Doctor Won’t Send Medical Records: The 30-Day Rule and HHS Complaints

When a doctor won’t send your medical records, federal law is on your side: under the HIPAA Privacy Rule, your provider must give you copies of your records, or send them directly to a new doctor you name, within 30 calendar days of a proper written request.¹ A provider who ignores or refuses that request can be reported to the HHS Office for Civil Rights, and recent federal settlements against practices that unlawfully delayed record requests have ranged from $15,000 to $80,000.²

Excuses That Don’t Hold Up

Before anything else, know that most of the reasons a front desk gives you for withholding records are not valid under federal law.

An unpaid balance is the biggest one. A provider cannot deny or delay access to your records because you owe the practice money. If someone tells you otherwise, they are either misinformed or hoping you’ll back down.¹ Ask to speak with the practice’s HIPAA privacy officer, which every covered entity is required to have.

“You can only get them through the patient portal” is another common one. You have the right to receive records in the format you request, as long as the provider’s system can readily produce them that way. If your records are electronic and you ask for an electronic copy in a specific format the system supports, the provider must provide it.¹ A practice cannot force you into the portal or a paper printout when their system can do what you asked.

You also don’t have to be the middleman. HIPAA specifically allows you to direct a provider to send your records straight to another person or entity you choose, such as a new physician. The request has to be in writing, signed by you, and must clearly identify who is receiving the records and where to send them.¹

When a Refusal Is Actually Legal

A handful of narrow exceptions do let a provider deny access. If none of these describe your situation, you have a strong case.

Two categories are excluded from your right of access entirely, with no appeal: a therapist’s personal psychotherapy notes kept separate from the rest of your record, and information compiled specifically in anticipation of a lawsuit or administrative action. Psychotherapy notes are not the same as your diagnosis, treatment plan, or medication history, which you can still access.

Beyond those, a licensed health care professional can deny access if they determine it is reasonably likely to endanger your life or physical safety, or would cause substantial harm to another person mentioned in the records. When a denial falls into this “reviewable” category, you have the right to ask for a second opinion from a different licensed professional who was not involved in the original decision, and the provider must honor that reviewer’s determination.³

Other unreviewable grounds are narrow: records obtained under a promise of confidentiality where access would reveal the source, records subject to the federal Privacy Act, and inmate situations where access could jeopardize institutional safety.³

Submit a Request the Provider Can’t Ignore

Most stalled record transfers happen because the request was never properly documented. A phone call is easy to deny receiving. A signed form sent by certified mail is not.

Ask the medical records department whether the practice has an “Authorization for Release of Information” form; most do, and using theirs eliminates the most common excuse for delay. Fill in every field. Include your full name, date of birth, contact information, and a specific description of what you want, such as “all records from January 2022 through December 2024” or “the MRI report from June 15, 2023.” If you want records sent directly to your new provider, add the receiving practice’s full name, address, phone number, and fax number. If the form has no line for third-party delivery, write in: “Please send a copy of the above records directly to [new doctor’s name and full contact information].” Sign and date it.

Then send it in a way that produces evidence of delivery. Certified mail with return receipt is the strongest option because the postal record shows the exact date the provider received it. Hand delivery with a date-stamped copy works too, as does upload through a secure patient portal that logs submissions. Keep copies of everything you send.

What the Provider Can Charge

Fees are another place providers try to stall. HIPAA allows a reasonable, cost-based fee limited to the labor of copying records once they’re located, the cost of supplies like paper or a USB drive, and postage if you want them mailed.⁴ The provider cannot bill you for searching for or retrieving the records, even though many try.

A provider can instead charge a flat fee of up to $6.50 for electronic copies of electronic records. That flat option is a convenience for providers who don’t want to itemize, not a cap on itemized fees.⁵ Many states also set per-page caps, roughly $0.25 to over $1.00 per page. If a bill looks inflated, ask for a written breakdown and compare it against both federal rules and your state’s schedule.

Whatever the fee, the provider cannot hold your records hostage over it. They can bill you, but they must still release the records.

The 30-Day Clock

Once a provider receives your properly completed request, federal law gives them 30 calendar days to respond. HHS has been explicit that this is a ceiling, not a target: providers are expected to respond as soon as they reasonably can.⁶

If a provider genuinely cannot meet the deadline, they can take one additional 30-day extension, but only if they notify you in writing before the first 30 days expire, explain the delay, and give you a specific date by which they’ll deliver the records.⁶ A provider who simply goes silent has not validly invoked the extension.

Some state laws set shorter deadlines, and those still apply because HIPAA doesn’t override state rules that give patients greater access.¹ If you have an urgent medical need, call your new provider’s office and ask them to request the records directly, since provider-to-provider transfers for continuity of care sometimes move faster in practice than an individual patient request.

Push Back Before Going Federal

A few escalation steps often shake records loose without a formal complaint.

Call the medical records department and ask for a status update. Reference the date they received your request and the 30-day federal deadline. If that person can’t help, ask for the practice’s HIPAA privacy officer by title. Many delays come down to a form sitting on someone’s desk, and a direct call to the right person resolves it.

If a call doesn’t work, send a follow-up letter by certified mail. State the date your original request was received, that the 30-day window has passed or is approaching, and that you will file a complaint with the HHS Office for Civil Rights if the records are not provided by a specific date. Attach a copy of your original signed request and the certified mail receipt. This converts a passive delay into a documented refusal, which is exactly what federal investigators look for.

You can also file a complaint with your state’s medical licensing board. The board won’t personally hand you your records, but a professional-conduct complaint adds pressure from a separate direction and can result in disciplinary action against the physician’s license.

Filing an HHS Office for Civil Rights Complaint

The HHS Office for Civil Rights (OCR) is the federal agency that investigates HIPAA violations.⁷ Filing is free.

Use the OCR Complaint Portal at ocrportal.hhs.gov.⁸ Select “Violation of Privacy or Security of Health Information” and provide your contact details, the provider’s name and address, and a description of what happened, including the date you submitted your request, any follow-up attempts, and the provider’s response. Attach your signed authorization form, certified mail receipts, and any written communication from the office.

You must file within 180 days of when you knew the violation occurred. OCR can extend that window for “good cause,” but don’t rely on it: file as soon as the 30-day deadline passes and your escalation attempts fail.⁹

OCR investigates and can require the provider to hand over your records and change internal procedures. When violations are serious, financial penalties follow. Since 2019, HHS has run a Right of Access Initiative specifically targeting providers who unlawfully deny or delay record requests, with settlements ranging from $15,000 to $80,000 and enforcement actions continuing through 2025.² Providers who learn a federal complaint has been filed tend to comply quickly, because the cost of a settlement dwarfs the cost of copying records.

Information Blocking: A Second Federal Lever

HIPAA isn’t the only law in your corner. The 21st Century Cures Act separately prohibits “information blocking” — practices that interfere with the access, exchange, or use of electronic health information.¹⁰ If your records are stored in an electronic health record system and the provider is stalling on sharing them electronically, the Cures Act may apply on top of HIPAA.

For health care providers, information blocking occurs when the provider knows a practice is unreasonable and likely to interfere with electronic access. There are exceptions for things like patient safety and system security, but a blanket refusal to send electronic records to a new provider won’t qualify.¹⁰ Providers found to have committed information blocking face HHS-established disincentives, including loss of eligibility for Medicare incentive payments.

You can report information blocking through the Information Blocking Portal on HealthIT.gov, which is separate from the OCR complaint process.¹¹ Filing both complaints at once, one with OCR and one through the information blocking portal, covers both legal frameworks and puts maximum pressure on a noncompliant provider.

If You’re Requesting Records for Someone Else

If you’re trying to get records for a child, an incapacitated parent, or a deceased family member rather than for yourself, HIPAA recognizes “personal representatives” who exercise the same access rights as the patient. Who qualifies depends on the situation: a parent or legal guardian for a minor (with some state-law carve-outs for care like reproductive health or substance use treatment), a health care power of attorney or court-appointed guardian for an incapacitated adult, and the executor or administrator of an estate for a deceased individual.¹²

When you request records as a personal representative, include a copy of the legal document establishing your authority — the power of attorney, guardianship order, or letters testamentary — along with the signed authorization form. A provider can refuse to treat someone as a personal representative if they reasonably believe the patient has been or may be subjected to abuse or neglect by that person, or if granting access could endanger the patient.¹² Outside of that safety exception, a provider who refuses a properly documented personal representative’s request is violating HIPAA the same way they would be with the patient’s own request, and the same escalation and complaint options apply.

1
HHS.gov. Individuals’ Right under HIPAA to Access their Health Information 45 CFR 164.524
2
HHS.gov. Resolution Agreements
3
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
4
HHS.gov. May a Covered Entity Charge Individuals a Fee for Providing the Individuals with a Copy of Their PHI
5
HHS.gov. $6.50 Flat Rate Option is Not a Cap on Fees
6
HHS.gov. How Timely Must a Covered Entity Be in Responding to Individuals’ Requests for Access to Their PHI
7
HHS.gov. HIPAA Enforcement
8
HHS.gov. Office for Civil Rights Complaint Portal
9
HHS.gov. How to File a Health Information Privacy or Security Complaint
10
ASTP – Assistant Secretary for Technology Policy. Information Blocking
11
ASTP – Assistant Secretary for Technology Policy. If I Experience Information Blocking, How Do I Submit a Complaint to HHS
12
HHS.gov. Guidance – Personal Representatives