The 30-Day Rule for Getting Your Records

How long does a doctor have to give you your records?

Under the federal HIPAA right of access, a provider generally must act on your request for a copy of your records within 30 days 1Ref 1U.S. Department of Health and Human Services, Office for Civil Rights (2024).Individuals' Right under HIPAA to Access their Health Information.That a covered entity generally must act on an access request within 30 days, and may take one 30-day extension only with written notice and the reason given within the original window.. "Act" means give you the records or, if it genuinely needs more time, tell you so in writing. The clock starts when you make the request, which is one reason to date it and keep a copy of what you sent.

The law allows one extension of up to 30 additional days, but it is not automatic: the provider must notify you in writing within the original 30 days and give the reason for the delay 1Ref 1U.S. Department of Health and Human Services, Office for Civil Rights (2024).Individuals' Right under HIPAA to Access their Health Information.That a covered entity generally must act on an access request within 30 days, and may take one 30-day extension only with written notice and the reason given within the original window.. Stack those together and the outer limit is roughly 60 days — but that is the exception, not the norm. Most complete requests are answered well before the first 30 days are up.

Thirty days is the maximum a provider may take, not the minimum you must wait.

What the 30 days actually means

The deadline is about the provider acting, not about a package landing on your doorstep on day 30. A covered entity meets the rule by making the records available within the window, and for a straightforward request that usually happens much sooner. The 30 days exists to cover the harder cases — old archived charts, records stored off-site, or a large file that takes real time to compile.

It also does not license a provider to sit on an easy request. If everything you asked for lives in an electronic system the office uses every day, taking the full month to hand it over is hard to justify. The deadline is a backstop for genuine complexity, not a default waiting period, and a reasonable office treats it that way.

The one extension, and what it requires

A provider gets exactly one extension, and it comes with conditions. To take the extra time — up to 30 more days — the office has to tell you in writing, inside the first 30-day window, that it needs the extension and why 1Ref 1U.S. Department of Health and Human Services, Office for Civil Rights (2024).Individuals' Right under HIPAA to Access their Health Information.That a covered entity generally must act on an access request within 30 days, and may take one 30-day extension only with written notice and the reason given within the original window.. A silent delay is not an extension; it is a missed deadline dressed up as one.

So if day 30 arrives with no records and no written notice, the provider is not simply "using its extension." The extension is a documented step the office has to affirmatively take, and its absence is exactly what you point to when you follow up. Keep any letter or portal message they send about a delay — it defines the new deadline they are now bound to.

Why electronic records are often faster

Electronic records frequently arrive far inside the 30-day window, because federal rules require your electronic health information — clinical notes, test results, and more — to be available to you at no cost and without special effort 2Ref 2Office of the National Coordinator for Health Information Technology (ONC) (2020).ONC's Cures Act Final Rule.That patients must be able to access their electronic health information, including notes and test results, at no cost and without special effort.. In practice that means a patient portal, where much of your record can be downloaded the moment you log in.

Before you settle in for a month-long wait, check the portal. What is there is yours immediately and usually free, which also sidesteps the medical record copy fees a paper request can carry. For anything the portal does not hold — older material, imaging, pathology — a formal request and the 30-day clock still apply, but you have already collected the easy part.

When a state clock is shorter

The 30-day rule is the federal floor, and some states require faster responses. Where a state sets a shorter deadline, that shorter deadline is the one your provider must meet — the rule that gives you more protection is the one that applies. So the honest answer to "how long do they have?" is: no more than about 30 days under federal law, and possibly less, depending on where you live.

This is also why the records retention period — how long a provider must keep your file — is worth separating from the response deadline. One governs how fast they must answer; the other governs whether the record still exists to answer with. Both can be set partly by your state, so a place with a short response clock may have its own retention rules as well.

If the deadline comes and goes

A missed deadline is not the end of the road; it is the start of your recourse. First, follow up in writing and reference your original dated request. If a provider or its health-IT vendor is obstructing access to your electronic health information, that can meet the federal definition of information blocking under the 21st Century Cures Act, which ONC and the HHS Office of Inspector General oversee 3Ref 3Office of the National Coordinator for Health Information Technology (ONC/ASTP) (2024).Information Blocking.That information blocking is defined under the 21st Century Cures Act (45 CFR Part 171) and that ONC and HHS OIG oversee and enforce it.. Naming that in a follow-up often unsticks a request.

If it does not, your hipaa right of access is enforceable through a complaint to the HHS Office for Civil Rights. A refusal is not always a violation — some narrow categories can be lawfully withheld, and the grounds for a denial of refused medical records are specific and limited — but an unexplained silence past the deadline is not among them. When the delay puts a time-sensitive decision at risk, such as a second opinion before a scheduled treatment, say so plainly in your follow-up; a government patient guide treats transferring your records for a review as a routine, expected step 4Ref 4MedlinePlus, U.S. National Library of Medicine (NIH) (2024).Your cancer diagnosis - Do you need a second opinion?.That transferring copies of records, imaging, and scans to a reviewing doctor is a routine, expected step in seeking a second opinion..