You have a federal right to access your medical records, and the process is simpler than most people expect. In many cases, you can download them instantly through an online patient portal. When that’s not an option, a written or in-person request to your provider’s office will get the job done, typically within 30 days.
Your Legal Right to Your Records
The HIPAA Privacy Rule gives every patient the right to see and obtain a copy of their health information. This applies to all forms of your records, whether electronic, on paper, or even verbal. Providers and health insurers covered by HIPAA must let you request copies, ask for corrections, and learn how your information has been shared.
A separate federal law, the 21st Century Cures Act, goes further by making it illegal for providers to block your access to electronic health information. Healthcare providers who knowingly interfere with access to your records face federal disincentives, and health IT companies can be fined up to $1 million per violation. In practical terms, this means your doctor’s office cannot drag its feet or create unnecessary barriers when you ask for your records electronically.
Start With Your Patient Portal
The fastest route is checking whether your provider has an online patient portal. Most hospitals and large practices now offer one, and you can typically view lab results, visit summaries, immunization records, medication lists, and clinical notes without making a formal request. If you haven’t set up your portal account, your provider’s front desk or website can walk you through enrollment.
If the records you need aren’t available through the portal, or your provider doesn’t offer one, you have several other options. Check the provider’s website for instructions, often found under “Contact Us” or “Medical Records.” You can also call the office and ask for the health information services department or the administrative staff who handle record releases. If you visit in person, bring a photo ID like a driver’s license.
How to Make a Formal Request
The exact steps depend on the provider, but the process generally follows the same pattern. You’ll fill out a medical record release form (sometimes called a “request for access” form), which asks for your name, date of birth, the date range of records you want, and where to send them. Some offices accept this by email, fax, or mail. Others require you to submit it through the patient portal or in person.
If you want your records sent directly to you in the format they’re already stored in (usually electronic), the process is straightforward. But if you want paper records or records sent to another person, you’ll need to complete a separate authorization form. This distinction matters because it affects both the cost and the timeline.
Sending Records to Another Doctor
When you switch providers or see a specialist, you’ll often need records transferred directly. The process is the same as requesting records for yourself: contact the office that holds your records, fill out a release form, and specify the name and address of the new provider. Calling ahead is a good idea so you can confirm what they need from you and whether there’s a fee.
Your new provider’s office may also initiate the transfer on your behalf if you sign their intake authorization form. Either way, plan ahead. If you have an upcoming appointment with a new doctor, request the transfer at least a few weeks in advance so the records arrive in time.
How Long Providers Have to Respond
Under HIPAA, a provider must act on your request within 30 calendar days of receiving it. If they can’t meet that deadline, they’re allowed one extension of up to 30 additional days, but only if they notify you in writing during that first 30-day window. The notice must explain the reason for the delay and give you a specific date by which they’ll fulfill the request.
One important caveat: when you authorize records to be sent to another person and those records are stored on paper or in a non-electronic format, the standard HIPAA deadline doesn’t apply. If speed matters, request electronic copies whenever possible.
What It Costs
Providers can charge you for copies of your records, but the fees are limited. For electronic copies of records that are already stored electronically, many providers use a flat fee of up to $6.50. This option exists so offices don’t have to calculate their actual copying costs for every request. Providers who prefer to itemize can charge for labor, supplies, and postage, but not for things like searching through files or retrieving records from storage.
Fees vary by state as well, since some states set their own caps that may be lower than what HIPAA allows. It’s worth asking about costs before you submit your request so there are no surprises. If a provider quotes you a fee that seems excessive, you can file a complaint with the U.S. Department of Health and Human Services.
When a Provider Can Deny Access
Your right to your records is broad, but it’s not unlimited. There are a few situations where a provider can legally say no:
- Psychotherapy notes. These are a therapist’s personal session notes kept separate from your main medical record. You don’t have an automatic right to these, though you can still access all other mental health records in your chart.
- Legal proceedings. Information compiled specifically for use in a lawsuit or legal action can be withheld, though you retain the right to the underlying health records that information was drawn from.
- Safety concerns. A licensed provider can deny access if, in their professional judgment, releasing the records is reasonably likely to endanger your life or physical safety, or someone else’s. General worries that you might be upset or confused by the information are not enough to justify a denial.
If your request is denied, the provider must explain why in writing, and you have the right to have that decision reviewed by another licensed professional.
Accessing a Deceased Relative’s Records
If a family member has died, their medical records don’t become publicly available, but the person legally authorized to manage their affairs can access them. This is typically the executor or administrator of the estate, or someone otherwise authorized under state law to act on behalf of the deceased person. Under HIPAA, the provider must treat this personal representative the same way they would treat the patient, granting access to records that fall within the scope of their legal authority.
You’ll need to provide documentation proving your role, such as letters testamentary, a court appointment, or a power of attorney that was in effect before death. Contact the provider’s medical records department to find out exactly which documents they require.
Records for Minor Children
Parents generally act as their child’s personal representative under HIPAA and can access the child’s medical records. But there are three situations where this doesn’t apply. First, if state law allows a minor to consent to certain care without parental permission (common for mental health services, reproductive health, or substance use treatment), the parent may not have access to records related to that specific care. Second, if a child receives care at the direction of a court, the parent isn’t considered the personal representative for those records. Third, if a parent has agreed to a confidential relationship between the child and provider, the scope of that agreement limits what the parent can see.
These exceptions vary significantly by state. Some states set specific ages at which minors gain confidentiality rights for certain services, while others leave it to provider discretion. Providers can also withhold records from a parent if they have a reasonable belief that the child has been or may be subjected to abuse, neglect, or domestic violence, or that sharing the records could endanger the child.