How to Request Your Medical Records Under HIPAA (And What to Do If They Refuse)

Your right under HIPAA

Under 45 CFR § 164.524, you have the right to inspect and receive a copy of your Protected Health Information (PHI) held by any covered entity. This includes medical records, billing records, lab results, imaging studies, notes, and any other information used to make decisions about your care.

The 30-day deadline starts when the covered entity receives your written request. If they need more time, they may take one 30-day extension, but only if they notify you in writing within the first 30 days, explain the reason for the delay, and give you a specific date by which they'll complete your request.

They cannot charge you an unreasonable fee. HHS guidance limits fees to the labor cost of copying records plus postage. Many providers must provide electronic records at no charge when you request them electronically.

What to include in your HIPAA records request

A HIPAA records release authorization should include: your full legal name, date of birth, and address, the name and address of the covered entity holding your records, the specific records you're requesting (date range, type of records, lab results, imaging, physician notes, discharge summaries), the format you want (electronic, paper, CD), the person or entity you authorize to receive the records if you're releasing them to a third party, the purpose of the request, the expiration date of the authorization, and your signature and date.

If you're requesting records on behalf of someone else, a minor child, an elderly parent under your legal guardianship, include documentation of your authority (birth certificate, guardianship order, healthcare proxy).

Enforcement is increasing

The HHS Office for Civil Rights has significantly intensified enforcement of the Right of Access provision. In March 2025, OCR announced its 53rd Right of Access enforcement action, a $200,000 civil monetary penalty against an academic medical center that failed to provide a patient's personal representative timely access to records.

Proposed updates to the HIPAA Privacy Rule would shorten the response deadline from 30 days to 15 days, reflecting pressure for faster access in digital health environments.

If you're denied access or the provider exceeds the deadline, file a complaint at hhs.gov/hipaa/filing-a-complaint. OCR accepts complaints up to 180 days after the date you knew (or should have known) about the violation.

When you're releasing records to someone else

If you're authorizing a third party to receive your records, a new provider, an insurance company, an attorney, or a family member. You need a signed authorization form rather than a simple records request. The distinction matters because providers have different verification requirements for third-party releases.

Your authorization must be voluntarily signed, must identify the specific records being released, must identify who may receive them, must state the purpose, and must include an expiration date. Authorizations are revocable in writing at any time before the records are actually released.

One important limit: you cannot authorize the release of psychotherapy notes using a standard HIPAA authorization. Psychotherapy notes have additional protections and require a separate, specific authorization.