How Long Does It Take to Receive Medical Records?

Under federal law, a healthcare provider has up to 30 calendar days to respond to your request for medical records, and may take one 30-day extension if they notify you in writing of the reason for the delay. So the outer limit on how long it takes to receive medical records is 60 calendar days from the date the provider received your request. In practice, most requests come back much sooner, and electronic records already in a patient portal are often available the same day.

The Federal 30-Day Deadline

The HIPAA Privacy Rule requires a covered healthcare provider or health plan to act on your access request no later than 30 calendar days after receiving it. “Act on” means either provide the records or issue a written denial explaining the legal basis for the refusal.¹ HHS has said this is the outer limit, not a target: many requests should be fulfilled well before 30 days, especially when the records are stored electronically and can be delivered through systems the provider already uses.²

If the provider can’t meet the initial deadline, they may extend it by up to 30 additional calendar days. To do that, they must send you a written explanation of the delay and a specific completion date, and the notice has to arrive within the first 30-day window. Only one extension is allowed per request.³ That puts the absolute federal ceiling at 60 calendar days.

The same timeline applies whether you’re requesting records for yourself, having them sent to a third party like another doctor or an insurer, or acting as someone’s personal representative.⁴

State Laws That Require a Faster Response

About a dozen states set deadlines tighter than the federal 30 days, and when a state law requires faster turnaround, providers in that state have to meet the shorter deadline. Timeframes range from as few as 5 working days for in-person inspection to about 21 calendar days for copies, with most falling between 10 and 15 business days. Some states use a shorter clock for reviewing records on-site than for receiving paper or electronic copies.

If your state doesn’t address the issue, or allows more than 30 days, the federal standard controls. Your state health department or the provider’s medical records office can tell you which deadline applies where you live.

When Records Are Available Immediately

The 21st Century Cures Act layered a second set of rules on top of HIPAA that makes the 30-day clock largely beside the point for electronic records already sitting in a patient portal. Under the act’s information blocking rules, which took full effect in October 2022, healthcare providers, health IT developers, and health information networks cannot engage in practices that unreasonably delay patients’ access to their electronic health information.⁵

In practical terms, lab results, clinical notes, imaging reports, and medication lists should appear in your portal without the provider manually holding them back. A blanket policy of, say, delaying every lab result for several days so a physician can review it first is likely information blocking. Necessary delays, like verifying compliance with state privacy laws or pulling records from a separate system, still fit within recognized exceptions.⁵

If your provider has a portal, check it before you file a formal request. You may find what you need in hours rather than weeks.

What Actually Determines Your Wait Time

Within the legal deadlines, a few practical factors decide whether records arrive in days or weeks.

Format. Electronic copies delivered by portal or secure email are usually the fastest. Paper copies mean printing, packaging, and mailing. A CD or USB drive adds the time to prepare and ship the media.
Volume. A single visit note is quick. Years of records across multiple departments take longer to locate, compile, and review.
Age of the records. Older files may be stored offsite or in legacy systems that need manual retrieval. This is one of the most common reasons providers invoke the 30-day extension.
Staffing. Small practices with limited administrative help often process requests more slowly than large health systems with dedicated records departments.
Multiple sources. Records spread across an emergency room, radiology, and outpatient clinics within the same system need to be gathered separately, which adds coordination time.

The fastest path is almost always downloading directly from a portal. A formal written request is necessary for records that predate the portal or that live at a facility you no longer use.

Requesting Records Without Adding Delay

Contact the medical records department at the provider or facility that holds the records. Most offer a written form, an online portal, email, or an in-person option. Providers can require the request in writing and can ask you to use their form, but they cannot make the process so burdensome that it effectively blocks you from getting your records.⁴

One point trips people up. A provider can ask for basic identifying information to verify who you are, but cannot require you to sign a formal HIPAA authorization just to access your own records. A HIPAA authorization is a separate document used for disclosures to third parties, and HHS has stated that requiring one for a personal access request creates an impermissible barrier. If a front desk hands you an authorization form when all you want is your own file, ask for the standard access request form instead.⁴

Include your full name, date of birth, and a patient identifier such as your medical record number. Specify the records you need and the relevant dates of service. If you want a particular format, say so upfront. Requesting electronic copies delivered by portal or email is almost always faster than waiting for paper to arrive by mail.

Boundaries on the Right of Access

The 30-day timeline covers records in what HIPAA calls a “designated record set”: medical charts, billing records, lab results, imaging reports, insurance information, and clinical notes.¹ A few narrow categories fall outside the right of access. Providers can withhold psychotherapy notes, which are a therapist’s private session notes kept separate from your main medical file, and information compiled for use in a legal proceeding. The underlying medical records that fed into those documents remain accessible.⁴

A licensed health care professional can also deny access if they determine release is reasonably likely to endanger your life or physical safety, or cause substantial harm to another person mentioned in the records. That kind of denial is reviewable by a different licensed professional at your request, and the review must happen promptly.⁴ Even a valid denial only covers the specific portion that falls under the exception; the rest of the file still has to be produced within the normal timeline.

If the Deadline Passes

Start with a phone call to the medical records department. Most delays come from mundane causes: a form missing information, a request that landed in the wrong queue, a backlog after a system change. A follow-up call resolves the majority of these.

If the provider misses both the initial 30-day deadline and any extension without producing records or a written explanation, that is a HIPAA violation. You can file a complaint with the Office for Civil Rights at HHS, which enforces HIPAA’s privacy rules.⁶ Complaints can be submitted online through the OCR portal, by email at OCRComplaint@hhs.gov, or by mail. The filing window is 180 days from when you knew of the violation, though OCR can extend that for good cause.⁷

OCR has run a Right of Access Initiative that has produced enforcement actions and financial settlements against providers who failed to hand over records on time. Mentioning in a follow-up call that you plan to file an OCR complaint sometimes moves things along. You can also file a complaint with your state medical board if the delay involves a specific physician’s office; consistently failing to release patient records can fall within unprofessional conduct, with consequences ranging from a formal reprimand to restrictions on the physician’s license.

Records for a Deceased Person

HIPAA protects a deceased person’s health information for 50 years after the date of death. During that period, the personal representative of the deceased, typically the executor or administrator of the estate, can exercise the same access rights the patient would have had while alive, on the same 30-day timeline. You’ll generally need to provide documentation of your authority, such as letters testamentary or a court order appointing you as executor.⁸

Family members who were involved in the patient’s care but are not the personal representative may still receive some information, unless the deceased person expressed a preference against it while alive. What qualifies as “relevant” is narrower in that situation, so family members who need comprehensive records should work through the estate’s personal representative when possible.

1
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
2
U.S. Department of Health & Human Services. Why Does HIPAA Give Covered Entities 30 Days to Respond to Individuals’ Requests for Access to Their PHI
3
U.S. Department of Health & Human Services. How Timely Must a Covered Entity Be in Responding to Individuals’ Requests for Access to Their PHI
4
U.S. Department of Health & Human Services. Individuals’ Right under HIPAA to Access their Health Information 45 CFR 164.524
5
ASTP. Information Blocking
6
U.S. Department of Health & Human Services. HIPAA Enforcement
7
U.S. Department of Health & Human Services. How to File a Health Information Privacy or Security Complaint
8
U.S. Department of Health & Human Services. Health Information of Deceased Individuals