How to get a copy of your medical records

The short version

HIPAA's right of access 45 CFR 164.524 says any provider or health plan holding your records has to give you a copy. They generally have 30 days. They can charge a modest, cost-based fee, and not much more than that. They can't ask why you want them, and they can't hold them because you owe money.

Most refusals you'll run into aren't decisions. They're habits: a policy nobody has reread in years, or a staff member repeating what they were told. Asking again, in writing, citing the rule, resolves a large share of them.

What you're entitled to

The law gives you access to what it calls your designated record set. That's broader than the visit summary most practices hand out. It covers the records used to make decisions about you:

• Clinical notes from your visits, including the full note rather than the patient-facing summary.
• Lab results and pathology reports.
• Imaging reports, and the images themselves if you ask for them.
• Medication lists and prescription history.
• Consultation letters and referral notes from other providers, once they're in your chart.
• Billing records.

Records from other providers count. Once an outside specialist's letter lands in your chart, it's part of the set your practice holds, and you can ask them for it rather than chasing the original office.

Two things sit outside the right of access. Psychotherapy notes, meaning a therapist's private session notes kept separate from the rest of the chart, are excluded. So is material compiled in anticipation of a legal proceeding. Neither exception is broad, and neither covers ordinary mental health treatment records like medication management or diagnoses, which you can get like anything else.

Making the request

Put it in writing. A practice is allowed to require that, and a written request also gives you a dated record of when the clock started, which matters if this drags.

A request that works names four things:

• What you want. Either a date range and record types, or your full designated record set. Using that phrase signals you know the term, and it forecloses the reply that they've already sent the visit summary.
• The format. If they keep records electronically and you want an electronic copy, say so. They have to provide the form and format you ask for if they can readily produce it. A PDF by secure email or on a USB drive is readily producible almost everywhere.
• Where it goes. To you, or to a person or place you name.
• How to reach you. Including how you'll pay any fee, so that isn't the thing that stalls it.

You don't have to say why. That's worth knowing, because being asked is common and answering can invite an argument about whether the reason is good enough. It isn't a question they're entitled to have answered.

The portal is worth trying first for speed, and a lot of what you want is often already sitting in it. But the portal is not the limit of what you're owed. If what you need isn't there, ask for the rest directly.

The clock

Thirty calendar days from when they receive your request. They can take one extension of up to another 30 days, but only if they tell you in writing within the first 30, with a reason and a date. An extension nobody told you about isn't an extension.

You may see references to a 15-day deadline. That was proposed in 2021 and never finalized, and the department has since signaled it intends to revisit the timeline separately. Thirty days is the rule today, and it's what to hold a practice to.

In practice, most requests that arrive with the format specified and the fee handled come back well inside the window. The ones that take the full 30 days are usually the ones somebody has to go find on paper or on microfilm.

What it can cost

A reasonable, cost-based fee. That is a narrower category than a price list usually suggests. They can charge you for:

• Labor for copying, in whatever form you asked for.
• Supplies, meaning paper or a USB drive.
• Postage, if you asked for it mailed.
• Preparing a summary or explanation, but only if you agreed to that in advance.

They cannot charge you for searching for the records, for retrieving them, or for the cost of the systems they keep them in. Those are the line items that inflate an invoice, and they aren't allowed.

For an electronic copy of records they already hold electronically, there's a flat fee of $6.50 they can opt to charge instead of itemizing. It's an option available to them, not a cap or an entitlement, and many practices charge less or nothing at all. Several states cap copying fees below what federal law would permit, and where a state cap is lower, it governs.

One wrinkle worth knowing if a lawyer or an insurer is involved. A 2020 federal court decision narrowed the fee protections when you direct records to a third party rather than to yourself. Requests routed through an attorney's office can legitimately cost considerably more. If the fee is the problem, ask for the records to be sent to you, and forward them yourself.

Answers that are wrong

These come up constantly, and none of them are things a practice can require:

• "You have to tell us why." No.
• "It has to be notarized." No.
• "You have to come in and pick it up." No. If you asked for it mailed or sent electronically, that's what they owe you.
• "It's all in the portal, that's all we can do." The portal is one way to give access, not the whole obligation.
• "You'll have to get that from Dr. So-and-so." Not if it's in the chart they hold.
• "You need your doctor's approval." No. It's your record, not a favor they grant.
• "We can't release it because of HIPAA." HIPAA is the law requiring them to release it to you. It's the single most common inversion of the rule, and it's covered at length in our guide on what HIPAA actually does.

When they say no

Denials are supposed to be rare and specific. If one comes, it has to be in writing, in plain language, explaining the basis and how to seek review or complain.

Some grounds can't be reviewed, and they're narrow: psychotherapy notes and litigation material, mostly. Others are reviewable, and those all turn on a licensed clinician judging that access is reasonably likely to endanger someone's life or physical safety, or to cause substantial harm to a person referenced in the record. If you get a reviewable denial, you can require that a different licensed professional, someone not involved in the original decision, look at it again. They have to honor that.

A denial has to be about specific records. "We don't release notes" is a policy, not a legal ground, and it isn't one of these.

If it still doesn't come

Escalating works more often than people expect, because the offices below have been active on exactly this.

• Ask for the privacy officer. Every covered entity has to have one, and they're usually the first person in the building who knows the actual rule. A written request addressed to them, mentioning 45 CFR 164.524, often resolves it within days.
• File with the HHS Office for Civil Rights. Free, online, and generally within 180 days of when you learned of the problem. OCR has brought more than fifty enforcement actions under its Right of Access Initiative since 2019, most ending in a settlement and a corrective action plan. Practices know it exists.
• File an information blocking complaint. A separate and newer route, under the 21st Century Cures Act, for electronic records specifically. Enforcement moved into an active phase in 2026, with payment disincentives for providers and penalties for software vendors, and the complaint portal has taken in well over a thousand reports. If your problem is that electronic records exist and aren't being released, this route has teeth the older one didn't.
• Your state health department or licensing board. Many states have their own records-access statutes with shorter deadlines and lower fee caps than the federal floor.

You don't have to pick one. Filing with OCR doesn't stop you from also going back to the practice, and telling a records office you've filed is sometimes what moves it.

What's worth collecting, and when

The easiest copy to get is the one you ask for in the room. Staff are right there, the visit is fresh, and nobody has to go find anything. A request six weeks later is a project by comparison.

If you're seeing providers across more than one health system, you're usually the only person entitled to all of it. Nobody else has the complete picture, and no system assembles it for you. The pieces that matter most:

• The full note from any new-patient or specialist visit.
• Results, with their reference ranges, rather than a message saying they were normal.
• Imaging reports, and the images if a second opinion is even possible.
• Operative reports and discharge summaries, which are the documents the next provider most wants and least often has.
• The current medication list, which is the thing most likely to be wrong in any one chart.

For veterans in community care, this is more than housekeeping. Documentation from a community care visit only reaches the VA if the practice sends it, and often it doesn't. Holding your own copy is what keeps that failure from becoming your problem at the next VA appointment. That's covered in a separate guide.