How to Get Your Medical Records: Your HIPAA Right of Access

Most people assume their medical records belong to their doctor. The building they were created in, the software they live in, the staff who typed them — all of that is the provider's. But the information itself is yours to see and to copy, and that isn't a favor a receptionist grants you. It's a federal right.

This guide walks through how to actually exercise that right: who holds your records, how to ask for them, how long it should take, what it can cost, and — the part almost everyone skips — what to do with the copies once you have them. It isn't legal advice; it's the practical version of a rule that's more generous than most people realize.

You have a right to your records

Under the HIPAA Privacy Rule, you have the right to inspect and get a copy of your own health information held by your doctors, hospitals, labs, and health plans.¹ The government's own patient-facing guidance from the Office of the National Coordinator (ONC) puts it plainly: the law protects "your right to see and get your health records," and that right holds even if you have an unpaid bill.²

"Your health information" is broad. It covers the records in what HIPAA calls your designated record set — the material a provider uses to make decisions about you. In practice that means:

• Lab and test results — blood work, panels, pathology.
• Imaging reports — the radiologist's written read of an X-ray, MRI, or CT (and often the images themselves).
• Visit notes — the clinician's notes from your appointments.
• Medication, immunization, and treatment history.

You don't have to explain why you want any of it. The default is access.

Who actually holds your records

Here's the wrinkle that trips people up: there is no single vault. Your history is spread across every provider who ever treated you, and each one holds only its own slice.³ Bloodwork from a walk-in draw sits with the lab; your annual physical sits with your primary care office; an ER visit from a trip three years ago sits with that hospital. ONC's guidance acknowledges this directly — getting your record "can be a real challenge" when you've seen providers in different places, because "each one may require you to follow a different process."²

So the first move isn't to request — it's to list. Write down every place that has something you want: each doctor's office, each hospital, and each lab (Quest, LabCorp, Function, a hospital running Epic or Cerner). A complete history is usually several requests, not one.

How to request them

There are two paths, and you'll often use both.

The patient portal. Many results are already sitting behind a login. Lab portals like MyQuest and LabCorp Patient, and provider portals like MyChart, let you download results and notes yourself, usually within days of a visit. This is the fastest route when it works — our step-by-step on exporting your Quest and LabCorp results covers the clicks. Start here.

A written request. When something isn't in a portal — older records, imaging, notes from a provider without a modern portal — you submit a request to that provider's medical records or health information management (HIM) department. A good written request names:

1. You — enough to verify your identity.
2. What you want — be specific: "lab results, imaging reports, and visit notes from January 2023 to present," rather than "everything."
3. The format — ask for an electronic copy if you can use one.
4. Where to send it — to you, or to a third party you designate (a new doctor, for instance).

Most providers have a form for this; ask for it. You generally can't be required to state a reason, and you can direct a copy to someone else if you choose.

Timelines, formats, and fees — what to expect

Three parts of the rule are worth knowing precisely, because they're where providers most often fall short.

Timeline. A covered entity must act on your request no later than 30 calendar days after receiving it. It can take one 30-day extension, but only if it tells you in writing — within that first 30 days — why it's delayed and when you'll get the records.⁴ Thirty days is a ceiling, not a target; portal downloads are often immediate.

Format. You can ask for the records in the form and format you request, and the provider must honor it if the records are readily producible that way — including a specific electronic format.¹ If your labs live in a system that can email you a PDF, "we only mail paper" is usually not a sufficient answer.

Fees. A provider may charge a reasonable, cost-based fee — limited to things like the labor of copying, supplies, and postage if you asked for it mailed.⁵ It cannot charge you for the staff time to search for and retrieve your records, and it cannot use a fee to discourage you from asking. Many electronic copies through a portal are simply free.

If a provider stonewalls, ignores the timeline, or quotes an unreasonable fee, you can file a complaint with the HHS Office for Civil Rights — the agency that enforces this right.

The part everyone skips: what to do with them

Getting the copies is the milestone people celebrate. It's also where the effort usually dies. The PDFs land in an email thread and a downloads folder, the imaging comes on a disc you no longer have a drive for, and eighteen months later your "records" are a scatter of files across two portals, an inbox, and a drawer — none of it lined up.

That matters more than tidiness, because the useful thing about your history is the shape of it over time. The signal in lab work is the trend, not the single result — and a trend only appears when readings from different visits and different labs sit on the same axis. A pile of disconnected PDFs can't show you how a marker moved over five years, especially when the units and names don't even match between labs.

So the request isn't the finish line. Bringing the records together is.

Where Libby fits

This is exactly the job Libby is built for. Once you've gathered copies of your records, drop the lab PDFs (and photos of paper results) into one place that reads every value, reconciles the units across labs, and files each marker onto a single timeline. Instead of a folder that decays, you get a record you own and can export anytime — one you can hand to a new doctor when you switch providers, or bring into a conversation with an AI assistant for a second read on your own numbers.

Exercising your right of access gets your data out of everyone else's systems. Keeping it in a record you control is what makes it useful. If you've just started collecting your records, start your record and drop the first PDF in — it takes about a minute.

FAQ

Do I have a legal right to my own medical records? Yes. Under the HIPAA Privacy Rule you have the right to inspect and get a copy of the health information your providers and health plans hold about you, including lab results, imaging reports, and visit notes. You generally don't have to give a reason, and the right applies even if you have an unpaid bill.

How long does a provider have to give me my records? A covered entity must act on your request within 30 calendar days of receiving it. It may take one 30-day extension, but only if it notifies you in writing within the first 30 days, explaining the delay and when you'll receive the records.

Can I be charged a fee for copies of my records? A provider may charge a reasonable, cost-based fee — limited to the labor of copying, supplies, and postage if you request mailing. It cannot bill you for the time spent searching for and retrieving your records, and many electronic copies through a patient portal are free.

Can I get my records electronically instead of on paper? Usually, yes. You can request the form and format you want, and the provider must provide it if the records are readily producible that way — including a specific electronic format. Ask for an electronic copy if you can use one.

Where do I actually send the request? Start with any patient portal, where results and notes are often downloadable immediately. For anything not in a portal, contact the provider's medical records or health information management (HIM) department and ask for their request form.

Educational content, not medical or legal advice. This article is general information about the patient right of access under HIPAA and how to keep your own records; it isn't legal advice, a diagnosis, or a treatment plan. Rules and processes can vary by provider and by state. For questions about your specific situation, talk to your provider, and for the authoritative rules see the HHS and HealthIT.gov sources linked below.