Medical record request template for patients and caregivers

A medical record request template helps you ask for the right existing records without rewriting the request from scratch every time. The useful version names the provider or facility, the record types, the date range, the preferred format, where the records should go, and whether the requester is the patient, a personal representative, or a helper working with the patient's authorization.

This is not legal advice, and it does not guarantee that every office will accept the exact wording below. Many organizations require their own release form. Use the template to make your request clearer, then follow the provider's required process.

ONC's current patient guide says an organization's process may use a portal, access or release form, email, mail, or fax, and that there is no single standard form. HHS explains that the HIPAA Privacy Rule generally gives an individual a right, with limited exceptions, to access existing protected health information in designated record sets maintained by or for HIPAA-covered providers and health plans. This template helps make a request specific and trackable; it does not decide whether a particular organization, requester, record, or transfer falls under HIPAA.

Choose the request path before using a template

Requester authority and delivery destination are different fields. Choose the path that matches the real situation:

1. Patient requesting a copy for themself: use the quick template below. This is the simplest default when the patient wants a copy for a personal record.
2. Personal representative requesting within their role: use the representative cover note and the organization's required proof of authority. HHS says state law may affect who is a personal representative, and the person's access follows the scope of that representation.
3. Informal caregiver or helper: the helper can prepare the details, but should not sign as though they are the patient or a personal representative. Ask the organization whether the patient must sign its access form, authorize disclosure to the helper, or use another process.
4. Patient asking for direct delivery to a clinician or another recipient: first ask which route the record holder is using. HHS's third-party access FAQ describes a written, signed patient direction for an electronic copy of protected health information in an electronic health record. HHS's court-order notice says the directive was vacated beyond that scope. For other records, use the holder's authorization or other stated process instead of assuming a signed destination block is sufficient.

The same person can occupy more than one role, but do not collapse the roles in the request. A caregiver may help draft it while the patient remains the requester and recipient.

Quick template

Copy this version when the patient is asking for a copy for themself and knows exactly what they need.

Subject: Request for copy of medical records

Hello,

I am requesting access to and a copy of existing records about me that are maintained by [provider / clinic / hospital / lab / imaging center].

Patient information:
- Full name: [full legal name]
- Date of birth: [date of birth]
- Phone or email: [contact information]
- Medical record or patient ID, if known: [optional; do not include a portal password]

Existing records requested:
- Record types: [visit notes, lab reports, imaging reports, image files, discharge summary, procedure report, pathology report, medication list, billing records, other]
- Date range: [start date] through [end date]
- Provider, department, or location: [name, if known]

Preferred format and delivery:
- Preferred format: [PDF, electronic file, paper copy, CD/USB, image link, other]
- Delivery method: [portal, secure email, mail, pickup, other supported method]
- Send the copy to me at: [portal account, email, mailing address, or pickup instructions]

If you need me to use a specific release form or provide identity verification, please send the instructions.
If a fee may apply, please send an advance estimate before making the copy.
If any requested item is unavailable, delayed, or denied, please identify that item separately in writing and provide the available items.

Thank you,
[Patient name and signature, if required]
[Date]

For direct delivery to another person or organization, do not quietly replace the patient's address with someone else's. The following replacement block is only for an electronic copy of protected health information in an electronic health record when the record holder confirms it is using the patient-directed route described above. For any other record or route, use the holder's authorization or other stated process.

Patient-directed electronic EHR copy:
The record holder confirmed this route applies: [department / person and date]

Please send the requested electronic copy directly to:
- Recipient name or organization: [exact name]
- Attention: [person or department]
- Address, secure fax, portal, or other accepted destination: [exact destination]

I am the patient, and this is my signed instruction for the destination above.
[Patient signature and date]

That wording is a preparation aid, not a promise that the organization must accept it instead of its own form or that every direct delivery falls under this route.

Keep a copy of what you sent. Add it to your missing-record log with the request date, method, follow-up date, and status.

Personal representative or authorized-helper cover note

Use this as a cover note when you are helping someone else. It does not establish authority by itself. Do not assume every organization will treat you as a personal representative because you are family, hold a broadly worded document, or were asked to help. An informal helper should have the patient sign the organization's required form or authorization rather than signing as the patient.

Subject: Request for copy of medical records for [patient name]

Hello,

I am helping [patient full name] prepare a request for existing records maintained by [provider / clinic / hospital / lab / imaging center].

Patient information:
- Patient full name: [full legal name]
- Patient date of birth: [date of birth]
- Patient contact information: [phone or email]
- Medical record or patient ID, if known: [optional; do not include a portal password]

Requester information:
- My name: [your full name]
- Relationship or role: [informal helper / parent or guardian / health care agent / personal representative / other]
- Authority or authorization status: [organization says documentation is on file / proof attached / patient will sign the required form / not yet confirmed]
- My contact information: [phone or email]

Existing records requested:
- Record types: [visit notes, lab reports, imaging reports, image files, discharge summary, procedure report, pathology report, medication list, billing records, other]
- Date range: [start date] through [end date]
- Provider, department, or location: [name, if known]

Preferred format and delivery:
- Preferred format: [PDF, electronic file, paper copy, CD/USB, image link, other]
- Delivery method: [portal, secure email, mail, pickup, or other supported method]
- Requested recipient: [patient / confirmed personal representative acting within the scope of that role / another recipient]
- If another recipient: [organization's required patient direction, authorization, or other process]
- Exact destination: [portal account, email, mailing address, secure fax, or pickup instructions]

Please let us know what proof of identity, authority, patient authorization, signature, or organization form you require before processing this request. If a fee may apply, please send an advance estimate.

Thank you,
[Patient or confirmed in-scope personal representative name and signature, as applicable]
[Date]

HHS explains that a HIPAA-covered provider or health plan generally must allow a personal representative to inspect and receive a copy of protected health information about the person represented. State or other applicable law affects who has that status, the access follows the scope of the role, and exceptions can apply. HHS also says a covered entity must verify the identity and authority of a personal representative when otherwise unknown. That is why the cover note asks the organization to confirm its requirements instead of treating caregiver, recipient, and personal representative as interchangeable labels.

What to ask for

The most common mistake is asking for "my records" when you really need a specific set of documents.

ONC notes that a full record can be useful when switching to a new primary care provider or for personal use, while a partial record can be useful when sharing specific information such as allergies, medications, immunizations, one visit note, test results, or X-rays.

Use these request categories:

• Full record: useful for a long-term backup or switching primary care.
• Visit notes: useful when a clinician's reasoning, plan, or recommendations matter.
• Lab reports: useful when you need values, units, reference ranges, collection dates, and source context.
• Imaging reports: useful when a specialist needs the written radiology interpretation.
• Image files: useful when a specialist needs to review the actual scan, X-ray, ultrasound, CT, or MRI images.
• Discharge summary: useful after a hospitalization or emergency event.
• Procedure report: useful after endoscopy, surgery, biopsy, catheterization, or another procedure.
• Pathology report: useful when tissue, biopsy, or surgical specimens matter.
• Medication list or medication history: useful when starts, stops, reactions, or dose changes matter.
• Billing records: useful when you are trying to match records to charges or insurance questions.

For a qualifying HIPAA access request, HHS describes a designated record set as a broad category that can include medical and billing records, lab results, medical images, and clinical case notes maintained by or for a covered entity. It also says the entity is not required to create a new explanation or analysis that does not already exist. Ask for existing records by type; do not phrase a records request as a demand for a custom clinical interpretation.

If you are preparing for a specialist, read how to export medical records for a specialist. If you are organizing a long-running condition, start with the personal health record checklist for chronic conditions.

Date ranges make requests easier to process

A date range helps the records department find the right records and helps you verify whether the response is complete.

Use one of these patterns:

• "January 1, 2024 through December 31, 2025"
• "All visits with Dr. Nguyen from March 2023 through June 2026"
• "The emergency department visit on April 9, 2025"
• "The lumbar spine MRI performed on March 12, 2024"
• "All ferritin, iron studies, CBC, and related visit notes from 2022 through 2026"

If you do not know the exact date, write the best range you can and say that it is approximate. Do not invent exact dates to make the request look cleaner.

Ask for the format and delivery path

ONC lists PDFs, documents, and images as possible formats and portal delivery, EHR upload, email, portable media, health apps, fax, mail, and pickup as possible channels. It also tells readers to check which options the provider supports.

HHS access guidance and 45 CFR 164.524 say that when a qualifying request asks for electronic protected health information that a covered entity maintains electronically, the entity must provide the requested electronic form and format if readily producible, or an agreed alternative readable electronic format. That rule does not promise support for every file type, device, app, or delivery channel.

For practical purposes, ask for the format you can actually use:

• PDF for human-readable reports and notes
• Electronic file for records you want to store or share digitally
• CD, USB, image link, or electronic image transfer for imaging files
• Direct send to a clinician after the record holder identifies the applicable treatment, electronic-EHR-copy, authorization, or other transfer path
• Paper copy only when digital is not available or you prefer paper

If records are going to a specialist, ask the specialist office what they can accept before requesting imaging files or large exports.

Identity verification and release forms

HHS says covered entities may require written access requests if they tell people about that requirement, and may require use of their own form as long as it does not create a barrier or unreasonable delay. HHS also says covered entities must take reasonable steps to verify the requester's identity, but the Privacy Rule does not mandate one universal verification method.

That is why the template includes:

• Full legal name
• Date of birth
• Contact information
• Patient ID when known
• Requester role for caregiver workflows
• Authority or authorization status
• A request for the provider's required form or verification instructions

Do not send a portal password, and do not send more identity information than the organization actually requires. If a records department asks for a form of ID, use the method it provides and avoid sending sensitive documents through channels you do not trust.

Use the template with a tracking log

The request template is only half the workflow. The other half is tracking what happened.

For each request, record:

• Source organization
• Record types requested
• Date range requested
• Request method
• Date sent
• Confirmation number or proof
• Follow-up date
• Status
• Received date
• Format received
• Where you stored the file
• What is still missing

Use how to keep a missing-record log when portals are incomplete for the full tracking workflow. The template gets the request out; the log keeps it from disappearing.

Follow-up template

Use this when the request has not been acknowledged, is incomplete, or the follow-up date has arrived.

Subject: Follow-up on medical record request sent [date]

Hello,

I am following up on a medical record request sent on [date] for [patient name, date of birth].

Request summary:
- Record types requested: [record types]
- Date range requested: [date range]
- Request method: [portal/form/fax/mail/email/phone]
- Confirmation number, if any: [number]

Could you please confirm whether the request was received, whether any authorization or identity verification is still needed, and when the records are expected to be available?

If only part of the request can be completed, please provide the available items and identify separately which requested items are delayed, denied in writing, not maintained by your organization, or need clarification.

Thank you,
[Name]
[Date]

For an individual's qualifying HIPAA request to access protected health information in a designated record set, HHS says and 45 CFR 164.524 provides that a covered entity must act no later than 30 calendar days after receipt. One extension of no more than 30 additional days is permitted when the entity gives the individual a written reason and completion date during the initial period. A denial in whole or in part must be written, and the entity must provide other requested protected health information to the extent possible after excluding denied information.

Those rules do not automatically govern every authorization, provider-to-provider transfer, portal, app, non-covered organization, or request to send records to a third party. This article is not legal advice, but it is a reason to keep the request receipt date, scope, and response visible instead of relying on memory.

What Libby helps with

Libby helps with the organization layer around requests and records. You can keep the request text, submitted forms, confirmation notes, received files, missing-record status, and source context together.

That can mean:

• One place for portal downloads and record-request notes
• A source inventory for providers, labs, hospitals, and imaging centers
• A missing-record log with follow-up status
• Timelines that connect received records to dates and events
• Specialist or new-doctor summaries built from source files
• Better context for AI conversations, with human review still required

Libby does not automatically retrieve every record, create legal rights beyond what applies to your situation, guarantee provider timelines, provide legal advice, or decide what the records mean medically.

If the first setup is the hard part, white-glove setup gives you hands-on help organizing the first version of the record. You can also watch the Libby demo to see how record requests fit into the broader workflow.

Safety boundaries

This article is about personal record organization and request preparation. It is not medical advice, legal advice, privacy compliance advice, diagnosis, treatment, or a substitute for a qualified professional.

• Do not delay urgent care while waiting for records.
• Do not assume every provider will accept this wording instead of its own release form.
• Do not assume every caregiver or family member is authorized to request someone else's records.
• Do not treat the person receiving a copy as though that alone makes them the requester or personal representative.
• Do not send private health information or identity documents through channels you do not trust.
• Do not change medications, supplements, diet, or treatment based on a record, template, app, or AI answer alone.
• Verify important details against original source documents and discuss medical decisions with a qualified clinician.

If symptoms may be urgent, contact a clinician, urgent care, emergency services, or your local emergency number instead of waiting to finish a request.

References

• ONC: How to Get It
• HHS: Individuals' Right under HIPAA to Access their Health Information
• HHS: Your Medical Records
• HHS: Personal Representatives
• HHS: Verifying a personal representative
• HHS: Directing an electronic EHR copy to a third party
• HHS: Court-order notice on third-party directives
• eCFR: 45 CFR 164.524