How to get your medical records: a scoped HIPAA access guide

To get your medical records, first list which organization holds each record, download what is already in its portal, and use that organization's current access-request process for anything missing. Ask for specific existing record types and dates, request a usable electronic format when appropriate, save proof of submission, and compare the response with what you requested.

This guide explains a practical U.S. workflow. It is educational information, not legal advice. HIPAA does not govern every organization, app, portal, record, or transfer. The federal right discussed here generally concerns an individual's request for existing protected health information in a designated record set maintained by or for a HIPAA-covered entity, subject to exclusions and denial grounds.

What the HIPAA access right covers

HHS access guidance says the Privacy Rule generally requires covered entities to give an individual access, on request, to protected health information about that person in one or more designated record sets maintained by or for the entity. A designated record set can include:

• Medical and billing records maintained by or for a covered health care provider
• Health-plan enrollment, payment, claims, case-management, and medical-management record systems
• Other records used, in whole or in part, by or for the covered entity to make decisions about individuals

HHS gives examples including laboratory results, medical images, clinical case notes, medical records, and billing and payment records. The right concerns existing information. A covered entity does not have to create a new explanation or analysis that is not already in the designated record set.

The scope is broad, but it is not unlimited. HHS identifies express exclusions for separately maintained psychotherapy notes and information compiled for certain legal proceedings, plus other records outside the designated record set and limited grounds for denying access. A written denial has its own requirements, and some denials can be reviewed.

Step 1: map the record holders and record types

Create one row for each likely source. Depending on your history, that may include a primary-care practice, specialist, hospital, independent laboratory, imaging center, health plan, pharmacy, or another organization. Do not assume one portal contains originals created elsewhere just because it displays a summary or imported result.

For each source, write down:

• Organization, location, and department
• Record types expected there
• Service date or date range
• Clinician, facility, or order when known
• Whether you need a report, the underlying file, or both
• Why the record is needed now, for your own planning only

Common record types include visit notes, discharge summaries, lab reports, pathology reports, imaging reports, image files, procedure reports, medication lists, immunization records, and billing records. An imaging report and the actual image files are different deliverables. A portal result summary and the original laboratory report can also be different.

If you are unsure how to phrase the request, use the medical-record request template for patients and caregivers. Ask for specific existing records instead of asking an office to create a custom interpretation.

Step 2: check the portal and find the current request path

ONC's patient guide recommends checking the provider's online patient portal first. Download the files already available, but keep a list of the items you expected and did not find. A portal may expose only some records, a limited date range, or a summary view.

For anything missing, check the organization's website or contact its medical records or health information management department. ONC notes that the process may use a portal, request or release form, email, mail, or fax, and that there is no single standard form.

HHS says a covered entity may require a written request, may use its own form after informing the individual, and must take reasonable steps to verify identity. HIPAA does not prescribe one universal verification method. Ask for the holder's instructions rather than sending a driver's license or other sensitive identity document through an unconfirmed channel. Never send a portal password.

Use a missing-record log if several sources or gaps are involved. It separates "not in the portal" from "not maintained," "not yet requested," "pending," "partially received," and "denied."

Step 3: submit a scoped request for your copy

The simplest path is usually the patient requesting a copy for themself. Include:

1. Your name and the identity details the organization requests
2. The specific existing record types
3. The service date or date range
4. The provider, department, or location when known
5. The preferred form and format
6. The delivery method and destination for your copy
7. A request for an advance fee estimate if a fee may apply
8. Your signature and date when required

For electronic protected health information maintained electronically, HHS explains that a covered entity must provide the requested electronic form and format if it is readily producible, or an agreed alternative readable electronic format. This does not require a holder to buy new software or support every file type, app, or delivery channel. Ask for a format you can open and preserve, such as a readable PDF for reports and the source's supported image-file or transfer option for scans.

Requester authority and delivery destination are separate. A family member or helper is not automatically the patient's personal representative. HHS says state law may affect who has that role, the role follows the applicable scope, and exceptions can apply. If someone else is requesting or receiving records, ask the holder which personal-representative, patient-direction, authorization, treatment-disclosure, or other process applies.

Do not assume the HIPAA patient-directed route covers every third-party delivery. HHS's court-order notice explains that the Ciox Health v. Azar order vacated that directive beyond an electronic copy of protected health information in an electronic health record. A self-copy avoids making this article resolve a fact-specific transfer question; the patient can then follow the holder's and recipient's current processes.

Step 4: save proof and track the response

Save the exact request, submitted form, transmission receipt, portal confirmation, case number, and follow-up messages. Record the date the covered entity received a qualifying individual access request, because that is when the federal timing rule starts.

HHS's timing FAQ calls 30 calendar days an outer limit for a covered entity to act on an individual's access request. If the entity cannot act within that period, it may use one extension of no more than 30 additional calendar days, but it must give the individual a written reason and completion date within the initial period. State or other law may require a shorter timeline, and many portal requests can be completed much sooner.

For a copy under the HIPAA access right, a covered entity may charge a reasonable, cost-based fee limited to permitted categories. HHS's fee FAQ identifies copying labor, requested supplies or portable media, postage when mailing is requested, and an agreed summary or explanation. Search and retrieval labor is not a permitted component of that fee. Ask for an estimate before the copy is made if a fee may apply.

Step 5: verify, preserve, and follow up

Do not mark the request complete because a download link arrived. Compare the response with the scope you sent:

• Are the patient, source, service dates, and record types correct?
• Did the response cover the full requested date range?
• Are the original report, notes, or images present—not only a summary?
• Can you open the files, and do the page and file counts look plausible?
• Did the holder identify anything not maintained, delayed, excluded, or denied?
• Is the response partial, and if so, what remains outstanding?

A download is not proof of completeness. Compare the response with the request before you mark the record received.

Preserve the original files before renaming, converting, or annotating working copies. Use a consistent folder or source inventory, and record where each original is stored. If only some items arrived, use the partial-record documentation workflow instead of labeling the response complete.

For a denial in whole or in part, HHS says the covered entity generally must provide a plain-language written denial stating the basis, any applicable review right and how to request it, and how to complain to the entity or HHS Office for Civil Rights. It also must provide other requested protected health information to the extent possible after excluding information it can deny.

If a request is unanswered, first confirm receipt, the request type, any missing verification or authorization, and the responsible department. The unanswered-request follow-up guide provides a bounded escalation sequence. An unanswered or incomplete request is not automatically proof of a HIPAA violation or information blocking.

HHS's complaint page says anyone may file a written complaint about HIPAA noncompliance, the complaint must identify the covered entity or business associate and describe the acts or omissions, and it generally must be filed within 180 days of when the person knew of the event; OCR may extend that period for good cause. Filing does not guarantee a particular investigation or outcome.

Privacy and safety boundaries

Medical-record files and identity documents are sensitive. Use the holder's approved channel, confirm recipient addresses, do not share portal credentials, and avoid putting someone else's information into shared folders, public AI chats, or tools they have not approved. If urgent care is needed, seek care instead of waiting for records.

Libby can organize uploaded lab PDFs into structured result facts and a longitudinal timeline. Check extracted values, units, dates, flags, and available source ranges against the original report. Libby does not request or retrieve medical records, ingest every record type, determine whether HIPAA applies, decide personal-representative authority, guarantee parsing, provide legal advice, or tell you what a result means medically.

If the requested records are for a specialist, use the specialist export workflow to build a focused packet only after confirming what the receiving office accepts.

FAQ

Do I have a legal right to my medical records? Under HIPAA, an individual generally has a right to access existing protected health information about them in designated record sets maintained by or for covered entities, subject to exclusions and denial grounds. Other laws and processes may apply outside that scope. This article is not legal advice.

What medical records can I request? HHS examples include medical and billing records, laboratory results, medical images, and clinical case notes in a designated record set. Ask for existing record types and dates. A covered entity does not have to create a new explanation or analysis that does not already exist.

How long does a covered entity have to respond? For a qualifying individual HIPAA access request, 30 calendar days is the federal outer limit. One extension of no more than 30 additional days is permitted when the entity sends a written reason and completion date during the initial period. A shorter state or other deadline may apply.

Can I ask for an electronic copy instead of paper? If a covered entity maintains the requested protected health information electronically, it must provide the requested electronic form and format when readily producible, or an agreed alternative readable electronic format. That is not a promise that every file type, app, or delivery channel is supported.

Can I be charged for a copy? A covered entity may charge a reasonable, cost-based fee limited to permitted copying labor, requested supplies or media, postage, and an agreed summary or explanation. Search and retrieval labor is not included. Ask for an advance estimate if a fee may apply.

Can access be denied because I have an unpaid bill? HHS says a person's reason for requesting access is not a permitted denial ground and lists limited reviewable and unreviewable grounds; an unpaid balance is not among those listed grounds. Billing collection and a medical-record access request are separate processes, but seek qualified advice for a specific dispute.

Can someone else request or receive my records? A legally recognized personal representative generally may exercise access within the scope of that role, but state or other applicable law and exceptions matter. An informal helper, family member, requester, and delivery recipient are not automatically the same role. Ask the record holder what proof or authorization it requires.

What should I do if records are missing or the request is ignored? Confirm receipt and request type, ask whether verification or authorization is missing, request item-level status, save every response, and ask for any required written denial. If the facts may indicate HIPAA noncompliance, review the HHS Office for Civil Rights complaint process; a complaint does not guarantee a result.

References

• HHS: Individuals' Right under HIPAA to Access their Health Information
• eCFR: 45 CFR 164.524, Access of individuals to protected health information
• ONC: How to Get It
• HHS: How timely must a covered entity respond to an access request?
• HHS: Fees for providing an individual a copy of protected health information
• HHS: Personal Representatives
• HHS: Court-order notice on the right of access
• HHS: How to file a health information privacy or security complaint