Maybe you want your medical records because you’re moving to a new city, where you’ll need to find new doctors. Or you’re considering a medical procedure and want to get a second opinion. Or you’re currently seeing doctors at different hospitals and want to have all your records in one place. No matter the reason, you’re entitled to obtain a copy of your medical records. This right is protected by HIPAA, the federal healthcare privacy law.
“You will encounter providers who will say it’s not their policy [to provide a copy of your medical record], but those providers either don’t know the law or are ignoring it,” says Dave deBronkart (aka e-Patient Dave), a patient advocate, cancer survivor and author of the upcoming book Superpatients.
Many but not all states have additional laws regarding medical record access, and hospitals and medical practices may have their own policies too. These layers of rules can make the process of tracking down medical records seem complicated, but don’t let that bog you down. With help from deBronkart and other experts, we put together a guide to getting your records.
What exactly are patients entitled to?
HIPAA protects your right to see your health information, get a paper or electronic copy of your medical records, and request changes to any errors or incomplete information. You can also have your records sent to someone else.
HIPAA, the Health Insurance Portability and Accountability Act, has been the law of the land since 1996. Among other things, HIPAA dictates what healthcare providers, facilities and insurers (and certain other entities that handle patient data) need to do to safeguard the security and privacy of patients’ medical data, while also enabling their access to it.
Does a patient have the right to access every single thing in their medical records?
Not quite, but patients can access most types of medical records. (Somewhat confusingly, the individual components of medical records are often also called “medical records.”)
Healthcare providers own patients’ physical records, whereas patients own their medical information. That’s why you’re entitled to a copy of your records. That copy should include any clinical notes, lab results, medical images such as X-rays, and records related to billing, payment and insurance. There are a few types of records that patients aren’t entitled to access. Psychotherapy notes, for example, are excluded from requests. So are files that, despite being included in a patient’s record, are unrelated to decisions about their care, such as provider performance reviews.
Who can a patient request records from?
You can request records from healthcare providers and facilities, e.g., hospitals, private practices, clinics like Planned Parenthood, urgent care centers and nursing homes. You can also request records from private and government insurance providers. And you can request copies of completed test results directly from freestanding labs.
How long should a record request take?
No more than 30 days, according to HIPAA, although some state laws give providers less time than that. In Maryland and California, for example, record requests may not take longer than 21 days and 15 days respectively. This comprehensive list of different state laws is from 2013, but it appears to be the most recent available.
One more thing: If a patient requests medical information that isn’t readily accessible, a provider may apply for a single 30-day extension. This is the only exception to the 30-day maximum rule. Extensions shouldn’t be the norm, and if your provider does get approved for one, they need to give you a heads up in writing.
If a state has its own record request law, does it override HIPAA?
No. HIPAA lays out the minimum protections to which patients are entitled. States can take it upon themselves to create additional or more specific policies than HIPAA requires to make sure patients can access their healthcare data. But if a provision in a state law doesn’t meet HIPAA standards, then it’s not legally enforceable.
Can you request records for someone else?
Parents of minors and other legal guardians are treated as proxies for the patients under their care, so they can always access their records. In most other cases, only an authorized personal representative can request records on another person’s behalf. Here’s more info.
One more thing: Being married to someone doesn’t automatically make you their personal representative; they still need to authorize you.
What should a record request cost?
HIPAA lets providers charge a “reasonable” fee to cover costs associated with copying and mailing (or electronically transmitting) records, but not searching for or retrieving them. That means a doctor can charge you for supplies such as paper, X-ray copies and postage. They could also charge you for labor if, say, you ask for a summary or explanation of your record (and agree to be charged for it). But if you notice a “retrieval” or “handling” fee, it might be illegal.
Most but not all states have statutes specifying the maximum amount providers can charge for records, but these laws vary considerably. If your doctor quotes you a fee that seems unreasonable, or which would be financially burdensome, speak up. Negotiation isn’t out of the question, says deBronkart.
One more thing: A provider may not deny you access to your medical records on the grounds that you owe them money, according to the U.S. Department of Health and Human Services.
How do you actually make a request?
If you need records from a current provider, or a former one who’s still practicing, Carolyn Lye, a law and medical student at Yale University who’s researched medical record requests, says the easiest thing to do is go to the practice or hospital website to see what information they have about record requests. If your doctor uses a patient portal, you can look there too.
“The medical records page should give patients a form stating what records can be requested, how to submit a request and the formats the records can be submitted in, such as paper or an electronic format,” Lye explains.
If you can’t find the information online, call the office. Each facility or medical office should have a record-request form or at least be able to give you clear instructions to complete the process.
You might need to submit your request in writing, and you’ll definitely need to verify your identity somehow, although verification methods vary by provider. If you request your records in person, it’s always a good idea to have a valid government ID on you just in case.
What if your doctor is retired?
Even when doctors retire or die, their patient records need to be maintained — at least for a while. Minimum time requirements vary by state. In Washington, D.C., doctors can discard records two years after a patient’s last visit, while in Georgia they need to wait 10 years. The rules often differ for practices versus hospitals too.
When a doctor retires or a medical office closes, patients will usually get a letter notifying them, says Annamarie Bondi-Stoddard, an attorney in Lake Success, New York, who specializes in medical negligence and malpractice. The letter should also tell patients what’s happening to their records — whether they’re being transferred to another practice or archived at a storage facility — and how long they’ll be saved.
However, Bondi-Stoddard notes that some facilities don’t get rid of old records as soon as they say they will. If you know where your records were transferred, it’s worth reaching out even if it’s been a while. Even if you don’t know where your records wound up, you’ve got some avenues for tracking them down. Hospitals where your doctor had an affiliation, or state and local medical societies which counted your doctor as a member, may have further or better information.
A few tips
If possible, go paperless: There might be some instances where you can only get a hard copy of your records. But if a provider keeps patient records electronically, you’re entitled to an e-copy. And even if they only have paper records, they’re supposed to create an e-copy for you if they’re able to. They’re also supposed to send your records in the electronic format of your choice (again, if they’re able to). For example, you could ask your doctor to put all your records on a USB drive or a CD, or to send you a PDF file via secure email.
Electronic files have advantages. They might be easier to share with future doctors, and if you need to locate specific information or documents within your records, e-files are easier to search. They also typically cost less than paper records to request. (HIPAA came up with $6.50 as a suggested flat fee for e-records, but providers aren’t required to stick to it.) Many providers will even send e-files at no charge.
A growing number of hospitals and medical practices — and even insurance providers — make electronic records available to patients by uploading them to patient portals. Government insurance programs, including Tricare, Medicaid and Medicare, and the VA, have patient portals that feature the Blue Button symbol, which signifies that patients can download their medical records directly.
Ask early: If you’re being treated at a hospital, or have a family member who is, it can be quicker to ask for records, including copies of PET or CT scans, before you (or they) are discharged, says Bondi-Stoddard.
Outsource the request: If you need medical records sent from one doctor to another — rather than to you directly — because you want to switch providers or get a second opinion, ask the new doctor’s office to make the request. The process might go faster if you’re not part of the equation. Plus, physician-to-physician requests are typically done free of charge.
Make cuts: It might be tempting to get a full record set just because you can. But before you select-all by default, consider whether you actually need everything in there. Before electronic records became paramount, Bondi-Stoddard says, a surgical record might have had 100 pages of information. But in the process of moving records into an electronic system, some notes may be duplicated for maximum clarity. As a result, that same 100-page record could realistically balloon up to 300 pages.
Bondi-Stoddard recommends focusing on the essentials. For a surgical record, for instance, that would mean the operative report, radiology studies such as X-rays, CT scans and MRIs, blood work, the admission note and the discharge summary. But you probably don’t need to hold onto old body temperature readings.
Hold yourself accountable for knowing the laws: Lye led a 2018 study examining how 83 different U.S. hospitals handled medical record requests. Hospitals varied greatly in what they charged for a 200-page record, with prices ranging from $0 to more than $500, and how quickly they turned around requests; seven hospitals violated the 30-day rule.
Also, the hospital employees who fielded medical-record requests didn’t always know the relevant laws. In some cases, Lye’s team found, calls were redirected to an offsite call center, where service reps weren’t familiar with the record-access policies in the state where the hospital was based.
So be ready to play defense. That way, if an office manager tells you that record requests take six weeks per state law, or that you need to pay off the balance of your biopsy bill before you can access your chart, you’ll be able to push back.
If at any point you suspect your rights are being violated, you can file a complaint with the Office of Civil Rights.
By doing it this way, the person in the provider’s office will be able to find the problem and make the correction easily. If they sent you a form to fill out, you can staple the copy to the form.