HIPAA Patient Access: Getting Your Own Medical Records

You can ask any doctor, hospital, laboratory, or health plan covered by HIPAA for a copy of your own records, and the covered entity must act on that request generally within thirty days, with one thirty-day extension if it tells you in writing why it needs the extra time. The right reaches the designated record set — the records actually used to make decisions about you — not every document that carries your name. A fee is allowed but must be reasonable and cost-based. The federal rules built on 42 U.S.C. 1320d and the sections that follow it set a national floor, and state records statutes sit on top of that floor.

1.How the request works

A covered entity may require the request in writing, and may verify who you are, but it cannot turn verification into an obstacle. It cannot make you appear in person when you have asked for a mailed or emailed copy, cannot require notarization, cannot demand that you explain why you want the records, and cannot route you through a web portal as the only channel.

You may ask for a particular form and format, and the entity must produce it that way if it is readily producible, including an electronic copy where the record is kept electronically. If the format you asked for is not workable, the entity has to offer a readable alternative and agree it with you rather than substituting paper without discussion. The Department of Health and Human Services explains the right in plain language on its HIPAA page for individuals.

The thirty-day clock runs from receipt of the request, not from the day the file room gets to it. Only one extension is available, it is also thirty days, and it must be accompanied by a written statement of the reason and the date the entity expects to finish. A second extension is not permitted.

Ask for everything at once. A benefits file usually needs imaging reports, laboratory results, clinician notes, and billing detail together, because a partial set forces a second request and restarts the practical timeline. That matters most when the records feed a deadline-driven process such as the five levels of Medicare appeal, where the coverage criteria the documentation has to satisfy are published by the Centers for Medicare and Medicaid Services.

2.What counts as your record

The designated record set is defined by use, not by folder. Records a provider relies on to make decisions about your care belong in it, as do a plan's enrollment, payment, claims, and case management records. Test results are yours whether or not the ordering clinician has discussed them with you yet.

Three categories sit outside the right. Psychotherapy notes, meaning the separately kept process notes of a counseling session, are excluded — the rest of the mental health chart is not. Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding is excluded. And material a facility keeps purely for quality assurance or peer review, never used to make a decision about you, is not part of the set.

Caution: An entity cannot withhold records because a treatment bill is unpaid. The permitted copying fee is a separate matter from what you owe for care, and refusing access as leverage over an outstanding balance is not a recognized ground for denial.

State law sits above this federal floor and is not preempted where it is more protective. Many states set their own response periods, some shorter, and many regulate what a provider may charge for paper copies. In Texas, for example, a separate medical records statute applies alongside HIPAA. Where the two differ, the rule more favorable to the patient generally controls.

3.What a copy may cost

The fee for a copy sent to you must be reasonable and cost-based. That is a narrow category, and the components are fixed by regulation rather than by what the copying vendor would like to charge.

• Labor for making the copy, whether the work is manual or electronic.
• Supplies, such as paper or portable electronic media, when you have asked for that medium.
• Postage, where you asked for the copy to be mailed.
• Preparing an explanation or summary of the record, but only if you agreed in advance to receive one and to be charged for it.

Search and retrieval time is not chargeable, and neither is the cost of storing the record. An entity may calculate actual costs, use a published schedule of average costs, or offer a flat fee for electronic copies of records held electronically; the ceiling on that flat fee appears in the HHS guidance for covered entities, so read the current figure there rather than trusting a vendor quote.

4.Denials and review

A denial must be in writing and in plain language, must state the basis, and must explain how to complain to the entity's privacy official and to the HHS Office for Civil Rights. If only part of the record is withheld, the rest must still be produced. Some grounds carry a right to a second clinician's look; others do not.

Note what is missing. Inconvenience is not a ground, and neither is disagreement with what you plan to do with the records, or a concern that the record will upset you, unless a licensed professional makes the specific physical-safety determination the rule describes. HIPAA carries no private right of action, so enforcement runs through a complaint rather than a lawsuit, though state law sometimes supplies its own remedy.

5.The third-party directive

Separately from asking for a copy for yourself, you can direct a covered entity to transmit a copy to a person or organization you name — a specialist, a family member, an attorney, an advocate. That directive still exists. What changed is its statutory reach and its price.

In Ciox Health, LLC v. Azar (D.D.C. 2020), a federal district court vacated the extension of the patient-rate fee limitation to third-party directives, and held that the broader directive, as applied to any information in the designated record set in any format, went beyond what the HITECH Act authorized. The statutory directive reaches electronic copies of records held in an electronic health record. As of mid-2026 that decision remains the operating position, and further rulemaking on access fees is possible.

The practical consequence is predictable: when a law firm or records company requests your chart under a directive, the fee is often set by a state copying schedule rather than the federal cost-based limit. The workaround costs nothing — request the copy to yourself at the patient rate, then forward it. Anyone documenting a bill dispute or a hospital financial assistance application should price both routes first.

Caution: A directive is not the same as a general authorization form. The access right, with its deadlines and fee limits, applies only to a request the individual makes. A form drafted by a third party and signed at their office is usually an authorization, and the patient-rate protections may not follow it.

6.Questions this raises

The practice uses an outside company to store its charts. Who do I ask?

Ask the practice. A storage or scanning vendor is a business associate, and the covered entity stays responsible for meeting the access deadline no matter who physically holds the file. If the vendor quotes a fee the practice never authorized, take that back to the practice, since it is the entity whose obligation is being measured. A closed practice usually has a custodian of records named with the state licensing board.

Can I insist on a searchable file rather than a scanned image?

You can ask, and the entity must produce that form if it is readily producible from its systems. Many systems export a structured summary and a set of images, and that combination is often what is genuinely available. An entity may decline to write your files to a drive you supply, on security grounds, but it then has to offer another workable electronic route such as encrypted email or a portal download.

Thirty days passed and nothing arrived. What now?

Send one written follow-up to the privacy official naming the original request date, and keep the proof of delivery. If that produces nothing, file a complaint with the HHS Office for Civil Rights, which handles access complaints as a distinct enforcement priority. There is no federal damages claim for the delay itself, but many states allow a suit or a licensing-board complaint over records, so check the law where the provider practices.

Can I get records about a parent I care for?

Only as a personal representative, which usually means a health care power of attorney, a guardianship order, or authority as executor after death. The representative generally stands in the individual's shoes for access purposes. Providers apply their own verification steps, so send the authority document with the first request. Where access would likely cause substantial harm, a representative's request is one of the reviewable denial grounds.

7.Making the request

Write the request rather than phoning it. Name the date range, the specific types of record you want, the format, and where to send it. Say plainly that you are exercising the individual right of access, because that phrase tells the records department which fee schedule applies. Ask for the fee estimate before the copy is produced.

Then calendar the deadline: thirty days from receipt, plus one written extension of thirty days if the entity claims it, and nothing beyond. Keep the mailing receipt. If a denial arrives, read it for the ground relied on, because that determines whether a reviewing professional has to look again. And if the record is heading into a coverage fight, pair it with the denial letters, the plan's stated criteria, and any advance notice of non-coverage handed to you at the desk.