A HIPAA access request form is the written request you give a healthcare provider, health plan, or clearinghouse to get copies of your medical records. Federal law gives you the right to inspect or obtain nearly all protected health information a covered entity holds about you, and the provider has 30 calendar days to respond after receiving your request. There is no single federal version of the form. Each provider designs its own, but every valid request contains the same core information, and you can submit a plain written request instead of the provider’s template if you prefer.
Where to Find the Form
Most providers make the form available in more than one place. Try these first:
- Your patient portal, usually under a “medical records” or “health information” tab. Submitting through the portal often speeds things up because the system links the request to your account automatically.
- The front desk or Health Information Management (HIM) office. Larger hospitals have a dedicated HIM department that handles records requests.
- The provider’s website, often under “patient forms” or “medical records.”
- The facility’s Privacy Officer. Every covered entity is required to have one, and they can direct you to the right form or accept a written request directly.
You are not required to use the provider’s form. A written request that includes the necessary details is legally sufficient. Using the provider’s own form does reduce the risk of delays caused by missing information.
What to Put on the Form
Whatever layout you’re working with, a request needs the same building blocks. Missing any of them is the fastest way to slow things down.
Your Identifiers
Start with your full legal name, date of birth, and current address and phone number. Most forms also ask for a patient ID or medical record number, which appears on a recent billing statement or discharge summary. Some facilities request a Social Security number, though federal law does not require you to provide one.
What Records You Want
Be specific. Narrow requests get processed faster than open-ended ones. Include:
- The start and end dates of the treatment period.
- The record types you need: laboratory results, imaging reports, discharge summaries, operative notes, pathology reports, prescription history, or billing records.
- The names of specific providers if you were seen by multiple doctors in the same health system.
Your right of access covers what the regulations call the “designated record set,” which includes the medical records and billing records the provider uses to make decisions about your care, along with enrollment, payment, and claims records held by a health plan.
How You Want to Receive Them
Standard options are paper copies, a PDF by secure email, records on a USB drive or CD, or access through the patient portal. If your records are stored electronically and you ask for an electronic copy, the provider must give you one in the format you request as long as it is readily producible. If that format isn’t available, you and the provider agree on a readable electronic alternative.
You can also ask for records by regular unencrypted email. The provider must honor that request but will warn you first that unencrypted email carries a risk of interception. Once you acknowledge the risk, the provider should proceed.
Third-Party Delivery
If you want records sent directly to another doctor, an attorney, or anyone else, include the recipient’s full name, mailing address or email, and a clear signed statement directing the provider to send the records there. The provider must honor a written, signed direction to transmit records to a designated third party.
Requesting Records for Someone Else
HIPAA allows a “personal representative” to exercise the same access rights as the patient. The provider must treat that person as if they were the patient for purposes of the request. Who qualifies depends on state law, but the common categories are:
- A parent or legal guardian of an unemancipated minor, with some exceptions where the minor lawfully consented to the care on their own, a court authorized the treatment, or the parent agreed to a confidential relationship between the provider and the minor.
- An agent named in a healthcare power of attorney, for an incapacitated adult.
- A court-appointed guardian or conservator.
- The executor or administrator of a deceased patient’s estate.
Bring the legal document that establishes your authority when you submit the form. Providers typically require a copy of the power of attorney, guardianship order, or court appointment.
How to Submit It
You have several delivery options, and the right one depends on how much of a paper trail you want.
- Patient portal upload is the fastest. The request is time-stamped and tied to your account.
- Fax works if the records department publishes a number. Keep the transmission confirmation page.
- Certified mail gives you a tracking number and delivery confirmation. Use it if you think there could be any dispute about when the provider received your request.
- In-person delivery lets you ask for a date-stamped copy at the HIM department or front desk.
Whichever method you use, keep a copy of the completed form and proof of the submission date. The federal response clock starts the day the provider receives your request.
What Happens After You Submit
The provider must act on your request no later than 30 calendar days after receiving it. Acting means one of three things: giving you the records, giving you the chance to inspect them in person, or issuing a written denial that explains why access is being refused.
If the provider needs more time because records are stored off-site or the request is unusually complex, it can take a single extension of up to 30 additional days. To do that, the provider must notify you in writing before the original 30-day window closes, explain the reason for the delay, and give you a specific date by which the request will be completed. No second extension is allowed.
What It Can Cost
A provider can charge a reasonable, cost-based fee, but only for four things: the labor of copying the records, supplies like paper or a USB drive, postage if you ask for the copies to be mailed, and preparation of a summary if you asked for one instead of the full records. Searching for and retrieving records is not billable. That cost cannot be passed to you.
For electronic copies of records stored electronically, many providers use a flat fee of up to $6.50 per request. HHS guidance sets this figure as an option for providers that do not want to calculate actual or average labor costs for each request; it covers labor, supplies, and postage combined. It is not a cap on all possible fees. A provider can choose to calculate actual costs instead, and the result may be higher or lower.
Per-page charges for paper copies vary, and state laws often set their own caps. Ask for a cost estimate before the provider produces the copies. Some providers waive fees for small requests or for records sent directly to another treating physician.
One thing a provider cannot do is refuse your access request because you owe money on a medical bill. Your right to your records exists independently of any outstanding balance.
When a Provider Can Say No
Most requests must be granted. Denials are limited and fall into two groups.
Some denials carry no appeal. Psychotherapy notes — a therapist’s personal session notes kept separate from the rest of the record — are excluded from your right of access. Routine clinical information such as prescriptions, session dates, diagnoses, treatment plans, and progress summaries is not considered psychotherapy notes and must still be provided. Information compiled for a lawsuit or legal proceeding is also excluded, as are certain requests by inmates, participants in ongoing clinical trials who agreed to a temporary suspension of access, records subject to the federal Privacy Act, and information obtained from a confidential source where disclosure would reveal that source.
Other denials can be appealed. If a provider denies access on the ground that release is reasonably likely to endanger your life or safety, or another person’s, or because a record references another person and disclosure could cause substantial harm, the provider must offer review by a different licensed healthcare professional who was not involved in the original decision.
Every denial, appealable or not, must be in writing, explain the basis for the refusal, and describe your right to file a complaint. If the denial applies only to part of your records, the provider must grant access to everything else.
If the Provider Doesn’t Comply
If a provider ignores your request, misses the deadline, overcharges you, or denies access without a valid reason, you can file a complaint with the HHS Office for Civil Rights (OCR). Right-of-access violations have been an OCR enforcement priority since 2019, with settlement amounts in resolved cases ranging from $15,000 for small practices to $200,000 for larger institutions.
File online through the OCR Complaint Portal at ocrportal.hhs.gov. You can file for yourself or on behalf of someone else. The complaint must be submitted within 180 days of when you knew or should have known about the violation, though OCR can extend that deadline for good cause. Include your name and contact information — anonymous complaints are not investigated — along with a description of what happened, when, and which provider was involved.
OCR reviews each complaint to decide whether it has authority to investigate. Not every complaint leads to a full investigation, but a well-documented submission with copies of your original request and proof of the submission date gives OCR what it needs to act.