Under HIPAA, you have the right to inspect and get copies of your own medical records, and in most cases the provider or health plan has 30 days to respond to your written request. HIPAA medical records access covers paper files and electronic records held by doctors, hospitals, pharmacies, health insurers, and clearinghouses, along with records their business associates keep on their behalf.1U.S. Department of Health and Human Services. Covered Entities and Business Associates A provider cannot withhold your records because you have an unpaid bill.2U.S. Department of Health and Human Services. May a Health Care Provider Withhold a Copy of an Individual’s PHI
What You Can Get
Your right of access reaches everything in what the regulations call the “designated record set.” That includes medical and billing records kept by providers, enrollment and claims records held by health plans, and any other files used to make decisions about your care.3eCFR. 45 CFR 164.501 – Definitions In everyday terms: clinical notes, lab results, imaging reports, prescription histories, treatment plans, and bills.
If your records are stored electronically, you can ask for them in the electronic format of your choice, and the provider must give you that format if it can readily produce it. If not, the provider has to offer whatever electronic formats it does have. Only after you turn down every available electronic option can the provider default to paper.4U.S. Department of Health and Human Services. When an Individual Exercises Her HIPAA Right to Get an Electronic Copy Delivery typically happens through a patient portal download, an encrypted email link, or a USB drive.
What Falls Outside the Access Right
Two categories are excluded. Psychotherapy notes are the private, session-by-session observations a mental health professional writes for their own use, kept separate from the rest of your chart. Your diagnosis, medications, and treatment summaries stay accessible; only those separately maintained notes are off-limits.5U.S. Department of Health and Human Services. Does HIPAA Provide Extra Protections for Mental Health Information Compared with Other Health Information Information compiled for use in a lawsuit or administrative proceeding is also excluded.6eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
How to Make the Request
Most providers want the request in writing, though HIPAA doesn’t mandate a specific form. Include your full legal name, date of birth, and current contact information so the records department can verify who you are and reach you about delivery. If the provider posts its own authorization form on a website or patient portal, using it usually moves things along faster.
Be specific about what you want and how you want it. A request for “all lab results from January through December 2025” will typically be processed faster than “my complete medical record,” though either is valid. State whether you want paper, electronic files, or both.
You can also direct the provider to send records straight to someone else, such as another doctor, a family member, or an attorney. That instruction has to be in writing, signed by you, and it must clearly identify who is receiving the records and where to send them.7U.S. Department of Health and Human Services. Can an Individual Through the HIPAA Right of Access Have PHI Sent to a Third Party A scanned PDF of a signed request or a secure electronic signature through a portal both work.
Before releasing anything, the provider must verify your identity. HIPAA gives providers flexibility here, so expect to be asked for a government photo ID, a date-of-birth confirmation over the phone, or portal login credentials.8U.S. Department of Health and Human Services. How May the HIPAA Privacy Rule’s Requirements for Verification of Identity Be Met
How Long the Provider Has
Once the provider receives your request, it has 30 calendar days to act on it. If it can’t meet that deadline, it gets a single 30-day extension, but only if it sends you a written explanation of the delay and an expected completion date within the original 30-day window.9U.S. Department of Health and Human Services. How Timely Must a Covered Entity Be in Responding to Individuals’ Requests for Access to Their PHI The absolute outer limit is 60 days.
What It Can Cost
Providers can charge a reasonable, cost-based fee, but the allowable costs are limited. They can bill you for the labor of copying, supplies such as paper or a USB drive, and postage if you want records mailed. They cannot charge you a “search and retrieval” fee for locating your file, even though that line item still shows up on some invoices.
For electronic copies, a provider can charge a flat fee of up to $6.50 instead of calculating actual costs. That flat rate is a shortcut, not a cap. A provider that wants to charge more must document its actual or average costs to justify the higher amount.10U.S. Department of Health and Human Services. Clarification of Permissible Fees for HIPAA Right of Access – Flat Rate Option of Up to $6.50 Is Not a Cap on All Fees for Copies of PHI Paper per-page rates vary by state, typically running from about $0.50 to $1.00 per page.
One detail that saves people money: if you only want to look at your records, not take copies home, the provider cannot charge you anything. The right to inspect in person is separate from the right to obtain copies, and the provider must arrange a convenient time and place.11U.S. Department of Health and Human Services. Can an Individual Be Charged a Fee If the Individual Requests Only to Inspect PHI
When a Provider Can Say No
Outright denials are rare, and the rules split them into two groups: denials you can challenge and denials you cannot.
Three situations allow a denial that you can have reviewed by a different licensed professional who wasn’t involved in the original decision:6eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
- A licensed professional has determined that access is reasonably likely to endanger your life or physical safety, or someone else’s.
- The records reference another person (not a healthcare provider), and a professional has determined access would cause that person substantial harm.
- A personal representative made the request, and a professional has determined that giving that representative access could cause substantial harm to you or someone else.
Denials tied to the excluded categories (psychotherapy notes, litigation materials) are not reviewable. Correctional facilities can deny an inmate’s request if access would jeopardize safety or security, and research participants who agreed at enrollment can have access temporarily suspended during a clinical trial.6eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
Fixing Errors in Your Records
Getting your records is often the first step toward correcting them. Under 45 CFR 164.526, you can submit a written request to amend any protected health information in your designated record set. Explain what’s wrong (an incorrect diagnosis code, a wrong medication, an inaccurate treatment date) and why it should change.
The provider has 60 days to act on your amendment request, with one 30-day extension if it sends you a written explanation within the original period. If it accepts the amendment, it must make reasonable efforts to notify others who previously received the wrong information and might rely on it.12eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
If it denies the amendment, it has to tell you why in writing and let you file a statement of disagreement. That statement gets attached to your record and travels with the disputed information any time it’s disclosed. The provider can limit the length of your statement but cannot refuse to accept one.12eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
Requesting Records for Someone Else
A “personal representative” can exercise the same access rights as the patient, but only if they have legal authority under state or applicable law to make healthcare decisions for that person.13U.S. Department of Health and Human Services. Guidance – Personal Representatives
For an adult, a personal representative is typically someone with a healthcare power of attorney, a court-appointed legal guardian, or a general durable power of attorney that includes healthcare decisions. Access matches authority: if the power of attorney is limited to certain healthcare decisions, the representative’s record access is limited to information relevant to those decisions.13U.S. Department of Health and Human Services. Guidance – Personal Representatives
A parent is generally the personal representative of an unemancipated minor. There are exceptions that surprise people. A parent loses that status for specific records when the minor consented to the care on their own (as allowed by state law), when a court directed the treatment, or when the parent agreed to a confidential relationship between the child and provider.14U.S. Department of Health and Human Services. The HIPAA Privacy Rule and Parental Access to Minor Children’s Medical Records A provider can also refuse to treat a parent as the personal representative if it reasonably believes the child has been or may be subjected to abuse or neglect, or that access could endanger the child.
A deceased person’s records stay protected for 50 years after death. During that window, the personal representative of the estate (typically the executor or administrator) has the same access rights the individual would have had while alive. Family members who were involved in the person’s care or payment for care before death may also receive relevant information, unless it conflicts with a preference the deceased expressed while living.15U.S. Department of Health and Human Services. Health Information of Deceased Individuals
If You’re Denied, Delayed, or Overcharged
If a provider wrongly denies your request, blows past the 60-day maximum, or charges fees that look inflated, you can file a complaint with the HHS Office for Civil Rights. Complaints can be submitted online through the OCR complaint portal or in writing.16U.S. Department of Health and Human Services. Filing a Health Information Privacy Complaint You have 180 days from when you knew or should have known about the violation to file, though HHS can waive that deadline for good cause.17U.S. Department of Health and Human Services. If I Believe That My Privacy Rights Have Been Violated When Can I Submit a Complaint
OCR has pursued more than 50 enforcement actions specifically against providers that failed to give patients timely access to their records, with settlements reaching six figures.18U.S. Department of Health and Human Services. HHS’ Office for Civil Rights Settles HIPAA Right of Access Case With Concentra A well-documented complaint (dates of your request, copies of correspondence, itemized fee statements) gives investigators what they need to act.