Yes, you can sue a doctor for not releasing your medical records, but not under HIPAA itself. Federal law gives you an enforceable right to your health information and lets you file complaints that carry real penalties, while most states allow you to bring an actual lawsuit under theories like negligence, breach of contract, or consumer protection. Which path fits depends on the harm you can show and the laws in your state.
What Your Records Rights Actually Are
The HIPAA Privacy Rule gives you a legal right to inspect and obtain copies of your protected health information from any covered provider or health plan. That includes medical records, billing and payment records, lab results, medical images, clinical notes, and insurance information held in what the regulation calls a “designated record set.”1U.S. Department of Health & Human Services. Individuals’ Right Under HIPAA to Access Their Health Information 45 CFR 164.524 The right applies to both paper and electronic records.
Once you submit a request, the provider has 30 calendar days to respond. If records are archived offsite or otherwise hard to locate, the provider can take one 30-day extension, but only by notifying you in writing during the initial window, explaining the delay, and giving a specific date by which you’ll get your records.1U.S. Department of Health & Human Services. Individuals’ Right Under HIPAA to Access Their Health Information 45 CFR 164.524 Thirty days is the outer limit, not the target.
If you want your records electronically, you have the right to receive them in the format you request as long as the provider can reasonably produce them that way. When electronic production isn’t feasible, the provider must offer a readable hard copy or work with you on an alternative.2U.S. Department of Health & Human Services. The HIPAA Privacy Rule’s Right of Access and Health Information Technology
When Refusal Is Illegal and When It Isn’t
Your right of access is broad but not absolute. Providers can deny access without appeal for a narrow set of categories: psychotherapy notes (a therapist’s private session notes, separate from your diagnosis, treatment plan, or medication records),3U.S. Department of Health & Human Services. HIPAA Privacy Rule and Sharing Information Related to Mental Health information compiled specifically for litigation, records tied to a clinical research study you agreed to suspend access for during enrollment, and information received under a promise of confidentiality where release would reveal the source.4eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
There is one additional safety exception a provider can invoke, subject to your right to appeal: a licensed professional determines that access is reasonably likely to endanger your life or physical safety, or someone else’s. HHS emphasizes this applies only in “extremely rare circumstances,” and vague concerns about emotional upset don’t qualify.5HHS.gov. Under What Circumstances May a Covered Entity Deny an Individual’s Request for Access to the Individual’s PHI?
Everything else is an illegal refusal. The most common one is an unpaid medical bill. Some providers try to hold records hostage until the balance is paid, but HHS has explicitly said this is not allowed. A provider cannot withhold your records because you owe money, and cannot apply your copying fee toward an outstanding balance instead of producing the records.6HHS.gov. May a Health Care Provider Withhold a Copy of an Individual’s PHI?
Administrative excuses come next: an incomplete form, unverified identity, a request that “never reached” the right department. These are fixable issues, not valid grounds for denial. And when a provider simply doesn’t respond within 30 days, that silence is itself a Privacy Rule violation.
Why You Cannot Sue Directly Under HIPAA
Here’s the point most people miss. HIPAA does not create a private right of action. There is no “HIPAA cause of action” that lets you walk into court and sue your doctor for a Privacy Rule violation. HIPAA is enforced by the federal government, not by individual patients in civil court.
What that means practically: to get money damages or a court order, you need to use a different legal theory (usually state law), and to trigger federal penalties, you file a complaint with a federal agency. Serious cases often use both channels at once.
Filing a Complaint With the Office for Civil Rights
The Office for Civil Rights at HHS investigates HIPAA violations, including refusals to provide patient access. You don’t need a lawyer to file.7HHS.gov. How to File a Health Information Privacy Complaint You can submit online through the OCR Complaint Portal or mail a written form. Include your name and contact information (OCR won’t investigate anonymous HIPAA complaints), a description of what happened, and copies of your written request and any responses.
Once accepted, OCR notifies both you and the provider, then gathers information from each side. Most cases end in voluntary compliance, a corrective action plan, or a formal resolution agreement. If the provider still refuses, OCR can impose civil monetary penalties.8HHS.gov. How OCR Enforces the HIPAA Privacy and Security Rules
OCR treats access complaints seriously. Through its Right of Access Enforcement Initiative, the agency has completed at least 54 enforcement actions, the most recent a $112,500 settlement with a national healthcare company in late 2025.9HHS.gov. HHS’ Office for Civil Rights Settles HIPAA Right of Access Case
Penalty Tiers
OCR’s civil penalties are tiered by culpability and adjusted annually for inflation. As of the January 2026 adjustment:10Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
- Provider didn’t know about the violation: $145 to $73,011 per violation, annual cap of $2,190,294 for identical violations.
- Reasonable cause, not willful neglect: $1,461 to $73,011 per violation, same annual cap.
- Willful neglect, corrected within 30 days: $14,602 to $73,011 per violation, same annual cap.
- Willful neglect, not corrected: $73,011 to $2,190,294 per violation, with the annual cap also at $2,190,294.
Note that any OCR penalty goes to the government, not to you. Compensation for you comes from a separate state-law lawsuit, discussed below.
OCR can also refer suspected criminal conduct to the Department of Justice, and state medical boards can independently discipline a provider through license suspension, fines, or mandatory corrective education.
Information Blocking as a Second Federal Lever
If your records live in an electronic health record system, you may have an additional federal claim under the 21st Century Cures Act. The law defines “information blocking” as any practice a healthcare provider knows is unreasonable and likely to interfere with access to, exchange of, or use of electronic health information.11eCFR. 45 CFR Part 171 – Information Blocking A doctor who ignores or stonewalls a legitimate electronic records request may meet that definition.
The HHS Office of Inspector General can impose penalties of up to $1 million per violation for information blocking.12HHS Office of Inspector General. Information Blocking Providers who participate in Medicare face additional financial disincentives through CMS, including reduced reimbursement, zero scores on performance metrics, and removal from shared savings programs.13Federal Register. 21st Century Cures Act: Establishment of Disincentives for Health Care Providers That Have Committed Information Blocking
You can report information blocking through the ASTP/ONC Information Blocking Portal, and unlike OCR complaints, you can submit anonymously.14Office of the National Coordinator for Health Information Technology. Information Blocking Filing both an OCR complaint and an information blocking report puts pressure on the provider from two federal agencies at once.
State-Law Claims That Actually Get You Into Court
This is where a lawsuit becomes possible. State laws vary, but several theories commonly apply to records disputes.
Negligence
If a provider’s failure to release your records caused measurable harm (delayed treatment, a missed diagnosis, inability to get a second opinion, or complications from a gap in care), you may have a negligence claim. Courts in many states allow HIPAA standards to serve as evidence of the standard of care the provider owed you, even though HIPAA isn’t the legal basis for the claim. The harm has to be concrete. Frustration alone doesn’t cut it. You need to show that the withheld records led to a specific medical or financial consequence.
Breach of Contract
Provider-patient relationships often involve written agreements: intake paperwork, privacy notices, or patient portal terms of service that include promises about record access. When a provider violates those written commitments, you may have a breach of contract claim. Pull whatever you signed when you became a patient and look for language about providing records upon request.
Emotional Distress and Privacy Torts
Some states recognize claims for intentional or negligent infliction of emotional distress when a provider’s conduct is particularly egregious. A provider who deliberately withholds records to retaliate or cover up a mistake may cross that line. Invasion of privacy claims more often involve unauthorized disclosure, but a refusal to provide access can sometimes fit under the broader violation of the confidential patient-provider relationship.
Consumer Protection Statutes
Many states have consumer protection or unfair trade practices laws that reach healthcare providers. Some of these statutes provide statutory damages and attorney’s fees, which makes pursuing the claim financially practical even when the underlying dollar amount is modest.
Documenting Your Case
Every remedy above depends on proving that you asked and the provider refused or failed to respond. Build the paper trail from day one.
- Make your request in writing (patient portal, email, fax, or certified mail) and keep copies with timestamps. Verbal requests are hard to prove.
- Include a copy of your photo ID to remove the most common administrative excuse for delay.
- If the provider charges a copying fee, pay it and keep the receipt. Payment made and records not delivered is powerful evidence of non-compliance.
- Log every phone call, office visit, email, and portal message: date, time, who you spoke with, what was said.
- After any phone conversation, send a follow-up email summarizing what was discussed. That creates a written record the provider can’t easily dispute.
If 30 days pass without records or a written explanation for the delay, send a formal follow-up letter. Reference your original request date, cite the 30-day deadline under the Privacy Rule, and state that you intend to file an OCR complaint if records don’t arrive within a specific timeframe. This letter alone often resolves the situation. Many providers move fast once they see you know the rules.
What a Lawsuit Looks Like and Finding Counsel
If federal complaints don’t resolve the issue and you have a viable state-law claim, a lawsuit is the next step. You’ll file a formal complaint in the appropriate court describing the provider’s failure to release records and the specific harm it caused. Filing fees vary by jurisdiction.
During discovery, both sides exchange evidence. You’ll typically request the provider’s internal communications about your records request, their policies and procedures for handling access requests, staff training materials, and any documentation of the reasons for denial. The provider may take your deposition to probe what harm you suffered and when. Many cases settle once discovery shows the provider had no legitimate basis for the denial. If a case goes to trial, possible outcomes include a court order compelling release of the records, monetary damages, and in some states attorney’s fees under consumer protection statutes.
Look for an attorney with experience in health information privacy law or patient rights rather than a general practitioner. This area sits at the intersection of federal regulation, state tort law, and healthcare compliance, and someone who handles these cases regularly will know which claims get traction in your state.
During an initial consultation, ask how many records-access cases they’ve handled, whether they’ve filed OCR complaints, and which state-law theories they’d pursue for your situation. Some attorneys in this area work on contingency; others bill hourly. Get the fee structure in writing before you commit. Once you hire someone, hand over everything you have: written requests, provider responses, your communication log, fee receipts, and evidence of harm. An attorney letter on firm letterhead often produces records within days, because providers and their insurers take the threat of litigation far more seriously than a patient acting alone.