, so Medicare patients may have a longer window to retrieve records.
If the practice closed recently, move quickly. If it closed a decade ago, be prepared for the possibility that the records were legally destroyed.
Send a Written Request
Once you know who has the files, submit a written request. Under HIPAA, you have a right of access to your own protected health information, and the process is simpler than many people expect.
What to Include
You do not need to fill out a formal HIPAA authorization form to get your own records. An authorization is designed for third-party disclosures, and HHS guidance says requiring one for a patient’s own access request creates an impermissible barrier.3U.S. Department of Health and Human Services. Individuals’ Right Under HIPAA to Access Their Health Information A signed written request that identifies you and describes the records you want is enough. Include your full name, date of birth, the approximate dates of service, and where you want the copies sent. If you want the records directed to a new doctor, name that person and their address.4U.S. Department of Health and Human Services. Can an Individual, Through the HIPAA Right of Access, Have His or Her PHI Sent to a Third Party?
Many custodians offer their own request form. Using it is fine and can speed things up, but you are not legally required to use a specific form. If a custodian insists you complete an authorization or add extra steps, that itself may be a HIPAA violation.
What It Costs
The custodian can charge a reasonable, cost-based fee for the labor of copying, supplies like paper or a USB drive, and postage. They cannot bill you for searching for or retrieving the records.5U.S. Department of Health and Human Services. How Can Covered Entities Calculate the Limited Fee For electronic copies of records maintained electronically, custodians have the option of charging a flat fee of no more than $6.50 instead of calculating actual costs.6U.S. Department of Health and Human Services. Clarification of Permissible Fees for HIPAA Right of Access Paper copies typically cost more; per-page rates vary by state, roughly $0.25 to $1.00 or more per page, plus postage. To keep costs down, request electronic copies.
How Long They Have to Respond
The custodian must act on your request within 30 days of receiving it. They can take one 30-day extension, but only if they notify you in writing with the reason for the delay and the date you can expect a response.7eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information The outer limit is 60 days. If nothing arrives after 30 days, follow up in writing and cite the HIPAA deadline. Send your request by certified mail or through a secure portal so you have proof of delivery — that’s what starts the clock.
Psychotherapy Notes
One narrow exception applies. Psychotherapy notes — a therapist’s private session-by-session observations, kept separate from the main record — are not covered by the HIPAA right of access. A provider may share them voluntarily but is not required to. Everything else in a mental health file, including diagnoses, treatment plans, medication records, progress summaries, session dates, and test results, is part of your standard medical record and carries the same right of access as any other health information.
Records of a Deceased Patient
If the patient has died, HIPAA protects their information for 50 years after death. During that period, the personal representative — typically the executor or administrator of the estate, or whoever has legal authority under state law — can exercise the same access rights the patient would have had.8U.S. Department of Health and Human Services. Health Information of Deceased Individuals Family members involved in the person’s care may receive limited information relevant to that involvement, unless the deceased had told the provider otherwise. Broader access generally requires establishing legal authority through probate and presenting documentation to the custodian.
If the Records Are Gone
Sometimes the files no longer exist. The retention period ran out, no custodian can be found, or a disaster destroyed them. You are not starting from zero. Several sources may hold pieces of your history:
- Specialists, hospitals, labs, and urgent care clinics you visited often keep referral letters, test results, imaging, and care summaries from your primary doctor.
- Your health insurance company maintains claims data showing dates of service, procedures, diagnoses billed, and prescriptions filled. It won’t replace clinical notes but creates a timeline.
- Pharmacies keep a prescription history that can go back many years — useful for chronic conditions.
- Many states operate Health Information Exchanges that aggregate clinical data across providers. Ask your state health department or a current provider whether an exchange covers your area and whether your former doctor participated.
- If you had access to a patient portal through the closed practice, check whether it is still active. Some portals are hosted by third-party vendors and retain data after a practice shuts down. Download everything you can.
If the Custodian Refuses or Ignores You
If a custodian ignores your request, misses the deadline, or charges unreasonable fees, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. OCR investigates HIPAA violations against covered entities and their business associates, including records custodians acting on a provider’s behalf.9U.S. Department of Health & Human Services. OCR Complaint Portal
File within 180 days of when you knew or should have known the violation occurred; OCR can waive the deadline for good cause.10eCFR. 45 CFR 160.306 – Complaints to the Secretary The complaint must be in writing and can be submitted through the OCR portal. Name the entity that refused access and describe what happened. OCR has pursued dozens of enforcement actions specifically against providers and custodians who failed to hand over patient records, with settlements requiring financial penalties and corrective action plans.11U.S. Department of Health and Human Services. Five Enforcement Actions Hold Healthcare Providers Accountable for HIPAA Right of Access Mentioning that you intend to file a complaint sometimes resolves the problem before it gets that far.