You have a federal right to get copies of your hospital records, and the process is straightforward once you know what to submit. Most requests involve filling out an authorization form, providing identification, and waiting up to 30 days for the hospital to respond. Whether you need records for a new doctor, a legal matter, or your own reference, here’s how to do it efficiently.
Check Your Patient Portal First
Before filing a formal request, log into the hospital’s online patient portal. Most portals let you view and download visit summaries, lab results, immunization records, allergy lists, and increasingly, full clinical notes from your visits. If all you need is a recent lab report or a vaccination record, you can often get it in minutes without any paperwork.
Portals have limits, though. Older records, detailed operative reports, pathology results, and imaging files typically aren’t available for direct download. For those, you’ll need to submit a formal written request.
How to Submit a Formal Request
Contact the hospital’s Health Information Management (sometimes called Medical Records) department. Most hospitals have a dedicated release-of-information office, and many now post their authorization forms online. You can usually submit your request in person, by mail, by fax, or through a secure online form.
The authorization form will ask for several pieces of information, and getting them right the first time prevents delays:
- Your identifiers: Full legal name (as it appears in the medical record), date of birth, and at least one contact detail. Include your medical record number if you have it.
- The disclosing entity: The full name and location of the hospital or department releasing the records. If the hospital has multiple campuses, specify which one.
- The recipient: Who should receive the records, with a full name and mailing or email address. This could be you, your attorney, or another provider.
- A description of what you want: Be specific. Rather than “all records,” list the types of records (visit notes, imaging reports, discharge summaries) and the date range. For example, “surgical notes and post-op visit records from March 2024 to June 2024” will be processed faster than a blanket request.
- Purpose of the request: Common reasons include “continuity of care,” “personal use,” or “legal review.”
- Expiration date: A date or event when the authorization expires. Don’t leave this blank.
- Your signature and the date.
Make sure every required field is filled in and that names and dates are legible and consistent across pages. Incomplete forms are the most common reason for processing delays.
How Long It Takes
Under HIPAA, the hospital must act on your request within 30 calendar days of receiving it. If they can’t meet that deadline, they’re allowed a one-time extension of up to 30 additional days, but only if they notify you in writing during the initial 30-day window, explain the reason for the delay, and give you a specific date when the records will be ready.
Some states require faster turnaround. If your state law sets a shorter deadline, the hospital must meet the shorter one. In practice, many hospitals fulfill straightforward requests in 10 to 15 business days.
What It Costs
Hospitals can charge you a reasonable, cost-based fee for copies of your records, but federal law limits what counts as “reasonable.” The fee can cover only four things: the labor to copy the records, supplies (like a CD or USB drive), postage if you want them mailed, and preparation of a summary if you specifically asked for one.
Hospitals cannot charge you for searching for your records, retrieving them, verifying your identity, or maintaining their storage systems, even if state law would otherwise allow those charges.
For electronic records delivered electronically, the hospital can charge a flat fee of no more than $6.50, covering labor, supplies, and postage combined. Per-page fees are only allowed when paper records are copied onto paper or scanned into electronic format. If you’re quoted a surprisingly high number, ask for a breakdown and reference the HIPAA fee limits.
Inspecting your own records in person is generally free. You only pay when you request copies.
Requesting Imaging Files
Radiology images like MRIs, CT scans, and X-rays require a slightly different process because the files are large and stored in a specialized format called DICOM. Hospitals typically provide these on a CD or DVD, often with a built-in viewer so you can open the images on a standard computer. Some hospitals now offer secure download links instead.
If you receive a disc with images converted to a consumer format like JPEG, you can ask the radiology department to create a replacement disc in the original DICOM format at no additional charge. The DICOM version preserves the full diagnostic quality your new doctor or specialist will need.
Requesting Records for Someone Else
You can request another person’s hospital records if you’re their legally authorized personal representative. The rules depend on the situation:
- Minor children: A parent or legal guardian is typically the personal representative. If a custody decree exists, the parent authorized to make healthcare decisions is the one who can request records.
- Incapacitated adults: The person named in a healthcare power of attorney can request records on the patient’s behalf.
- Deceased individuals: The executor or administrator of the estate, or a person authorized by a court or state law to act for the deceased, can request records.
When signing the authorization form as a representative, you’ll need to include your own name, signature, date, and your relationship to the patient. Bring supporting documentation: a birth certificate or custody order for a child, the power of attorney document for an incapacitated adult, or letters of administration for a deceased person’s estate. The hospital will verify your authority before releasing anything.
If Your Request Is Denied
Hospitals can deny access in limited circumstances. The most common reasons include requests for psychotherapy notes (which have separate, stricter protections), information compiled for a legal proceeding, or situations where a licensed healthcare professional determines that access could endanger someone’s safety. Records created by certain research studies may also be temporarily restricted.
If your request is denied, the hospital must give you the reason in writing and tell you how to appeal. For most denial reasons, you have the right to have the decision reviewed by a different licensed healthcare professional who was not involved in the original denial. The reviewer’s decision is binding on the hospital. You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights if you believe your access rights were violated.
How Long Hospitals Keep Records
There’s no single national rule for how long hospitals must retain your records. State laws vary, but most require hospitals to keep adult medical records for at least 5 to 10 years. Federal rules add additional layers: Medicare fee-for-service providers must keep documentation for at least 6 years, providers submitting cost reports must retain records for at least 5 years after the cost report closes, and Medicare managed care providers must keep records for 10 years.
If you need very old records, it’s worth requesting them sooner rather than later. Once the retention period expires, the hospital is legally permitted to destroy them. If your records have been destroyed, the hospital should be able to tell you that rather than simply not responding.