Explainer
Your Records Are Yours by Law
Federal law already gives you the right to a copy of your health records, fast and in the format you ask for. Most people never use it.
Most people think of their medical records as something that belongs to the office that wrote them. The paper sits in their filing room, the data sits in their system, and getting a copy feels like asking a favor. The law sees it the other way around.
Since HIPAA's privacy rule took effect, you have had a legal right to see and get a copy of the health information your doctors, hospitals and health plans keep about you. In recent years that right has grown sharper: deadlines, fee limits, electronic copies, and new rules that treat holding data back as a violation in itself. Here is what the right covers, in plain English.
The Right Most People Never Use
The rule is called the HIPAA right of access, and it lives in one section of federal regulation, 45 CFR 164.524. It applies to "covered entities": nearly every doctor, hospital, clinic, lab, pharmacy and health plan that bills insurance electronically. It covers what the law calls your designated record set, which in practice means your medical records and billing records, plus the records a plan uses to make decisions about you.
There are a few narrow exceptions. Psychotherapy notes kept separately by a therapist are one; information compiled for a lawsuit is another. Everything else, from visit notes to lab results to imaging reports, is yours to request.
The record describes you. The law has said for years that you get a copy.
What You Can Ask For
Three parts of the rule do most of the work, and each one is more generous than people expect.
- A deadline
- The provider must act on your request within 30 days. They may take one extension of up to 30 more days, but only if they tell you in writing why, and when you will have it.
- The format you ask for
- If you want an electronic copy and they can readily produce one, they must give it to you that way. If they cannot, they must offer a readable electronic format you both agree on.
- A copy sent where you choose
- You can ask, in writing and signed, for an electronic copy of your records to go straight to another person or service you name.
- Inspection in person
- You can also ask to look at your records where they are kept, which can cost nothing at all.
What It Can Cost
A provider may charge you a fee for a copy, but the rule keeps it narrow. The fee has to be reasonable and based on cost, and it can cover only the labor of making the copy, supplies like paper or a USB drive if you ask for one, postage if you want it mailed, and preparing a summary if you agreed to one in advance. Searching for the records, storing them and running the system are not things they can bill you for.
State law can set its own limits too. When state and federal rules differ, the one that results in the lower fee for you generally applies.
What They Cannot Do
The most common way people get turned away is over money. HHS has answered that one directly: a provider may not withhold or deny your access to your records because you have not paid a bill for the care they gave you. They can charge the copy fee. They cannot hold your history hostage.
They also cannot make you explain why you want your records, require you to come in person when you have asked for a copy to be sent, or bury the request under unreasonable steps. HHS's Office for Civil Rights has spent years enforcing this right, and its settlements with providers who stalled patients are public.
When It Should Just Flow
A second set of rules picks up where HIPAA leaves off. The 21st Century Cures Act made it a violation for health systems, technology companies and networks to interfere with access to electronic health information without a valid reason. Those information blocking rules began applying to providers in April 2021.
In practice this is why your test results now show up in your portal, often before anyone calls you. Holding results back so a clinician can review them first is generally treated as interference, unless you asked for that delay yourself. When federal regulators surveyed 8,000 patients about it, more than 95 percent said they wanted to keep receiving results right away.
For years these rules had little enforcement behind them. That changed in September 2025, when HHS announced a crackdown on information blocking and directed more resources to it. Technology developers and networks found blocking data can face penalties of up to $1 million per violation, and providers face penalties through Medicare programs.
Getting your own record should take one request, not a fight.
Field Work
How to Ask for Your Records
- Find the right door. Check the patient portal first; many systems let you download or request records there. Otherwise ask for the medical records or health information management office.
- Put it in writing. Include your full name, date of birth, the records you want, the date range, and how you want them: for example, an electronic copy by secure email or download.
- Name the rule. One sentence is enough: "I am requesting a copy of my records under my HIPAA right of access, 45 CFR 164.524."
- Mark the date. The 30 days start when they receive your request. Keep a copy of what you sent.
- If you are stonewalled, ask for the refusal in writing, then file a complaint with the HHS Office for Civil Rights. It is free and can be done online.
Sources
- Access of individuals to protected health information, 45 CFR 164.524 (Legal Information Institute, Cornell Law School)
- Is $6.50 the maximum amount that can be charged? (HHS FAQ)
- May a provider deny access because the individual has not paid the bill? FAQ 2065 (HHS)
- HHS announces crackdown on health data blocking (HHS press release, September 2025)
- Survey: patients prefer immediate access to test results through the portal (ASTP/ONC)
- Filing a HIPAA complaint (HHS Office for Civil Rights)
This article is general information, not medical or legal advice. Rules change and vary by state; check with a licensed professional about your situation. In an emergency, call 911. In a mental health crisis, call or text 988.