How to Get Your Medical Records: A Practical Step-by-Step Guide

What the law guarantees you

The Health Insurance Portability and Accountability Act (HIPAA) gives you the right to inspect and receive copies of your medical records from any covered healthcare provider in the United States. This includes visit notes, lab results, imaging reports, medication lists, discharge summaries, and billing records in a designated record set. Providers must respond to your request no later than 30 calendar days after receipt, with one possible 30-day extension if they provide written notice of the reason for the delay.

Critically, a provider cannot deny you access to your records because you owe them money — the right of access is independent of your payment status. The 21st Century Cures Act further prohibits information blocking and requires most providers who use certified electronic health record systems to give patients prompt electronic access to their records, with financial disincentives for providers who knowingly and unreasonably block access 1Ref 1Office of the National Coordinator for Health Information Technology (2024).Information Blocking.21st Century Cures Act prohibits information blocking — practices that interfere with patient access to electronic health information; certified health IT developers must support secure API-based patient access at no additional cost; HHS OIG can investigate and enforce disincentives for providers who knowingly and unreasonably block access.

Step 1: Check your patient portal first

If your practice uses a patient portal (MyChart, Athenahealth, eClinicalWorks, or similar), your records may already be available. Log in and look for sections labeled Health Summary, Visit Notes, Test Results, or Medical Records. Many practices now make after-visit summaries, lab results, and clinical notes available within 24–72 hours of the encounter.

Downloading from the portal is usually the fastest path — you receive a PDF or a FHIR-format electronic file at no charge, and you can forward it digitally to any other provider. Under the ONC Cures Act Final Rule, certified health IT developers are required to support secure API-based patient access to electronic health information at no additional cost 1Ref 1Office of the National Coordinator for Health Information Technology (2024).Information Blocking.21st Century Cures Act prohibits information blocking — practices that interfere with patient access to electronic health information; certified health IT developers must support secure API-based patient access at no additional cost; HHS OIG can investigate and enforce disincentives for providers who knowingly and unreasonably block access.

Step 2: Submit a written release request

For records not available through the portal, or for records to be sent to another provider, call or visit the practice and ask for their medical records release form (also called an authorization for release of information). You can often download it from the practice website.

Fill it out with: - Your full name and date of birth - What records you want (specific dates, types of records) - Who should receive them (another provider, yourself, or a legal representative) - The format you prefer (electronic, paper, or CD) - Your signature and date

Keep a copy of the completed form and note the date you submitted it.

Step 3: What to expect after submitting

Most practices fulfill requests faster than the 30-day legal maximum, especially for electronic records. You may receive records as a PDF, on a CD, or as a physical mailed copy. Fees vary — federal guidance limits fees to the reasonable cost of copying and transmitting, and many practices provide electronic records free of charge.

If you need records urgently — for a time-sensitive referral or a second opinion — call the office and explain the time constraint. Practices often accommodate urgent requests more quickly, especially for records being sent directly to another treating clinician.

Getting records from hospitals or multiple providers

For hospital records, contact the Health Information Management (HIM) department — that is the medical records department in hospital settings. Large health systems often have online portals or dedicated records request lines.

For records from multiple providers, you will need to submit separate requests to each, unless you use a health information exchange or a patient-directed aggregation service. Apple Health Records, CommonHealth (for Android), and similar platforms can pull records from participating institutions into one place, using the same right of access HIPAA guarantees you. These apps use standardized FHIR APIs, the same interoperability infrastructure the Cures Act mandates for certified EHR systems 1Ref 1Office of the National Coordinator for Health Information Technology (2024).Information Blocking.21st Century Cures Act prohibits information blocking — practices that interfere with patient access to electronic health information; certified health IT developers must support secure API-based patient access at no additional cost; HHS OIG can investigate and enforce disincentives for providers who knowingly and unreasonably block access.