Do You Have a Right to Your Medical Records? HIPAA Rules Explained

Meta description: Learn what medical records you can access under HIPAA, how to request them, when a provider may deny access, and what to do if a request is delayed.

In most cases, yes: You have a legal right to inspect or get a copy of your medical records. The federal HIPAA Privacy Rule gives individuals access to much of the health information held by covered health care providers and health plans. That right has limits, and state law may provide additional protections or faster access. Knowing which records are covered, how to submit a request, and what to do if a provider says no can make the process more straightforward.

What Does HIPAA Give You the Right to Access?

Under the HIPAA Privacy Rule, a person generally has the right to inspect and obtain a copy of protected health information in a designated record set. This is a legal term for records maintained by or for a covered health care provider or health plan that are used, in whole or in part, to make decisions about individuals.

For a medical provider, the designated record set commonly includes medical and billing records, clinical laboratory results, imaging reports, appointment and treatment records, and information used to make decisions about care. A health plan’s records may include enrollment, claims, payment, and case-management information. The exact contents depend on how the organization keeps and uses its records.

Access generally includes the right to review the information in person or receive a copy. A patient may also ask the organization to send a copy to another person or organization, such as a new doctor, by making a written, signed request that identifies the recipient and where to send the records.

The right applies to records in paper or electronic form. If information is maintained electronically, a patient can generally request an electronic copy. HIPAA also allows a patient to ask for the information in a particular format, such as a PDF, if it is readily producible in that format. If it is not, the provider and patient can agree on another readable format.

Which Records May Be Outside the Access Right?

HIPAA access rights are broad, but they do not cover every item a health organization might possess. The rule generally excludes certain information from the designated record set, including:

• Psychotherapy notes: A therapist’s separately maintained notes documenting or analyzing the contents of a counseling conversation may be excluded. This exception does not generally cover a diagnosis, treatment plan, medication information, test results, or progress summaries that are part of the medical record.
• Information prepared for a legal proceeding: Records compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding are excluded from the access right.
• Information that is not part of the designated record set: A provider may not be required to give access to every internal document, draft, or administrative item it holds if the item is not used to make decisions about the patient.

These exclusions are specific. A provider cannot deny access to an entire medical record simply because some information in it falls under an exception. It should identify the basis for withholding information and provide access to the remaining material when the rules require it.

Who Can Request Medical Records?

An adult generally has the right to request their own records. A person can also authorize another individual or organization to receive them. A valid authorization should clearly identify the information to be shared, the person or organization receiving it, and the purpose or scope of the disclosure, along with the required signature and date. HIPAA generally requires an authorization to include an expiration date or event.

A patient may also have a personal representative who can act on their behalf. Depending on applicable law, that could be a parent or guardian, someone with a health care power of attorney, or another person legally authorized to make health care decisions. A provider may ask for documentation showing the person’s authority.

Rules involving children and teenagers can be more complicated. Parents usually have access to a minor child’s records as personal representatives, but exceptions may apply when state law allows a minor to consent to particular care without parental involvement, or when a court or another legal arrangement limits a parent’s authority. A provider may also deny a parent access if it reasonably believes doing so could endanger the child. State law and the type of treatment matter, so families may need to ask the provider how the rules apply.

HIPAA does not automatically give relatives access to a living adult’s records. A spouse, adult child, or other family member generally needs the patient’s permission or legal authority. Separate rules may permit limited disclosures to family involved in care, but those do not amount to a general right to obtain the full record.

How to Request a Copy of Medical Records

Providers and health plans may have their own request forms and procedures. The process is usually simple, but a complete request can help avoid delays.

1. Contact the organization that holds the records. Ask the medical records, health information management, or privacy office how to submit a request. A clinic, hospital, laboratory, and health plan may maintain separate records.
2. Specify what is needed. Identify the dates of service, types of records, and whether the request is for a paper or electronic copy. A request can cover the full designated record set or particular items, such as imaging reports or billing records.
3. Choose how to receive the records. State whether the records should be picked up, mailed, securely delivered electronically, or sent directly to another provider. Include the recipient’s correct contact information.
4. Complete required identity checks. The organization may verify the requester’s identity and authority. It can use reasonable procedures but should not create unreasonable barriers to access.
5. Keep a copy of the request. Save the submitted form, confirmation, and any messages about fees or timing. This documentation can help if the request is delayed or denied.

Many health systems provide records through a patient portal. A portal can be a convenient way to view or download some information, but it may not include every record in the designated record set. If a particular document is missing, a patient can make a formal access request.

How Long Can a Provider Take?

HIPAA generally requires a covered entity to act on an access request within 30 calendar days of receiving it. If the organization cannot meet that deadline, it may take one extension of up to 30 additional calendar days. It must provide a written explanation for the delay and state the date by which it expects to complete the request.

The deadline is not a routine allowance to wait 60 days. An extension is available only when the organization needs more time and properly notifies the requester within the initial period. State law may require a shorter response time, and the shorter applicable requirement may control.

If a provider says it needs more time, the patient can ask when the request was received, whether the organization issued a written extension notice, and when the records will be available. Keeping communication in writing can make it easier to track the timeline.

Can a Provider Charge for Medical Records?

A provider may charge a reasonable, cost-based fee for copying and delivering records. Under HIPAA, the fee may include labor for copying, supplies such as paper or an electronic storage device, and postage if the records are mailed. It may not include costs associated with searching for or retrieving the records, maintaining the system, or verifying the requester’s identity.

For an electronic copy, the organization may calculate the fee using actual allowable labor and supply costs, or it may use a permitted flat fee of no more than $6.50 when that option is appropriate under federal guidance. That figure is not a universal cap for every method of calculating a fee. State law may impose stricter limits, and some states restrict charges for records sent to a patient or another provider.

A patient can ask for the fee estimate before the organization prepares the copy. If the amount seems unusually high, ask for an itemized explanation and the method used to calculate it. HIPAA does not require a covered entity to provide a free copy in every situation, though state rules or the organization’s own policies may do so.

When Can Access Be Denied?

A denial must fit a ground allowed by the HIPAA Privacy Rule. For example, a provider may deny access to psychotherapy notes or information prepared for a legal proceeding. It may also deny access in certain situations where a licensed health care professional determines that access is reasonably likely to endanger the life or physical safety of the patient or another person.

Some denials are reviewable, meaning the patient can request that a qualified health care professional who did not make the original decision review it. This review right applies to certain denials based on potential danger or harm. It does not apply to every permitted denial, including the exclusion for psychotherapy notes.

When a denial is required to be reviewable, the organization must explain how to request a review. A patient can ask the privacy office whether the denial is reviewable and how to submit the request. The reviewing professional’s decision must be followed by the organization.

If only part of a record can lawfully be withheld, the provider generally must give access to the rest. A denial should be in writing and explain the reason, the basis for the decision, and any available review or complaint process. A broad statement such as “the records are confidential” does not by itself explain whether a specific HIPAA exception applies.

What to Do If a Request Is Ignored or Denied

First, contact the organization’s medical records department or privacy officer. Confirm that it received the request, ask whether anything is missing, and request a written status update. If the organization denied access, ask for the specific legal basis and whether a review is available.

If the issue remains unresolved, a person may file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights (OCR), which enforces the HIPAA Privacy Rule. OCR generally requires a complaint to be filed within 180 days of when the person knew or should have known about the problem, although the agency may extend the deadline for good cause. Complaints can be submitted through OCR’s online portal or by mail, and should explain what happened and identify the organization involved.

A complaint may also be made to a state agency that regulates health care providers or privacy, depending on the issue and state. HIPAA itself does not generally provide an individual with a right to sue a provider for damages solely for a HIPAA violation. State privacy, consumer protection, or medical-records laws may offer separate options, so legal advice may be useful in a serious dispute.

HIPAA Rights and State Medical Records Laws

HIPAA sets a federal baseline for covered entities, but it does not prevent states from giving patients stronger access rights. State law may set shorter response deadlines, define additional records that must be provided, or limit copying fees. When a state law is more protective of access and does not conflict with HIPAA, the stronger state protection may apply.

Not every organization that handles health information is covered by HIPAA. The federal Privacy Rule generally applies to health plans, health care clearinghouses, and health care providers that conduct certain electronic transactions, as well as their business associates when applicable. An app, wearable-device company, or consumer service that is not acting for a covered entity may fall outside HIPAA, even if it stores sensitive health information. Other federal or state privacy laws may still apply.

For a particular request, the most useful questions are: Does the organization hold the information? Is it a HIPAA-covered entity or business associate? Is the information part of the designated record set? Does a specific exception apply? And does state law provide a shorter deadline or lower fee? These distinctions help explain why access rules can differ between a hospital, a health plan, and a consumer health app.

Practical Checklist for Getting Records

• Use the provider’s preferred form, but ask whether another written request is acceptable.
• Describe the records and dates clearly, and name any authorized recipient.
• Request the format that is most useful, such as a secure electronic copy.
• Ask for a fee estimate and keep proof of submission.
• Track the 30-day federal response period and any written extension notice.
• If access is denied, request the written reason and ask about review or complaint options.

For official information, see the HHS guidance on individuals’ right to access medical records and the HIPAA access rule at 45 C.F.R. § 164.524. These resources explain federal requirements; state law and the facts of an individual request can affect how those requirements apply.