Your HIPAA Right to Your Medical Records, Explained

HIPAA, the federal health privacy law, gives you a right to see your medical records and to get a copy. HHS (the U.S. Department of Health and Human Services) publishes guidance on how it works. This page walks through that guidance in plain words. It is general information from HHS sources, not advice about your own situation.

What the right covers

HHS says the Privacy Rule gives you, with few exceptions, the right to inspect, review and receive a copy of the medical records and billing records held by health plans and health care providers that the rule covers. A few points from HHS:

• Only you or your personal representative has this right.
• You do not have the right to a provider's psychotherapy notes, which are kept separate from your medical record.
• A provider cannot deny you a copy because you have not paid for your care.
• The right applies to covered providers and health plans. It does not apply to every company that holds health information.

How to ask

1. Check the patient portal. HHS says that if your doctor has a web portal, you may be able to view and download your information whenever you want. Our guide to downloading lab results from MyChart shows how that usually goes.
2. Ask the records office. Look under Contact Us on the provider's website, or call and ask for the health information or medical records department. Many providers have a request form. HealthIT.gov (ONC) says a provider cannot impose unreasonable barriers to your access or unreasonably delay you.
3. Say what you want. Name the records and dates, and ask for an electronic copy in the form you want, such as a PDF or email. HHS says you have a right to the form and format you ask for if it is readily producible.
4. Write down the date. HHS says the response clock starts on the day the provider receives your request.

Timelines and fees

• Timing: up to 30 calendar days from receipt, plus one extension of up to 30 days if the provider sends you a written reason and a completion date within the first 30 days. HHS calls these outer limits.
• What a provider may charge: a reasonable, cost-based fee covering only the labor for copying, supplies (such as a USB drive, if you ask for one), postage if you ask for mailing, and a summary or explanation if you ask for one and agree to the fee in advance. Costs of searching for and retrieving records, and fees set by a state fee schedule, are not allowed for an individual's request, according to HHS.
• Flat fee: for an electronic copy of records kept electronically, a provider may charge a flat fee up to $6.50 instead of calculating its costs.
• Notice: a provider must tell you the approximate fee in advance. HHS says providers should give copies free of charge.

HHS notes that some of its guidance applies only as far as it is consistent with a 2020 federal court decision, Ciox Health v. Azar. For example, HHS says its fee limits apply to your request for your own records, and not to a request to send records to someone else.

If a request is refused or delayed

You can file a complaint with the HHS Office for Civil Rights (OCR). HHS says the complaint must be in writing, name the provider, describe what happened, and be filed within 180 days of when you knew about it, and that OCR can extend the 180 days for good cause. You can file through the OCR Complaint Portal, by mail, by fax, or by email. HHS says a provider cannot retaliate against you for filing.

Sending your records to someone else

HHS says that if you ask in writing, with your signature, naming the person or organization and where to send the records, a provider must send an electronic copy of your electronic health record to that recipient. That includes a new doctor or a health app you choose. Because of the 2020 court decision, HHS says this request is limited to an electronic copy of an electronic health record, and the fee limits above do not apply to it. Our guide to sending all your records to a new doctor covers the practical steps.

On apps: HHS says a provider generally cannot refuse to send your records to an app you chose just because it worries about how the app will use them. HHS also says HIPAA does not limit what the app does with the records, and does not apply to a company that is not a covered entity or business associate. Read an app's privacy terms before you send anything.

What to do with the files

When your records arrive, you may have several files from several places. Phi Longevity PRISM can read them and build a one-page Care Team Brief. About how we handle your records:

Phi Longevity is not a healthcare provider or a "covered entity" under HIPAA for your personal account. We store your records in HIPAA-eligible systems under a signed business associate agreement with Google Cloud, and we protect them to that standard. You can ask us to delete your data at any time.

Start free: bring in my records →

What Phi Longevity PRISM does not do

It does not give legal advice or decide what you are entitled to. It does not diagnose, and it reads lab results today; medicines, diagnoses and allergies are not imported yet.