To obtain pharmacy records, submit a written request — usually on the pharmacy’s authorization form — to the location that filled your prescriptions, along with a government-issued ID. Under HIPAA, the pharmacy has 30 days to give you the records or explain why it can’t, and it can only charge you the actual cost of copying.1eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information The rest is knowing what to ask for, what to bring, and what to do if the pharmacy pushes back.
What You Can Ask For
Pharmacies are covered entities under HIPAA, so you have the right to inspect or get copies of the protected health information they hold about you.2Department of Health and Human Services. Individuals’ Right Under HIPAA to Access Their Health Information 45 CFR 164.524 That covers your prescription history, medication names and dosages, refill dates, prescribing physician information, billing records, and any patient profile data on file. You can also direct the pharmacy to send a copy straight to a doctor, attorney, or anyone else you name.
Two narrow categories fall outside this right of access: psychotherapy notes and information the pharmacy compiled specifically for a legal proceeding.1eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information Neither typically comes up with pharmacy records. A list of what you were prescribed, when you picked it up, and what you paid is squarely within your rights.
Prepare the Request
Before you contact the pharmacy, pull together:
- Full name, date of birth, current address, and phone number exactly as the pharmacy has them on file.
- The scope of what you want. Everything on file? A specific date range? Just billing? Being specific speeds things up.
- A government-issued photo ID for identity verification.
Most pharmacies require a completed authorization form, often titled “Authorization for Release of Protected Health Information.” Chains commonly post it on their websites, and any store will hand one over at the counter. Fill in the patient’s name and date of birth exactly as they appear in the pharmacy’s system, name the date range, and describe the records you want. Mismatched names, missing signatures, and vague date ranges are the most common reasons requests stall, so check the form twice before you send it.
Asking for Someone Else’s Records
HIPAA lets a “personal representative” exercise the same access rights as the patient. This means someone with legal authority under state law to make healthcare decisions for the person — a parent for a minor child, a court-appointed guardian, or the holder of a healthcare power of attorney.2Department of Health and Human Services. Individuals’ Right Under HIPAA to Access Their Health Information 45 CFR 164.524 Bring the legal document proving your authority along with your own ID.
Records for Someone Who Has Died
If the patient has passed away, the executor or administrator of the estate, or anyone else with legal authority to act for the deceased under applicable law, is treated as a personal representative for records connected to that role.3eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information Expect to provide a death certificate together with letters testamentary, letters of administration, or a court order. Being a close family member alone is not enough; the pharmacy needs proof of legal authority.
How to Submit It
Depending on the pharmacy, you can usually submit the request in one of three ways:
- In person at the pharmacy counter with your form and ID. Often the fastest route for simple requests.
- By mail or fax to the pharmacy’s records department, with a short cover letter that includes your contact information.
- Through an online patient portal or app. Many chains let account holders view and download prescription history. This won’t always be as detailed as a formal records request, but it’s often enough for basic medication history.
If the pharmacy no longer has what you need, your health insurer keeps its own records of prescription claims it processed, and the same HIPAA right of access applies to those records. That’s a useful backup when a pharmacy has closed or purged older files.
Timing and Fees
The pharmacy has 30 days from receiving your request to either provide the records or issue a denial. It can take one 30-day extension, but only by notifying you in writing with the reason and a specific date by which it will respond.1eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information Only one extension is allowed, so 60 days is the ceiling.
Fees must be reasonable and cost-based. That means the labor of copying, supplies like paper or a USB drive, and postage if you ask for the records mailed.1eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information Search-and-retrieval time, overhead, and profit cannot be added in. For electronic copies of electronic records, some pharmacies use a flat fee of up to $6.50 instead of tallying actual costs, but that flat rate is one option, not a cap; a pharmacy with higher actual costs can charge more.4Department of Health and Human Services. $6.50 Flat Rate Option Is Not a Cap on Fees If the bill looks high, ask for a breakdown of how the pharmacy calculated it.
How Far Back Records Go
Your right of access only reaches records the pharmacy still has. Federal law requires at least two years of retention for controlled substances. Most state pharmacy boards set longer periods, commonly three to seven years for prescription records generally. Records from a decade ago may simply be gone, and HIPAA can’t recover what no longer exists. If you want older records, request them sooner rather than later.
If the pharmacy has closed or changed hands, its records were likely transferred to a successor pharmacy or to the state board of pharmacy. The state board can usually point you to where older files ended up.
If the Pharmacy Denies or Ignores You
Most real-world denials are mundane and fixable: an incomplete form, a name or date of birth that doesn’t match the system, or ID the pharmacy considers inadequate. Read the denial notice, correct the problem, and resubmit.
Some denials are on the merits. A licensed health professional may determine that access could endanger someone’s life or safety, or that access by a personal representative could substantially harm the patient. In those cases, you can ask for a different licensed professional, one who wasn’t involved in the original decision, to review it.5eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information Other denials — for records that fall outside the right of access, or information a non-provider gave the pharmacy under a promise of confidentiality — do not carry an internal appeal.
When a pharmacy ignores a valid request, charges what looks like an inflated fee, or otherwise refuses to comply, start with the pharmacy’s corporate office or compliance department. Large chains have formal complaint-handling processes and often resolve issues at that level. If that fails, file a written complaint with the U.S. Department of Health and Human Services Office for Civil Rights. The complaint must name the pharmacy and describe what it did or failed to do, and you generally have 180 days from when you knew or should have known about the violation, though HHS can waive that deadline for good cause.6eCFR. 45 CFR 160.306 – Complaints to the Secretary Filing is free and doesn’t require a lawyer.7U.S. Department of Health and Human Services. Filing With OCR
Fixing Errors in What You Receive
If the records show a medication you never took, a wrong dosage, or the wrong prescriber, you have the right to request an amendment. Submit it in writing, spell out what’s inaccurate and why, and attach anything that supports the correction, such as a prescription label or a letter from your doctor.8eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
The pharmacy has 60 days to act, with one possible 30-day extension on written notice.9eCFR. 45 CFR 164.526 – Amendment of Protected Health Information If the pharmacy agrees, it must make the correction and notify anyone who received the wrong version. If it refuses, it must explain why in writing, and you can submit a statement of disagreement that stays in your file going forward.