How to get copies of your medical records (and what to do when the office stalls)
You have a legal right to your medical records. Here is exactly how to request them, what it can cost, the deadlines providers must meet, and what to do when nobody calls you back.
Most people don’t find out how hard it is to get their own medical records until they need them: a new specialist wants your history, a school needs vaccination dates, or you’re helping a parent switch doctors. Here’s the process, start to finish.
You have a legal right to your records
In the United States, HIPAA’s right of access says you can get a copy of nearly everything in your medical record: visit notes, lab results, imaging reports, medication lists, immunization records, and billing information. The provider can charge a reasonable, cost-based fee for copies, but they cannot refuse because you have an unpaid bill, and they cannot make you explain why you want them.
There are a few narrow exceptions (psychotherapy notes kept separately by a therapist are the big one), but for everyday purposes, if it’s about your care, you’re entitled to it.
Step 1: Ask the right department
Don’t ask at the front desk and hope. Ask for medical records or health information management (HIM). Small practices may handle it through the office manager; hospitals almost always have a dedicated department with its own phone line and form.
Step 2: Put the request in writing
Most providers require a signed authorization or release form. When you fill it out:
- Be specific about the date range and record types if you only need part of it (“all lab results and visit notes from 2023 to present”). Requesting “the complete record” from a hospital can produce hundreds of pages and a bigger copying fee.
- Say how you want it delivered. You can ask for electronic copies (PDF on a portal, email, or a disc), and providers with electronic systems are generally required to provide an electronic format if they can.
- Keep a copy of the request and note the date you submitted it.
Step 3: Know the deadline
Under HIPAA, providers generally have 30 days to respond, with one possible 30-day extension if they notify you in writing. Many states are stricter. If the deadline passes, call and reference the date of your written request.
When the office stalls
It happens constantly: the fax “didn’t arrive,” the person who handles records is “out this week,” the request “must have been lost.” Escalation path:
- Call and ask for the status of your written request by date. Specifics get action; vague inquiries don’t.
- Ask for the privacy officer. Every HIPAA-covered provider has one, and invoking them signals you know your rights.
- File a complaint with HHS Office for Civil Rights (hhs.gov/ocr) if you’re truly stonewalled. It’s free, it’s online, and right-of-access complaints are an enforcement priority; providers have paid real fines for slow-walking record requests.
What to do with the records once you have them
This is the part everyone skips, and it’s why you’ll be repeating this whole process in two years. Records arrive as a stack of paper, a burned CD, or a dozen PDFs with names like document_final_2.pdf. And then they scatter.
Whatever system you choose (a binder, a folder of scans, or an app), do it the same week the records arrive:
- Keep everything in one place, not split between a drawer and three email attachments.
- Make sure it’s searchable: future-you will be looking for “the colonoscopy report,” not “page 47.”
- Keep it accessible at appointments, because that’s where you actually need it.
That last part is what we’re building OwnVital for: scan the stack once, and it lives on your phone, organized and searchable, never leaving your device.