You have a federal legal right to get copies of your medical records from any healthcare provider, health plan, or clearinghouse that stores them. Under the HIPAA Privacy Rule, providers must respond to your request within 30 calendar days. The process is straightforward, but knowing what to include in your request, what fees to expect, and what to do if you hit a wall can save you weeks of frustration.
Your Legal Right to Your Records
Federal law (specifically 45 CFR ยง 164.524) gives you the right to inspect and obtain a copy of your protected health information for as long as a provider maintains it. This covers nearly everything in your medical file: visit notes, lab results, imaging reports, billing records, insurance claims, and referral letters. It applies to doctors’ offices, hospitals, pharmacies, nursing homes, and health insurance companies.
There are two narrow exceptions. Providers can withhold psychotherapy notes, which are a therapist’s personal process notes kept separate from the rest of your chart. They can also withhold information compiled in anticipation of a legal proceeding. Outside of those categories, the records are yours to request.
How to Submit Your Request
Most providers have a records release form you can fill out, either on paper at the front desk or through their patient portal. If your provider doesn’t have a standard form, a written letter or email works just as well. HIPAA does not require you to use any particular format.
Your request should include:
- Your full legal name and date of birth
- Date ranges for the records you want (e.g., “all records from January 2022 through December 2024”)
- Types of information you’re requesting (visit notes, lab work, imaging, vaccination records, etc.)
- Your preferred format for receiving the records (electronic file, paper copies, or access through a patient portal)
- Your signature and the date you signed
Be specific. Some organizations, including federal agencies like the Social Security Administration, will reject blanket requests for “any and all records” or “the entire file.” Specifying the type of records and the date range keeps things moving.
Electronic vs. Paper Records
If your records are stored electronically, you can ask to receive them in an electronic format. Providers are required to give you the records in the format you request if it’s readily producible. Common options include PDF files, documents sent through a patient portal, or exports in structured clinical formats like C-CDA (a standardized medical document type). If you just want something you can read and share with another doctor, a PDF or portal download is the simplest choice.
If the provider can’t produce records in your requested format, they must offer an alternative electronic format you both agree on, or provide a paper copy as a last resort. Many people find it easiest to start with their patient portal, since most health systems now let you view and download visit summaries, lab results, and medication lists directly.
How Long It Takes
Providers have 30 calendar days from the date they receive your request to give you access. If they need more time, perhaps because older records are archived offsite, they can extend the deadline by an additional 30 days, but they must notify you of the delay in writing and give you a reason.
In practice, many requests are fulfilled faster. Records available through a patient portal can be ready within hours. Paper requests from large hospital systems tend to take closer to two or three weeks. If you’re transferring records to a new provider for an upcoming appointment, build in at least a month of lead time to avoid delays.
What It Costs
Providers are allowed to charge you a reasonable, cost-based fee for copies of your records. This fee can cover the labor involved in copying the records, the cost of supplies (paper, USB drives, postage), and mailing expenses. It cannot include costs for searching for or retrieving the information.
Some states go further than federal law and either prohibit fees entirely or cap them lower than what HIPAA allows. HIPAA does not override state laws that give you greater access rights, so if your state says you’re entitled to one free copy, that applies. Check your state health department’s website or call the provider’s medical records office and ask what they charge before submitting your request, so there are no surprises.
Requesting Records for Someone Else
HIPAA recognizes “personal representatives” who can request records on behalf of another person. The most common situations involve parents and children, or caregivers and incapacitated adults.
Minor Children
In most cases, a parent or legal guardian is treated as the personal representative of an unemancipated minor and can access the child’s full medical record. There are three exceptions where a parent may not have access to certain records: when the minor lawfully consented to care on their own (for example, reproductive health services in states that allow minors to consent), when a court directed the child’s care, or when the parent agreed to a confidential relationship between the child and provider. Providers can also withhold records from a parent if they have reason to believe the child is subject to abuse or neglect.
Incapacitated Adults
If you hold a healthcare power of attorney or have been appointed as a legal guardian for an adult who cannot make their own decisions, you can request that person’s records. Bring a copy of the legal document granting you authority when you make the request.
Deceased Individuals
The executor or administrator of a deceased person’s estate, or anyone otherwise legally authorized to act on behalf of the estate, is treated as a personal representative under HIPAA. If it falls within the scope of your legal authority, you can obtain the deceased person’s records. You’ll typically need to provide a death certificate and documentation of your role, such as letters testamentary from a probate court.
What to Do if Your Request Is Denied
Providers can deny access in limited circumstances, and some denials are reviewable while others are not. Denials based on psychotherapy notes or legal proceeding materials are final. But if a provider denies access because a licensed health professional determined that access could endanger you or someone else, you have the right to request a review of that decision by a different licensed professional at the same organization. The reviewer’s decision is binding.
If you believe a provider is improperly withholding your records, dragging their feet past the allowed timeframe, or charging unreasonable fees, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. Complaints can be submitted online through the HHS website. The office investigates HIPAA violations and can require providers to change their practices.
Tips for a Smoother Process
Call the medical records department before submitting anything and ask about their preferred process. Some offices want requests faxed, others accept email, and many now handle everything through the patient portal. Knowing the preferred method up front avoids your request sitting in the wrong inbox.
Keep a copy of your signed request along with the date you submitted it. This creates a paper trail if you need to follow up or file a complaint later. If 30 days pass without a response, call and reference the specific date of your original request.
If you’re gathering records from multiple providers for a new doctor, consider using your health insurance company as a secondary source. Insurers maintain claims data that can help you reconstruct a timeline of visits, procedures, and prescriptions, which is useful if you’ve lost track of which providers you saw and when.