You have a legal right to see and get a copy of your health information from hospitals, doctors and health plans. This right comes from the HIPAA Privacy Rule, enforced by the Office for Civil Rights (OCR) at the US Department of Health and Human Services (HHS). Knowing how the right of access works can save you time, money and frustration, whether you need records for a second opinion, a new doctor, an insurance claim or your own reference.
This guide is general information, not legal advice. State laws may give you additional rights.
What the HIPAA right of access covers
Under HIPAA, you can access the information in your "designated record set." For a hospital, that generally includes:
- Medical records, including doctors' and nurses' notes, test results and imaging reports
- Imaging studies themselves, such as X-ray, CT and MRI images
- Medication and allergy lists
- Discharge summaries and operative reports
- Billing records
There are a few exceptions. The most notable are psychotherapy notes kept separately by a mental health professional, and information gathered for use in a lawsuit. In limited situations, such as when access could endanger someone's life or physical safety, a provider may deny part of a request, and you may have the right to have that decision reviewed.
How fast a hospital must respond
| Rule | What HIPAA requires |
|---|---|
| Deadline | No later than 30 calendar days after receiving your request |
| Extension | One extension of up to 30 more days, with a written explanation of the delay |
| Format | In the form and format you ask for, such as electronic copies, if readily producible |
| Fees | Only a reasonable, cost-based fee for copying labor, supplies and postage |
| Verification | The hospital can take reasonable steps to confirm your identity |
Many hospitals respond much faster, and some states set shorter deadlines. Information in a patient portal is often available immediately.
Fees
Under HIPAA, a hospital may charge only a reasonable, cost-based fee for providing copies. That can include labor for copying, supplies such as a USB drive or paper, and postage. It cannot include the cost of searching for and retrieving records, or general overhead. HHS guidance allows providers to charge a flat fee of no more than $6.50 for electronic copies of electronic records as one option. Viewing your records in a patient portal is generally free.
Step-by-step: how to request your records
- Check the patient portal first. Under the 21st Century Cures Act, hospitals must not unreasonably block access to electronic health information, so many notes and results now appear in portals automatically.
- Find the right office. Requests usually go to the hospital's Health Information Management (HIM) or medical records department. Look for a records request form on the hospital's website.
- Put it in writing. Hospitals can require written requests, and a written request creates a record of the date.
- Be specific. List your name, date of birth, dates of service and the records you want. Asking for "all records" is allowed, but can take longer to fill.
- Choose the format. You can ask for paper or electronic copies, emailed or sent through a secure portal, or images on a disc.
- Keep a copy of your request and note the date you sent it.
- Follow up if you have not received your records within 30 days.
Sending records to someone else
You can direct a hospital to send your records to another person or organization, such as a new doctor or an app you choose. The request must be in writing, signed by you, and clearly identify where to send them. Separately, providers can share information with your other treating doctors for treatment purposes without your authorization.
Requests for someone else
A personal representative can exercise the right of access for another person. This usually includes:
- Parents or guardians of minor children, with exceptions in some states for care minors can consent to themselves
- A person with a health care power of attorney or a court-appointed guardian
- The executor or administrator of a deceased person's estate
Expect to show documentation, such as a power of attorney or court papers.
Records from VA and military hospitals
Veterans can download many VA records through My HealtheVet or VA.gov, or submit a request to the release of information office at their VA medical center. Records from military treatment facilities can be requested through the facility or the Defense Health Agency. See How VA Hospitals Work.
Correcting your records
HIPAA also gives you the right to ask a hospital to amend information you believe is wrong or incomplete. The hospital must respond, generally within 60 days. If it denies the request, you can submit a statement of disagreement to be included in your record.
If the hospital does not comply
Start by contacting the hospital's privacy officer, whose contact details must be in its Notice of Privacy Practices. If the problem is not resolved, you can file a complaint with the HHS Office for Civil Rights, generally within 180 days of when you knew of the problem. OCR has run a Right of Access Initiative since 2019 and has reached settlements with providers over delayed or denied access.