To get your Medicaid records, contact two offices: your state Medicaid agency (or your managed care plan) for eligibility, enrollment, and claims data, and the healthcare provider who treated you for clinical records like doctor’s notes, lab results, and imaging. Under the HIPAA Privacy Rule, both must act on your request within 30 days. Knowing how to get Medicaid records comes down to matching each type of record to the office that actually holds it.
Which Office Holds Which Records
Medicaid records aren’t kept in one place, and a single request rarely gets you everything.
- Eligibility and enrollment records — your application, coverage dates, aid category, and the financial information used to determine whether you qualify — sit with your state Medicaid agency.
- Claims and billing records, including every service Medicaid paid for, the billed amounts, and procedure codes, are held by your state agency or, if you’re enrolled in managed care, by the managed care organization administering your benefits.
- Medical treatment records (clinical notes, diagnoses, labs, imaging) are created and stored by the provider who treated you. The state Medicaid office does not have these.
- Tax documents: your state Medicaid agency issues IRS Form 1095-B each year as proof of minimum essential coverage. For a replacement, contact the state Medicaid agency or your local eligibility office; the agency must furnish a copy within 30 days of your request.1Internal Revenue Service. 2025 Instructions for Forms 1094-B and 1095-B
If you want a full picture of your Medicaid history, plan on contacting at least two organizations.
Requesting Eligibility and Claims Records
Start with your state Medicaid agency. Most states run a client portal where you can check eligibility, view claims, and request documents online.2Medicaid.gov. Where Can People Get Help With Medicaid and CHIP Expect to complete a records request or authorization form and verify your identity with a government-issued photo ID. States accept requests by different combinations of phone, mail, fax, and online portal.
If you’re in a managed care plan, the plan itself may hold your claims data and handle your request separately from the state. Ask the state agency who has your specific records if you’re not sure.
Requesting Medical Treatment Records From Providers
Clinical records must come from the provider who created them. Contact the provider’s health information management or medical records department and ask for their records request form.3U.S. Department of Health & Human Services. Your Medical Records
A provider must act on your request within 30 days. They may take a single 30-day extension, but only after sending you a written explanation of the delay and a date by which they’ll finish.4eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information To speed things up, name specific date ranges and record types instead of asking for “everything.”
You can request the format you want. If a provider stores your records electronically, they generally must give you an electronic copy on request. A provider cannot withhold your records because of an unpaid bill.5U.S. Department of Health & Human Services. Right to Access and Research
Electronic Access Through Apps and Portals
Under the CMS Interoperability Rule, Medicaid fee-for-service programs and Medicaid managed care plans must make your claims, encounter data, and clinical information (including lab results) available through a standardized Patient Access API. You can use a third-party health app of your choice to pull the data. Records with dates of service from January 1, 2016 forward are available through the API.6Centers for Medicare & Medicaid Services. Patient Access API
Starting January 1, 2027, Medicaid programs must also make prior authorization decisions available through the API, including the status, approval or denial date, and the specific reason for any denial.7Federal Register. Advancing Interoperability and Improving Prior Authorization Processes Many providers also offer patient portals with immediate access to test results and clinical notes under the 21st Century Cures Act.
Requesting Records for Someone Else
HIPAA requires covered entities to treat a “personal representative” as if they were the patient for access purposes. Who counts depends on the situation.
Parents and Guardians of Minors
If you have legal authority to make healthcare decisions for a minor child, providers and health plans must treat you as the patient for records access. One carve-out: if your minor lawfully received care without your consent (some state laws allow this for services like reproductive health or substance abuse treatment), you may not be able to access records tied to that specific care.8eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information General Rules
Adults With Power of Attorney or Guardianship
If you hold a healthcare power of attorney or have been appointed legal guardian for an adult, you can access that person’s records to the extent your legal authority covers healthcare decisions. Bring a copy of the power of attorney or guardianship order. A provider can refuse to treat you as a personal representative in rare cases where doing so could endanger the patient, such as suspected abuse or domestic violence.9U.S. Department of Health & Human Services. If Someone Has a Health Care Power of Attorney for an Individual Can They Obtain Access to That Individuals Medical Record
Executors of a Deceased Beneficiary’s Estate
If you’re the legally authorized executor or administrator of a deceased Medicaid beneficiary’s estate, providers and health plans must treat you as a personal representative. Your authority extends as far as state probate or estate law allows.10U.S. Department of Health & Human Services. How Can Family Members of a Deceased Individual Obtain the Deceased Individuals Protected Health Information Provide documentation of your appointment, such as letters testamentary or letters of administration.
What It Costs
Providers and health plans can charge a reasonable, cost-based fee for copies. That fee may cover only three things: labor for copying, supplies (paper or electronic media), and postage if you asked for mailing.4eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
Organizations that don’t want to calculate actual costs for electronic copies can instead charge a flat fee of no more than $6.50 per request. This is an optional shortcut, not a cap; some entities calculate their actual costs and arrive at a different figure.11U.S. Department of Health & Human Services. $6.50 Flat Rate Option Is Not a Cap on Fees In most cases you won’t be charged for viewing, searching, or downloading records through an electronic portal. State laws may set additional per-page limits, and those limits vary.
If Your Request Is Denied
Providers can deny access to your records only on narrow grounds. The most common legitimate reasons are requests for psychotherapy notes, information compiled for a legal proceeding, or a licensed professional’s determination that access would endanger you or another person. In that last scenario, you can ask for a review by a different licensed professional at the same organization.12U.S. Department of Health & Human Services. Individuals Right Under HIPAA to Access Their Health Information
Any denial must come to you in writing, in plain language, and must explain the reason, your right to review, and how to file a complaint. You have two avenues if you think the denial is wrong.
First, request an internal review. The organization must refer your case to a designated reviewing official who was not involved in the original denial. That official must decide within a reasonable time and notify you in writing.12U.S. Department of Health & Human Services. Individuals Right Under HIPAA to Access Their Health Information
Second, file a complaint with the HHS Office for Civil Rights (OCR). You can file online through the OCR Complaint Portal, by email to OCRComplaint@hhs.gov, or by mailing the HIPAA complaint form to OCR’s centralized case management office in Washington, D.C. Your complaint must name the entity, describe what happened, and be filed within 180 days of when you became aware of the violation. OCR may extend the deadline for good cause.13U.S. Department of Health & Human Services. How to File a Health Information Privacy or Security Complaint
Separately, the 21st Century Cures Act makes it illegal for healthcare providers and health IT developers to engage in “information blocking,” practices that interfere with your access to electronic health information. Health IT developers and health information networks face penalties of up to $1 million per violation, and healthcare providers face federal disincentives established by HHS rule.14HealthIT.gov. Information Blocking
How Long Records Are Kept
Your records won’t exist forever. Federal rules set minimum retention periods, though many states require longer.
Healthcare providers participating in Medicare and Medicaid must maintain medical records for at least seven years from the date of service.15Centers for Medicare & Medicaid Services. Medical Record Maintenance and Access Requirements State Medicaid agencies must keep eligibility and enrollment records for the entire time your case is active, plus a minimum of three years after it closes.16eCFR. 42 CFR 431.17 – Maintenance of Records For beneficiaries who received long-term care services subject to estate recovery, the state must retain records until the estate recovery process is complete, which can take decades.
If you think you’ll need your records later, request copies while the provider or agency still has them. Once retention periods expire, records may be lawfully destroyed.
Fixing Errors Once You Have the Records
If your Medicaid records contain inaccurate or incomplete information, you have the right to request an amendment. This covers eligibility data at a state agency, claims data at a managed care plan, and medical records at a provider.
Submit a written request to the organization that holds the record. Identify the specific information you believe is wrong, explain why, and describe the correction you want. The organization must respond within 60 days and may take one 30-day extension after notifying you in writing of the reason for delay.17eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
If the organization agrees, it appends the correction to your record. The original entry usually stays with a note linking to the amendment; your old information isn’t erased. If the request is denied, you can submit a written statement of disagreement, which becomes a permanent part of your record along with the organization’s denial.17eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
Amending a record is different from appealing a Medicaid decision. Correcting a factual error goes through the amendment process above. Challenging an eligibility or coverage decision goes through a state Medicaid fair hearing, and the records you’ve collected are what you’ll use to support your case there.