You have a federal right to obtain copies of your mental health records. Under HIPAA’s Privacy Rule, any healthcare provider or insurer that falls under federal regulations must let you request, inspect, and receive copies of your health information, including mental health treatment records. The process is straightforward in most cases, though mental health records have a few unique wrinkles worth understanding before you start.
What You’re Entitled To
Your mental health records include diagnoses, treatment plans, medication lists, session dates, clinical assessments, lab results, and any correspondence between providers about your care. If it’s in your medical chart, you can generally request a copy of it.
There is one major exception: psychotherapy notes. These are a therapist’s or psychiatrist’s personal notes taken during or after a session, kept separate from the rest of your medical file. Under HIPAA, providers can categorically deny access to psychotherapy notes without review, and patients have no right to appeal that denial. This distinction matters because many people assume “mental health records” includes everything their therapist wrote down. It doesn’t. Psychotherapy notes are legally separate from your treatment record, which contains the clinical information you do have a right to access.
How to Submit Your Request
Start by contacting the provider’s office, hospital, or clinic where you received treatment. Most facilities have a medical records department or a health information management office. You’ll typically need to fill out a written authorization form that includes your full name, date of birth, the date range of records you want, and your signature. Some providers accept requests by email or through a patient portal, but many still require a signed paper form or a secure electronic equivalent.
If you want records sent to a third party, such as a new therapist, a lawyer, or a disability claims office, your authorization form will also need to specify who should receive the records and what information to release. Be as specific as possible about the date range and types of records you need. Vague requests can slow the process down.
Timelines and Costs
Providers must respond to your request within 30 calendar days. If the records are archived offsite or otherwise hard to retrieve, they can extend that deadline by an additional 30 days, but they must notify you in writing during the first 30 days explaining the delay and giving you a new expected date. Only one extension is allowed per request.
For electronic copies, providers generally cannot charge you under the 21st Century Cures Act, which requires that patients be able to electronically access all of their electronic health information at no cost. For paper copies, providers may charge a reasonable, cost-based fee that covers supplies and labor for copying, but they cannot inflate the price or charge for time spent searching for your records. If a fee seems excessive, you’re within your rights to push back or file a complaint.
Electronic Access Through Patient Portals
The 21st Century Cures Act, which took full effect in recent years, makes it illegal for providers to engage in “information blocking,” meaning they can’t create unnecessary barriers to sharing your health data electronically. In practice, this means many mental health providers now must make clinical notes, lab results, and other records available through patient portals. If your provider uses an electronic health record system with a portal, checking there first is often the fastest route to your records.
Psychotherapy notes remain excluded from these electronic access requirements, consistent with their special status under HIPAA.
When a Provider Can Deny Access
Beyond the psychotherapy notes exception, a provider can deny access to your records in limited circumstances. HIPAA distinguishes between two types of denials: reviewable and unreviewable.
Unreviewable denials apply to categories like psychotherapy notes or records compiled for legal proceedings. The provider can deny these without case-by-case evaluation, and you have no right to a formal review.
Reviewable denials require a licensed health care professional to use their clinical judgment on a case-by-case basis. For example, a provider might deny access if they determine that releasing the information would reasonably endanger your life or physical safety, or the life or safety of another person. If you receive a reviewable denial, you have the right to request that a different licensed health care professional review the decision. That second professional’s judgment is final. Automated systems or generic policies cannot substitute for this individual clinical assessment.
Accessing a Minor’s Records
Parents generally have the right to access their minor child’s mental health records as the child’s personal representative, but state law can override this. Many states allow minors to consent to mental health treatment on their own, and in those situations, the parent may not automatically have access to the resulting records. HIPAA defers to whatever state law says about parental access.
There’s also a safety provision. If a provider reasonably believes that a minor has been or may be subjected to abuse, neglect, or domestic violence by a parent, the provider can choose not to treat that parent as the child’s personal representative. This decision is based on professional judgment about the child’s best interests.
Accessing a Deceased Person’s Records
Mental health records remain protected for 50 years after a person’s death. During that period, the personal representative of the deceased, typically the executor or administrator of the estate, can exercise the same access rights the patient would have had while alive. You’ll need to provide documentation of your authority, such as letters testamentary or a court appointment as executor. For any disclosures not already permitted under HIPAA, the personal representative must provide a written authorization.
If Your Provider Has Closed or Retired
Tracking down records from a closed practice takes more detective work, but the records don’t simply vanish. Physicians are expected to contact their state medical board as part of a closure strategy, and the board may have information about where records were transferred. Beyond that, the American Medical Association suggests several practical steps:
- Check the old practice’s website or social media for forwarding information or announcements about where records were sent.
- Visit the old office location to see if a new practice has taken over and inherited the records.
- Contact your insurance company to pull claims history, which can help you piece together your treatment timeline and identify other providers who may hold portions of your records.
- Reach out to labs and imaging centers directly, since they maintain their own copies of any tests they performed.
- Search for the provider or their former colleagues on LinkedIn or other platforms to find a current contact.
- Call your local health department or chamber of commerce, which sometimes has information about practice closures.
If none of these strategies work and you believe your records are being improperly withheld, you can file a formal complaint with the U.S. Office for Civil Rights, which is the federal agency that enforces HIPAA.
Filing a Complaint
If a provider ignores your request, misses the 30-day deadline without explanation, charges unreasonable fees, or denies access without a valid legal basis, you can file a complaint with the Office for Civil Rights at HHS. Complaints can be submitted online through the HHS website. There is no cost to file, and the agency investigates violations of both HIPAA and the information blocking provisions of the Cures Act. Having a paper trail of your original request and any responses from the provider strengthens your case considerably.