Requesting medical records

Every patient in the United States has a federally protected right to access their medical records under the HIPAA Privacy Rule. This right allows you to inspect, obtain copies of, and request corrections to your health information maintained by healthcare providers, hospitals, clinics, and health plans.

32 steps across 5 sections

1. Step-by-Step Process

  • Check the patient portal first: Many providers offer instant access to lab results, visit summaries, and clinical notes through online patient portals (e.g., MyChart). This is often free and immedi...
  • Contact the Medical Records department: Call your provider's office and ask for the Health Information Management (HIM) or Medical Records department.
  • Submit a written request: Most providers require a written request. You can typically:
  • Download an authorization form from the provider's website
  • Request one by mail or in person
  • Write your own letter including: your full name, date of birth, date range of records, specific records requested, format preference, and delivery method
  • Sign the authorization: HIPAA requires your signature (or your legal representative's). Include the date signed.
  • Provide identification: Providers may require identity verification (photo ID, date of birth) but cannot impose unreasonable verification burdens.
  • Keep a copy: Retain a copy of your signed request and note the date submitted.

2. What to Include in Your Request

  • Full legal name and any former names
  • Patient ID or medical record number (if known)
  • Date range of records needed
  • Specific types of records (all records, lab results only, imaging, etc.)
  • Preferred format (electronic, paper, CD)
  • Delivery method (mail, email, pickup, patient portal)
  • Name and address of recipient (if directing to a third party)

3. HIPAA Fee Limits

  • Labor for copying (paper or electronic)
  • Supplies for creating the copy (paper, USB drive, CD)
  • Postage if mailed
  • Preparation of a summary or explanation (only if you agree to one in advance)

4. Fee Structures

  • Electronic copies via patient portal or email Typically free.
  • Paper copies Fees vary by state. Common ranges:
  • $0.50 to $1.00 per page for the first 25-50 pages
  • $0.25 to $0.50 per page thereafter
  • Some states cap total fees (e.g., Louisiana caps electronic records at $100 per request)
  • Flat fee option HHS allows a flat fee of up to $6.50 per request for electronic copies as a simplified alternative.
  • Search or retrieval fees HIPAA does not permit charging search or retrieval fees to the patient (though some states allow them for third-party requestors).
  • State fee schedules Many states have specific fee schedules that may override HIPAA's general "reasonable cost" standard. Check your state's medical records fee statute.

5. What Providers Cannot Charge For

  • Searching for and retrieving records
  • Maintaining systems that allow access
  • Verification of identity
  • Withholding records due to unpaid medical bills (in most states)

Common Mistakes

  • Not keeping a copy of your request
  • Requesting verbally only
  • Not specifying what you need
  • Accepting a denial without question
  • Paying excessive fees

Pro Tips

  • Use the patient portal first
  • Request records annually
  • Know your state's laws
  • File a HIPAA complaint if needed
  • Request in the format you want

Sources

Related Checklists