To find medical malpractice records, you have to check four different places, because no single database holds them all. Your own treatment records sit with the provider that treated you. Lawsuit filings live in court systems. Discipline against a doctor’s license is tracked by state medical boards. And a federal database, the National Practitioner Data Bank, holds malpractice payment history but is closed to the general public with only narrow exceptions. Knowing which source holds what, and how to request it, is what separates a productive search from a dead end.
Getting Your Own Medical Records
If you were the patient, start with the provider. HIPAA’s Privacy Rule gives you a legal right to inspect and obtain copies of your own health information held by hospitals, clinics, and individual practitioners.1U.S. Department of Health and Human Services (HHS.gov). Individuals’ Right under HIPAA to Access their Health Information 45 CFR 164.524 That includes physician notes, diagnostic test results, imaging, medication logs, and nursing observations. These records are the factual backbone of any malpractice investigation because they document what actually happened during your care.
Contact the provider’s medical records or health information department and ask for its authorization form. Specify which records you want, the date range, and where to send copies. Be precise. A request for “all records from January 2024 through March 2024, including operative reports and anesthesia records” costs less and arrives faster than a blanket request for your entire file.
The provider must act on your request within 30 days. It can take one additional 30-day extension, but only after sending you a written explanation and a new deadline.2eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information So the outside limit is 60 days.
What Copies Should Cost
Providers can charge a reasonable, cost-based fee, but HIPAA limits what “reasonable” means. The fee can cover only the labor to copy the records, supplies like paper or a USB drive, and postage. It cannot include the cost of searching for or retrieving the records, maintaining the storage system, or verifying your identity.1U.S. Department of Health and Human Services (HHS.gov). Individuals’ Right under HIPAA to Access their Health Information 45 CFR 164.524 For electronic copies of records already stored electronically, providers may charge a flat fee of no more than $6.50. Many states set per-page caps for paper copies, typically between $0.25 and $1.00 per page.
Two Things HIPAA Won’t Get You
Psychotherapy notes — a therapist’s private session-by-session notes kept separate from the main chart — are outside the standard access right.3eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information Information compiled in anticipation of a lawsuit or administrative proceeding is also excluded. That second exception matters here: if the provider already anticipates litigation, documents its legal team creates for defense purposes may not be available through a HIPAA request.
Requesting Records for Someone Else
When the patient can’t request the records themselves, HIPAA extends the same access rights to a “personal representative” with legal authority to make healthcare decisions. Who qualifies is a matter of state law, and usually means someone named in a healthcare power of attorney, a court-appointed guardian, or a default surrogate under the state’s decision-making hierarchy.4NCBI Bookshelf. Families Caring for an Aging America Bring documentation of your authority when you make the request.
For a patient who has died, HIPAA protects the records for 50 years after death. During that period the executor or administrator of the estate can access and authorize disclosures the same way the patient could have while alive.5U.S. Department of Health and Human Services (HHS.gov). Health Information of Deceased Individuals You’ll need letters testamentary or letters of administration from the probate court.
Searching Court Records for Malpractice Lawsuits
When a malpractice suit is filed, the court file is generally a public record. It can include the complaint describing what allegedly went wrong, motions, expert reports filed as exhibits, and the final judgment or settlement terms, unless the parties sealed part of the case.
Federal Court Cases
Malpractice suits occasionally end up in federal court when the parties live in different states and more than $75,000 is at stake. Federal case records are searchable through PACER (Public Access to Court Electronic Records), which covers more than a billion filings across the federal courts.6Public Access to Court Electronic Records. Public Access to Court Electronic Records You can search by party name or case number.
PACER charges $0.10 per page, capped at $3.00 per document. If your total charges in a quarter stay at $30 or less, the fees are waived, which is usually enough room for a targeted search on one provider.7PACER. PACER Pricing – How Fees Work
State Court Cases
Most malpractice cases are filed in state court. Most state systems now offer online portals where you can search civil cases by party name or case number. What’s actually available online varies widely. Some states post full documents. Others show only the docket — a list of filings and dates — and require you to visit the courthouse or contact the clerk for copies. Court clerks can pull specific documents for a per-page or flat fee.
Knowing the doctor’s or hospital’s full legal name and an approximate date range for the lawsuit makes the search go much faster. And a warning: settled cases sometimes result in sealed files, especially when the settlement includes a confidentiality clause. You may see that a lawsuit existed without being able to read the details.
Checking State Medical Board Discipline
State medical boards license physicians and can discipline them for incompetent or unprofessional practice. When a board acts, that discipline goes on the provider’s public record. Sanctions range from reprimands and probation to license suspensions, outright revocations, and fines.8Federation of State Medical Boards. About Physician Discipline
Every state board maintains a website where you can look up a provider by name or license number and see license status and disciplinary history, usually at no charge. You have to search in each state where the provider has practiced. A doctor disciplined in one state and then licensed in another may not have the full history visible on the new state’s board site.
The Federation of State Medical Boards runs a free tool called DocInfo (docinfo.org) that lets you verify a physician’s license status and check whether any state board has taken action. It pulls from data shared by boards nationwide, which makes it a useful first stop before working through individual state sites.
The National Practitioner Data Bank
The National Practitioner Data Bank is a federal repository that tracks malpractice payments and adverse actions against healthcare providers nationwide. Hospitals, insurers, and licensing boards are required to report to it. In theory, it’s the most complete malpractice history in the country. In practice, the general public cannot look up individual providers.
Federal law makes NPDB information confidential and bars disclosure of data identifying a specific provider, except to authorized entities like hospitals, licensing boards, and certain government agencies.9Office of the Law Revision Counsel. 42 USC 11137 – Miscellaneous Provisions There are only two narrow openings for individuals. Practitioners can query their own records through a self-query, which costs $3.00 for an electronic response and returns results within minutes.10National Practitioner Data Bank. Self-Query Basics Separately, if you’ve already filed a malpractice lawsuit against a hospital, you can request NPDB information on a practitioner named in the case, but only if you can show the hospital failed to query the NPDB about that practitioner, and the information can be used only against the hospital, not against the practitioner directly.11National Practitioner Data Bank. Public Information
The NPDB does offer a free Data Analysis Tool that anyone can use to generate aggregate statistics, such as total malpractice payments by state, specialty, or year. It strips all identifying details, so you can’t look up a specific doctor, but it’s useful for context on how common certain outcomes are.12National Practitioner Data Bank. Data Analysis Tool
Records You Generally Can’t Get
Hospitals conduct internal quality reviews when something goes wrong, often called peer review. A committee of physicians examines what happened, whether care met the standard, and what should change. These reviews produce exactly the kind of candid analysis a patient would want in a malpractice investigation, which is why almost every state protects them from disclosure. All 50 states and the District of Columbia have some form of peer review privilege that shields the committee’s records and proceedings from use as evidence in litigation.13AMA Journal of Ethics. Limits to Peer Review Privilege The scope varies by state, and an attorney handling active litigation may be able to reach some of this material through discovery, but a records request from outside a lawsuit generally won’t get you the hospital’s internal investigation.
Timing: Retention Periods and the Statute of Limitations
Medical records don’t exist forever. State laws set minimum retention periods for how long providers must keep patient files. For adult patients, minimums typically range from about 5 to 10 years, though some states require longer and some providers voluntarily keep records indefinitely. Records from treatment decades ago may simply no longer exist.
Timing matters for the underlying claim too. Every state imposes a statute of limitations on malpractice lawsuits. Deadlines range from one year in the shortest states to as long as seven years, with most falling in the two-to-three-year range. Many states apply a “discovery rule” that starts the clock when you knew or should have known about the injury rather than when the treatment happened. Wait too long to collect records and the claim can expire before you ever get to use them.
If a Provider Refuses to Give You Records
A provider can deny a records request only in narrow circumstances, such as when a licensed professional determines that access would endanger your life or safety. A flat refusal with no explanation, or an excuse like “we don’t release those records,” is not a valid denial under HIPAA.
If you believe a provider has improperly denied or ignored your request, file a complaint with the U.S. Department of Health and Human Services’ Office for Civil Rights. Complaints can be submitted through the OCR Complaint Portal online or in writing.14U.S. Department of Health and Human Services (HHS.gov). Filing a Health Information Privacy Complaint OCR investigates HIPAA violations and can require the provider to turn over your records. Mentioning that you intend to file a complaint often moves things along on its own.