Is It Illegal to Withhold Medical Records? HIPAA Rights and Denials

In almost all cases, no — it is not legal for a healthcare provider to withhold your medical records. The HIPAA Privacy Rule gives you an enforceable federal right to inspect and receive copies of the health information a provider or health plan keeps about you, and a provider who refuses without a legally recognized reason can face civil monetary penalties starting at $145 per violation and climbing past $2 million a year.¹ The exceptions are narrow, and the federal government actively investigates patient complaints about denied access.

What Records You Have a Right To

HIPAA covers a wide range of information used in decisions about your care: physician notes, diagnoses, treatment plans, lab results, medical images, billing records, and insurance information.² The right reaches nearly all providers who conduct business electronically, along with hospitals, clinics, pharmacies, nursing homes, and health plans.³

Your access right lasts as long as the provider keeps the records. Age of the record doesn’t matter, and neither does the format or who originally created it.²

How to Request Your Records

Put the request in writing. That creates a paper trail showing what you asked for and when, which matters if you later need to file a complaint. Include your full name, date of birth, and contact information so the provider can verify you. Specify what you want (lab results, imaging, consultation notes) and the date range. If you want an electronic copy, say so — providers must supply records in the format you ask for when they can reasonably produce them that way.²

How Long a Provider Has to Respond

Providers must act within 30 calendar days. They can take up to 30 additional days only if they notify you in writing during the first 30-day window, explain the reason for the delay, and give you a date by which they will finish.⁴ If 60 days pass with no records and no written explanation, the provider is in violation.

What They Can Charge

A provider can charge a reasonable, cost-based fee covering the labor to make copies, supplies like paper or USB drives, and postage if you want records mailed. They cannot charge you for time spent searching for or retrieving the records.² For electronic copies of electronically maintained records, many providers use a flat fee option capped at $6.50 per request, which covers all labor, supplies, and postage.⁵ If a provider quotes you a large per-page charge, ask about that flat fee alternative.

Sending Records to Someone Else

You can direct a provider to send your records to a third party — another doctor, a lawyer, a family member. The request must be in writing, signed, and must clearly identify the recipient and where to send the records.⁶ A scan, a faxed copy of your signed request, or an electronically signed request through a patient portal all work.

When a Provider Can Legally Say No

The right of access is broad but not absolute. Federal regulations list specific grounds for denial, and they cannot be used as a blanket policy. The rules split denials into two categories: unreviewable (final) and reviewable (you can demand a second opinion from another licensed professional).⁷

Final (Unreviewable) Denials

Psychotherapy notes kept separate from your main record by a mental health professional. This is narrow. It does not cover your diagnosis, treatment plan, medications, session dates, or progress summaries, all of which you are still entitled to.⁸
Materials compiled specifically for a lawsuit or other legal action. Your underlying health records are not withholdable just because litigation exists.
An inmate’s request, where providing records would jeopardize the safety, security, or order of a correctional facility.⁷
Research records during an active clinical trial that includes treatment, if you agreed to a temporary suspension of access when you enrolled.⁹
Information obtained from a non-provider source under a promise of confidentiality, when releasing it would likely reveal who supplied it.

Reviewable Denials

For these, you can insist that a different licensed healthcare professional (not the one who made the original decision) review the denial:⁷

A licensed professional has determined the records are reasonably likely to endanger your life or physical safety, or someone else’s.
The records reference another person, and a professional has determined access could harm that person.
A parent, guardian, or other personal representative is requesting the records, and the provider reasonably believes the patient has been or may be subject to domestic violence, abuse, or neglect by that representative.¹⁰

The distinction matters. On a reviewable denial, insist on the second-opinion review first, because the provider is required to offer it. On an unreviewable denial, your main recourse is a federal complaint.

What to Do if You’re Denied

Start with the provider’s privacy officer. Most healthcare organizations have someone designated for HIPAA compliance, and denials caused by miscommunication or staff error often get resolved at that level.

If the privacy officer upholds the denial or the provider ignores you entirely, file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights (OCR), which enforces the HIPAA Privacy Rule. You can submit online, by mail, or by email.¹¹

File within 180 days of learning about the violation. The OCR can extend this deadline for good cause.¹² Name the provider, describe what happened, and explain why you believe your access rights were violated.

What Providers Risk for Refusing

The OCR has made access violations a priority. Through its HIPAA Right of Access Initiative, the agency has pursued multiple enforcement actions specifically against providers who failed to give patients their records. One case against a children’s hospital settled for $80,000 plus a corrective action plan.¹³

Beyond settlements, the OCR can impose civil monetary penalties in four tiers based on fault. The 2026 inflation-adjusted amounts:¹

Did not know and could not reasonably have known: $145 to $73,011 per violation, up to $2,190,294 per year.
Reasonable cause, not willful neglect: $1,461 to $73,011 per violation, up to $2,190,294 per year.
Willful neglect, corrected within 30 days: $14,602 to $73,011 per violation, up to $2,190,294 per year.
Willful neglect, not corrected within 30 days: $73,011 to $2,190,294 per violation, up to $2,190,294 per year.

Most access-denial cases fall in the first two tiers and resolve through settlement rather than maximum penalties, but stonewalling a records request is a financially risky choice.

Electronic Records and Information Blocking

HIPAA is not the only law protecting your access. The 21st Century Cures Act created a separate prohibition on “information blocking” — practices that interfere with access to, exchange of, or use of electronic health information. It applies to healthcare providers, health IT developers, and health information networks.¹⁴

A provider engages in information blocking when it knowingly takes actions that are unreasonable and likely to prevent or discourage electronic access. Health IT developers and information networks face civil monetary penalties of up to $1 million per violation. Providers face “disincentives” tied to Medicare payments: hospitals can lose “meaningful EHR user” status and see reduced Medicare payment updates; clinicians can receive a zero score in the Promoting Interoperability category under the Merit-based Incentive Payment System, cutting their Medicare reimbursement; accountable care organizations can be removed from or denied participation in the Medicare Shared Savings Program for at least a year.¹⁵

If you think a provider is blocking your access to electronic health information, file through the Information Blocking Portal on HealthIT.gov. Complaints are reviewed by the Office of the National Coordinator for Health IT (ONC) and the HHS Office of Inspector General, and you can submit anonymously.¹⁶

Fixing Errors Once You Have Your Records

You may find mistakes when the records arrive: a wrong diagnosis code, an incorrect medication, a factual error in a provider’s notes. HIPAA gives you the right to request an amendment to any protected health information a provider maintains about you.¹⁷

Submit the request in writing and explain why you believe the information is wrong or incomplete. The provider must act within 60 days, with a single 30-day extension available if they notify you in writing.

A provider can deny an amendment only on limited grounds: the information is accurate and complete, the provider did not create the record (and the originator is still available), or the information isn’t part of the records you’re entitled to access. On denial, the provider must give you the reason in writing and tell you about your right to file a statement of disagreement that will be attached to the record from that point on.¹⁷

That last option matters more than it sounds. Even when a provider refuses to change a record, your written disagreement becomes part of the file. Any future provider or health plan receiving those records also receives your statement. It is not a correction, but it puts a permanent counterpoint in the record.

1
Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
2
U.S. Department of Health & Human Services. Individuals’ Right under HIPAA to Access their Health Information
3
U.S. Department of Health and Human Services. Your Rights Under HIPAA
4
U.S. Department of Health and Human Services. How Timely Must a Covered Entity Be in Responding to Individuals’ Requests for Access to Their PHI
5
U.S. Department of Health and Human Services. Is $6.50 the Maximum Amount That Can Be Charged
6
U.S. Department of Health and Human Services. Can an Individual Through the HIPAA Right of Access Have His or Her PHI Sent to a Third Party
7
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
8
U.S. Department of Health & Human Services. Does HIPAA Provide Extra Protections for Mental Health Information Compared With Other Health Information
9
U.S. Department of Health and Human Services. What Does the HIPAA Privacy Rule Say About a Research Participant’s Right of Access to Research Records or Results
10
U.S. Department of Health & Human Services. HIPAA Privacy Rule and Sharing Information Related to Mental Health
11
U.S. Department of Health and Human Services. Filing a Health Information Privacy Complaint
12
U.S. Department of Health and Human Services. How to File a Health Information Privacy or Security Complaint
13
U.S. Department of Health and Human Services. OCR Resolves Twentieth Investigation in HIPAA Right of Access Initiative
14
Office of the Law Revision Counsel. 42 USC 300jj-52 – Information Blocking
15
Federal Register. 21st Century Cures Act – Establishment of Disincentives for Health Care Providers That Have Committed Information Blocking
16
HealthIT.gov. Information Blocking
17
eCFR. 45 CFR 164.526 – Amendment of Protected Health Information