A medical record includes virtually every document a healthcare provider or health plan creates or stores about you: clinical notes, lab results, billing statements, imaging reports, consent forms, and much more. Under federal law, the term covers not just the chart your doctor writes in but also payment records, insurance claims, and any other information used to make decisions about your care.
What Federal Law Includes
The federal privacy rule defines something called a “designated record set,” which is the legal framework for what counts as your medical record. This set includes medical records, billing records, payment and claims records, health plan enrollment records, and case management records. It also sweeps in any other records a healthcare provider or insurer uses, even partly, to make decisions about you.
In practical terms, that means you have a legal right to access a wide range of documents: clinical notes (including the structured “SOAP” notes clinicians write during visits), lab reports, X-rays and imaging studies, wellness and disease management program files, consent forms, and insurance information. If a provider or plan used it to decide something about your care or coverage, it’s part of your record.
Specific Documents in a Typical Record
A complete medical record can contain dozens of document types. The core clinical documents include:
- Patient identification and biographical information
- Medical history, including past diagnoses, surgeries, allergies, and immunizations
- Physical examination notes
- Laboratory reports, including blood work and pathology
- Radiology and diagnostic imaging reports
- Treatment records and medication lists
- Physician consultation notes and referral information
- Progress notes from ongoing visits
- Discharge summaries and follow-up reports
- Social work notes
Billing and administrative documents sit alongside these clinical files. Your payment history, insurance claims, and enrollment records are all legally part of the designated record set. If you request your records, you’re entitled to both the clinical and billing sides.
What’s Excluded From Your Record
Two categories of information are specifically carved out from the records you can access. The first is psychotherapy notes. These are the personal, free-form notes a mental health professional writes during or after a counseling session, kept separate from the rest of your chart. They’re treated differently because of their sensitivity and because they’re essentially the therapist’s private working notes, not clinical documentation needed for treatment or billing.
It’s worth understanding what psychotherapy notes are not. Medication prescriptions, session start and stop times, treatment frequency, clinical test results, and summaries of your diagnosis, symptoms, treatment plan, and progress are all standard medical record entries. They stay in your chart and you have full access to them. Only the therapist’s private session-by-session analysis gets the special protected status.
The second exclusion covers information compiled in anticipation of a lawsuit or legal proceeding. If a provider assembles documents specifically for a court case, those compiled materials fall outside your access rights. However, the underlying health information that was used to create those legal files remains in your designated record set, and you can still access that original data.
Mental Health Records vs. Psychotherapy Notes
This distinction trips up a lot of people. General mental health records are treated exactly the same as any other medical information under federal law. Your psychiatrist’s prescription records, your therapist’s diagnostic summary, your treatment plan, your session frequency: all of that is standard protected health information, subject to the same rules as a cardiology report or a blood panel.
Psychotherapy notes occupy a narrow, separate category. A provider needs your written authorization before sharing them with anyone, including other clinicians. Parents don’t automatically have a right to access psychotherapy notes about a minor child’s treatment, even though they can typically access the child’s broader medical record. The notes must be physically or electronically separated from the rest of the medical record to qualify for this protection.
Digital Records and Patient Portals
Electronic health records have expanded what falls under the medical record umbrella. The 21st Century Cures Act requires that patients be able to electronically access all of their electronic health information, both structured data (like coded diagnoses and lab values) and unstructured data (like free-text clinical notes), at no cost.
The law also pushed healthcare systems to adopt standardized technology so that patients can pull their records into smartphone apps and share them across providers more easily. It includes “information blocking” provisions that penalize healthcare organizations for unnecessarily restricting access to electronic health information.
Patient portal messages occupy a gray area that varies by institution. Many portals allow you to send free-text messages to your care team, similar to email. Whether these messages become a formal part of your medical record depends on the provider’s policies, but any portal communication that a clinician uses to make decisions about your care would fall within the designated record set.
Who Owns the Record
This is one of the most commonly misunderstood aspects of medical records. In all 50 states, the physical (or digital) record belongs to the healthcare provider or facility, not to you. Hospitals own the charts. Clinics own the files. You do not own the document itself.
What you do have is a robust set of rights over the information inside that record. You can inspect it, get copies, request corrections, and control who else sees it. Only one state, New Hampshire, explicitly grants patients property rights over the medical information contained in facility records. A handful of court rulings from other jurisdictions have recognized that patients hold a property right in the information portrayed in their records, even though the hospital owns the physical file. In practice, the distinction rarely matters day to day because federal law guarantees your access regardless of who technically owns the paper or server.
How Long Records Must Be Kept
Federal regulations require hospitals participating in Medicare to retain medical records for at least five years. State laws often impose longer requirements, and many states have separate rules for pediatric records that extend the retention period until several years after a child reaches adulthood. Individual providers and institutions frequently keep records well beyond the legal minimum, especially now that electronic storage makes long-term retention inexpensive.
If you need records from a provider you saw years ago, it’s worth requesting them even if you think they may have been destroyed. Many organizations retain files for 10 years or more, and electronic backups often survive longer than the legal floor requires.