How to get your medical records

The HIPAA Privacy Rule gives you the right to see and get a copy of your health information from health care providers and health plans. That includes most doctors, hospitals, clinics, labs, pharmacies, therapists, and dentists.

• What's included: visit notes, test and lab results, imaging reports and images, medication lists, immunizations, and billing records — anything the provider uses to make decisions about you.
• Your choice of format: if the records are kept electronically, you can ask for an electronic copy, and the provider should give it to you in the format you ask for if they can readily produce it (for example, PDF files).
• Your choice of delivery: mail, email, a patient portal, or pick-up. You can ask for regular email even if it isn't encrypted, as long as you accept the risk.
• Sending to someone else: you can also ask, in writing, for a copy to go directly to another person or organization. Fee rules can differ for these requests, so ask about cost first.

1. 1

   Find out who has the records

   Usually the practice or hospital where you were seen. If a doctor works for a larger group or health system, the records often sit with the group. Search the directory for the office's address, phone, and fax.

2. 2

   Check for a patient portal

   Many providers post recent results and visit notes in an online portal. If that's all you need, it's the fastest route.

3. 3

   Ask in writing

   Call the office and ask for the medical records or health information management (HIM) department, and ask how they accept requests. If they have their own form, it's often fastest to use it; a letter like ours also works in most cases.

4. 4

   Send it and keep a copy

   Fax, mail, email, or hand-deliver your request. Note the date you sent it — the 30-day clock starts when they receive it.

5. 5

   Follow up

   If you haven't heard back in two to three weeks, call to check on it. Ask whether there's a fee and when to expect the copy.

• Timing: the provider must act on your request within 30 calendar days of receiving it. They can take one extension of up to 30 more days, but only if they tell you in writing, within the first 30 days, why and when you'll get it. Some states require faster responses.
• Cost: providers may charge a reasonable, cost-based fee that covers the labor of making the copy, supplies like paper or a USB drive, and postage. They can't charge you for searching for or retrieving your records.
• Flat fee option: for electronic copies of records kept electronically, federal guidance lets providers charge a flat fee of up to $6.50 instead of calculating their actual costs.
• Ask first: it's reasonable to ask for the fee up front — our letter does this for you.

A provider can only deny access for a few specific reasons, and a denial must be in writing, explain why, and tell you how to complain. For some denials, you can ask for a review by another licensed health professional.

• Call the records department and ask about the status — most delays are paperwork, not refusals.
• Ask to speak with the practice's privacy officer, who is responsible for HIPAA compliance.
• If you still don't get your records, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights, generally within 180 days. File an OCR complaint (opens in a new tab)