Medical records are the collection of documents and data that track your health history over time. They include everything from your diagnoses and medications to lab results, imaging reports, allergies, immunizations, and treatment plans. Today, most medical records are stored digitally, though the rules around who owns them, how long they’re kept, and what they cost to access are more complicated than most people expect.
What’s Inside a Medical Record
A medical record captures the key administrative and clinical data relevant to your care. That includes demographics (your name, date of birth, contact and insurance information), vital signs recorded at each visit, diagnoses, medications, allergies, immunization history, lab and test results, radiology reports, and treatment plans. Providers also document notes from each visit, sometimes using a structured format that covers your symptoms, the exam findings, the assessment, and the plan going forward.
Beyond what happens in the exam room, your record also contains billing codes, insurance payment information, referral letters, and sometimes notes from specialists or other facilities. If you’ve had surgery, your record includes operative reports. If you’ve been hospitalized, it contains admission and discharge summaries. Over time, this collection builds into a comprehensive picture of your health.
Electronic Medical Records vs. Electronic Health Records
These two terms sound interchangeable, but they work differently. An electronic medical record (EMR) is essentially a digital version of the paper chart in one clinician’s office. It holds your treatment history at that single practice, and the information doesn’t travel easily. If you see a specialist, your EMR data might need to be printed and mailed.
An electronic health record (EHR) is broader. EHRs are designed to share information across multiple providers, hospitals, labs, and even across state lines. Your data follows you through whatever care you receive, and authorized clinicians at different organizations can access it. EHRs are also built so patients themselves can view their own information, typically through online portals. Most hospitals and large health systems now use EHR platforms, which is why you can often see your lab results or visit notes online within hours of an appointment.
Who Actually Owns Your Records
This is one of the most misunderstood areas of healthcare law. All 50 states agree that medical providers, not patients, own the physical record itself. Twenty-one states have statutes explicitly saying so. You don’t own the chart or the file, but you do generally have the right to access what’s in it and to control who else can see it.
Only one state, New Hampshire, gives patients explicit statutory ownership of the medical information contained in their records. A couple of court decisions from the 1960s recognized that patients have a “property right” in the information even though the hospital owns the physical document, but this hasn’t become the norm nationwide. The practical takeaway: you can get copies of your records and you can restrict who sees them, but the record itself belongs to the provider or facility.
Genetic information is a notable exception. At least five states (Alaska, Colorado, Florida, Georgia, and Louisiana) have passed laws declaring that DNA samples and genetic test results are the exclusive property of the person tested.
How to Access Your Records
Federal law under HIPAA gives you the right to obtain copies of your medical records. The process varies by provider, but it typically involves submitting a written request (sometimes on a specific form) to the medical records department at the facility where you received care. Some offices handle this quickly, while others take weeks.
Patient portals have made access far more immediate. Through a portal, you can typically view test results, visit summaries, your medication list, allergy information, immunization records, and billing details. Many portals also let you message your provider, request prescription refills, schedule appointments, and update your insurance information, all without a phone call. Some even offer virtual visits for minor issues like rashes or small wounds.
If you need a formal copy of your complete record (for a legal matter, a new provider, or your own files), expect to pay a fee. Providers can charge for the labor and materials involved in copying records. A flat fee of up to $6.50 is one option that federal guidance allows for electronic copies, but this isn’t a hard cap. Providers can also calculate fees based on their actual costs, which may be higher for large or complex records. They cannot, however, charge you fees that would effectively block your access.
How Long Providers Must Keep Records
There’s no single federal law mandating a specific retention period for medical records. Requirements vary by state, and some states don’t have a general retention law at all. A common recommendation, reflected in guidelines from medical associations and state boards, is to retain records for at least 10 years from a patient’s last contact with the practice. For minors, the recommendation typically extends to 21 years from the child’s date of birth. Records for deceased patients are often kept for at least six years after death.
When records are eventually destroyed, HIPAA requires that they be rendered unreadable, whether through shredding, burning, or digital wiping. Providers can’t simply toss paper charts in a dumpster or delete files without proper destruction protocols.
What Else Medical Records Are Used For
Your records serve purposes well beyond your individual care. Insurance companies rely on them to verify and process claims. Without accurate documentation, reimbursement for treatment can be delayed or denied. Employers and workers’ compensation programs may also need medical record information in certain situations.
In legal settings, medical records function as critical evidence. Courts regularly subpoena records in personal injury cases, criminal cases (to document the nature and severity of injuries), traffic accident claims, and medical malpractice lawsuits. The documentation in your chart, including timestamps, clinical observations, and treatment decisions, can determine the outcome of these cases.
On a larger scale, de-identified medical records feed into public health research and help governments plan healthcare strategies. When your personal information is stripped away, your record data can contribute to studies on disease patterns, treatment effectiveness, and population health trends. Providers can share these anonymized records for research purposes without needing your individual permission.