To send your medical records, you’ll typically need to submit a written authorization form to the healthcare provider that holds them, specifying where the records should go and what information to include. Most transfers now happen electronically through patient portals, secure messaging, or fax, and federal law gives you the right to get copies of nearly all your health information and direct where it’s sent.
The process is straightforward once you know the steps, but timelines, fees, and special rules for sensitive records can catch people off guard. Here’s how to handle it efficiently.
Your Legal Right to Your Records
Federal privacy law gives you an enforceable right to inspect, obtain copies of, and direct the transfer of your medical records. This covers medical records, billing records, lab results, imaging, and insurance claims data. You can request paper copies, electronic files, or both, and you can ask the provider to send them directly to another person or organization of your choosing.
Two narrow categories are excluded from this right: psychotherapy notes (the personal session notes a therapist keeps separate from your chart) and information compiled in anticipation of legal proceedings. Everything else in your record is fair game.
A provider cannot refuse to release your records because you have an unpaid balance. They also cannot charge you a fee for searching for or retrieving the records, though they can charge reasonable costs for copying and mailing.
How to Request a Transfer
Start by contacting the medical records or health information department at the facility that holds your records. Many offices have a release-of-information form available at the front desk or as a downloadable PDF on their website. Some patient portals let you submit the request digitally.
A valid authorization form needs to include several specific elements:
- Your identifying information: full name, date of birth, and any patient ID or account number.
- What you’re releasing: specify the types of records (visit notes, lab results, imaging, vaccination history) and the date range.
- Who’s sending and who’s receiving: the name and contact information of both the releasing provider and the recipient (your new doctor’s office, a specialist, an insurance company, or yourself).
- An expiration date: authorizations cannot be open-ended. Set a reasonable window, such as 90 days or six months.
- Your signature and the date you signed.
The form must be written in plain language, and you have the right to revoke the authorization in writing at any time. If you’re directing records to a new provider, include that provider’s fax number or secure email address to speed things up.
How Long It Takes
Providers have 30 calendar days from the date they receive your request to act on it. If they can’t meet that deadline, they’re allowed a one-time extension of up to 30 additional days, but only if they notify you in writing during the first 30-day window with an explanation for the delay and a specific completion date. In practice, many offices fulfill requests within one to two weeks, especially for electronic records.
If you need records urgently for an upcoming appointment, call the records department directly and explain your timeline. Provider-to-provider transfers for active treatment often move faster than patient-initiated requests because the offices can coordinate through secure channels they already use.
Transfer Methods
The format you receive depends on what the provider’s system can produce and what you ask for. You’re entitled to get your records in the form and format you request if the provider can reasonably generate them that way. If they can’t, they must provide a readable hard copy or another format you both agree on.
Patient Portals
If both your old and new providers use electronic health record systems, a patient portal is often the fastest route. Many portals let you download your records as a standardized file and upload or forward them. Under the 21st Century Cures Act, healthcare organizations are required to give patients electronic access to all of their health information, structured and unstructured, at no cost. The same law prohibits “information blocking,” meaning providers and health IT companies cannot create unnecessary barriers to your access.
Direct Provider-to-Provider Transfer
You can ask your current provider to send records directly to your new one. This typically happens via secure fax or encrypted electronic messaging between the two offices. You’ll still need to sign an authorization form, but the offices handle the logistics. This is the simplest option when switching primary care doctors or seeing a new specialist.
Paper Copies, Fax, and Mail
For smaller requests or offices without robust electronic systems, paper copies sent by mail or fax remain common. If you pick up physical copies yourself, you can hand-deliver them to your new provider. Certified mail is a good option if you want a delivery confirmation for your own records.
Secure Email or Encrypted File
Some providers will send records via encrypted email if you request it. Standard unencrypted email is not considered secure for health information, so if a provider offers this option, confirm they’re using an encrypted platform.
What It Costs
Providers can charge you reasonable fees for the labor of copying, the cost of supplies (paper, USB drives, CDs), and postage. They cannot charge for the time spent searching for or pulling your records. Fee limits vary by state, and some states cap per-page charges. Electronic copies accessed through a patient portal are generally free under the Cures Act.
When records are sent from one provider to another for treatment or payment purposes, the same reasonable-cost rules apply. If cost is a concern, requesting electronic copies rather than paper typically reduces or eliminates fees.
Records That Require Extra Authorization
Most medical records follow the same release process, but certain categories have stricter rules.
Psychotherapy Notes
Psychotherapy notes, the personal notes a therapist writes during or after a counseling session, are kept separate from your standard medical chart and receive special protection. A provider generally needs a specific, separate authorization from you before releasing them to anyone, including other healthcare providers. This applies even when the disclosure would be for treatment purposes. Exceptions exist for situations like mandatory abuse reporting or imminent safety threats, but those are narrow.
Substance Use Treatment Records
Records from federally funded drug and alcohol treatment programs fall under a separate federal law that is more restrictive than standard privacy rules. If you received treatment at one of these programs, the facility may require a more detailed consent process before releasing information. If you’re unsure whether your treatment program falls under these rules, ask the facility’s records department directly.
Mental Health Records (General)
General mental health records, such as diagnoses, medications, and treatment plans documented in your regular medical chart, follow the same release rules as any other medical record. The extra protections apply specifically to psychotherapy notes, not to all mental health information.
Tips for a Smooth Transfer
Be specific about what you need. Requesting “all records” when you only need the last two years of visit notes and lab work slows the process and may cost more. If you’re transferring to a new primary care provider, ask their office what they’d like to receive. Most want recent visit summaries, current medications, immunization records, and any recent lab or imaging results.
Keep a personal copy of everything you request. Having your own set of records makes future transfers easier and gives you a backup if anything gets lost. Many patient portals now let you maintain a running archive of your health data, which is worth setting up even if you don’t need it immediately.
If a provider misses the 30-day deadline or charges fees that seem excessive, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights, which enforces federal privacy rules. Most issues resolve with a phone call to the records department, but knowing your rights gives you leverage if things stall.