Yes, a doctor can request your medical records from another doctor, and in most cases they don’t even need your written permission to do it. Federal privacy law specifically allows health care providers to share patient records with other providers for treatment purposes without requiring a signed authorization form from the patient.
What HIPAA Actually Allows
The HIPAA Privacy Rule, under 45 CFR 164.506, permits a health care provider to disclose your protected health information to another provider who is treating you, without your written authorization. This is part of what’s known as the “treatment, payment, and health care operations” exception. In practical terms, it means your primary care doctor can send your records to a specialist, a surgeon can request your imaging from a radiologist, or a new physician can pull your history from a previous one, all without you signing a release form.
HHS has addressed this directly in its official guidance: a physician does not need a patient’s written authorization to send a copy of the patient’s medical record to a specialist or other health care provider who will treat the patient. The key requirement is that the disclosure must be for treatment purposes. If a doctor requests your records for a reason unrelated to your care, such as research or marketing, a signed authorization would be needed.
When Written Authorization Is Required
There are important exceptions where your explicit consent is necessary, even for treatment-related sharing.
Psychotherapy notes are the most notable exception. These are a therapist’s personal notes documenting the content of private counseling sessions, and they’re kept separate from the rest of your medical record. Because of their sensitive nature, HIPAA requires your written authorization before they can be shared with another provider, even one who is treating you. It’s worth knowing what psychotherapy notes don’t include: medication records, session dates and times, diagnoses, treatment plans, and clinical test results. All of that can still be shared under the standard treatment exception.
Substance use disorder treatment records have their own stricter federal protections under 42 CFR Part 2. These records can only be used or disclosed as permitted by that regulation, and historically required patient consent for most sharing. Recent updates have brought these rules closer to standard HIPAA, but they still carry additional restrictions, particularly around use in legal proceedings against a patient. If you’ve received treatment for a substance use disorder, your provider generally needs your written consent before sharing those specific records with another doctor.
How Records Move Between Doctors
Most record transfers today happen electronically through one of two main systems. Directed exchange works like secure email: one provider sends specific information (lab results, referral notes, discharge summaries) directly to another provider’s system. Query-based exchange allows a provider to search for and request a patient’s records from other sources, which is especially useful in urgent or unplanned care situations where there’s no time for a formal request.
When both providers use compatible electronic health record systems, the data can integrate directly into the receiving doctor’s system without anyone re-entering information. In practices that haven’t fully adopted interoperable systems, records still move by fax, secure portal, or even physical mail.
Doctors Can’t Refuse Without Reason
The 21st Century Cures Act introduced the concept of “information blocking,” which makes it illegal for health care providers to knowingly and unreasonably interfere with the access, exchange, or use of electronic health information. If your previous doctor’s office drags its feet or refuses to send records to your new provider without a valid reason, that could qualify as information blocking. HHS finalized a rule in 2024 establishing specific disincentives for providers found to have committed information blocking. Health IT developers and health information networks face civil penalties of up to $1 million per violation.
How Long a Transfer Can Take
Under HIPAA, a provider has 30 calendar days to fulfill a records request. If the records are archived offsite or otherwise not readily accessible, they can extend that deadline by an additional 30 days, but they must notify the requesting party in writing within the initial 30-day window explaining the delay. Only one extension is allowed per request. Some states have shorter deadlines that override the federal timeline, so the turnaround you experience depends partly on where you live.
In practice, electronic transfers between providers on the same system can happen within hours. Transfers between unconnected systems or paper-based offices tend to take days to a few weeks.
Fees for Record Transfers
Whether your old doctor can charge for sending records varies by state. Some states cap per-page fees and explicitly prohibit administrative surcharges. Nevada, for example, limits photocopying costs to 60 cents per page plus actual postage and bars any additional service fees. Other states have different caps or no specific limits beyond HIPAA’s general requirement that fees be reasonable and cost-based. When the transfer is doctor-to-doctor for treatment purposes, many practices handle it at no charge, but there’s no universal federal rule preventing a fee.
What You Can Do to Speed Things Up
Even though your new doctor can legally request records without your signed authorization, the process often goes faster when you’re involved. Before your first appointment with a new provider, call your previous doctor’s office and let them know a request is coming. Ask whether they need you to fill out their own release form, since many offices have internal policies that go beyond what HIPAA strictly requires. Provide your new doctor’s full name, office address, fax number, and phone number to the releasing office.
If you’re switching providers, request your records yourself as a backup. You have an independent right under HIPAA to get a copy of your own medical records, and you can direct that they be sent to any provider you choose. The same 30-day (or 60-day with extension) timeline applies. Having a copy in hand when you walk into a new doctor’s office eliminates the waiting game entirely.