Your Right to Your Own Medical Records

What does HIPAA give you a right to?

Yes — and it is not a favor your doctor grants. The HIPAA Privacy Rule gives you an enforceable right to inspect and to receive a copy of the health information a provider or health plan keeps about you. That information sits in what the rule calls the designated record set — your medical records and your billing records, the material actually used to make decisions about your care 1Ref 1U.S. Department of Health and Human Services, Office for Civil Rights (2024).Individuals' Right under HIPAA to Access their Health Information.The core claim that the HIPAA Privacy Rule gives an enforceable right to inspect and receive a copy of protected health information in the designated record set (medical and billing records), that access must be provided in the form and format requested when readily producible, that a covered entity must respond within 30 days, and that any fee must be reasonable and cost-based.. The right does not depend on why you want it.

In practice, that covers far more than a visit summary. It includes clinician notes, lab and pathology results, imaging reports, medication and problem lists, and discharge summaries, alongside the billing record. You can ask to look at the file in person, usually at no charge, or to receive a copy 1Ref 1U.S. Department of Health and Human Services, Office for Civil Rights (2024).Individuals' Right under HIPAA to Access their Health Information.The core claim that the HIPAA Privacy Rule gives an enforceable right to inspect and receive a copy of protected health information in the designated record set (medical and billing records), that access must be provided in the form and format requested when readily producible, that a covered entity must respond within 30 days, and that any fee must be reasonable and cost-based.. If the records are kept electronically and you ask for an electronic copy, the provider must give you one in that form when it is readily producible 1Ref 1U.S. Department of Health and Human Services, Office for Civil Rights (2024).Individuals' Right under HIPAA to Access their Health Information.The core claim that the HIPAA Privacy Rule gives an enforceable right to inspect and receive a copy of protected health information in the designated record set (medical and billing records), that access must be provided in the form and format requested when readily producible, that a covered entity must respond within 30 days, and that any fee must be reasonable and cost-based..

HIPAA does not reach every entity that touches health information, but it reaches the ones most people mean: health plans and the great majority of doctors, hospitals, labs, and pharmacies. Alongside the right to a copy, the same law gives you the right to ask for corrections and to receive an accounting of certain disclosures 2Ref 2U.S. Department of Health and Human Services, Office for Civil Rights (2024).HIPAA for Individuals.The enumeration of the three related individual HIPAA rights used here — access to records, requesting corrections or amendments, and an accounting of certain disclosures.. The copy is the foundation; the other two travel with it.

How fast do they have to respond?

A covered entity generally must act on your request within 30 calendar days 1Ref 1U.S. Department of Health and Human Services, Office for Civil Rights (2024).Individuals' Right under HIPAA to Access their Health Information.The core claim that the HIPAA Privacy Rule gives an enforceable right to inspect and receive a copy of protected health information in the designated record set (medical and billing records), that access must be provided in the form and format requested when readily producible, that a covered entity must respond within 30 days, and that any fee must be reasonable and cost-based.. If it cannot meet that deadline, it may take a single 30-day extension — but only one, and only if it tells you in writing within the first 30 days why it needs longer and the date you will have the records 3Ref 3U.S. Department of Health and Human Services, Office for Civil Rights (2024).Individuals' Right under HIPAA to Access their Health Information.The specific detail that a covered entity may take one 30-day extension only, and only with written notice of the reason and the new date within the first 30 days.. There is no second extension.

That ceiling is the outer limit, not the target. Many requests are filled far faster, and results released through a patient portal often appear the moment they are finalized. If you are gathering records to seek a second opinion or to change doctors, the HIPAA 30-day access deadline is the number to hold a slow office to — a request that has passed it with no copy and no written extension is out of bounds.

A provider has 30 days, plus at most one 30-day written extension — nothing more.

What can they charge you for a copy?

A fee is allowed, but the law caps it: it must be reasonable and cost-based, and it can cover only the labor to make the copy, the cost of supplies such as paper or a disc or USB drive, and postage if you ask for the copy to be mailed 1Ref 1U.S. Department of Health and Human Services, Office for Civil Rights (2024).Individuals' Right under HIPAA to Access their Health Information.The core claim that the HIPAA Privacy Rule gives an enforceable right to inspect and receive a copy of protected health information in the designated record set (medical and billing records), that access must be provided in the form and format requested when readily producible, that a covered entity must respond within 30 days, and that any fee must be reasonable and cost-based.. A provider must tell you the fee in advance, and it cannot bill you for the time spent searching for or retrieving your records 1Ref 1U.S. Department of Health and Human Services, Office for Civil Rights (2024).Individuals' Right under HIPAA to Access their Health Information.The core claim that the HIPAA Privacy Rule gives an enforceable right to inspect and receive a copy of protected health information in the designated record set (medical and billing records), that access must be provided in the form and format requested when readily producible, that a covered entity must respond within 30 days, and that any fee must be reasonable and cost-based..

Electronic copies are often cheaper still, and under federal rules many are free. When you use a patient portal to view and download your own electronic health information, that access is generally provided at no cost 4Ref 4Office of the National Coordinator for Health Information Technology (ONC) (2020).ONC's Cures Act Final Rule.The claim that the 21st Century Cures Act requires patients' electronic health information, including clinical notes and test results, to be available at no cost and without special effort, generally through a patient portal or an app the patient chooses.. The paper-copy fee and the portal are two different doors to the same record, and the portal is usually the faster and cheaper one.

If a quoted fee sounds like a penalty rather than the cost of a photocopy and a stamp, that is worth questioning — the law is on the side of a modest, itemized charge.

Your records, electronically, at no cost: the Cures Act

The 21st Century Cures Act added a second layer on top of HIPAA. Its rules require that you be able to get your electronic health information — including clinical notes and test and imaging results — without cost and without special effort, generally through a patient portal or an app you choose 4Ref 4Office of the National Coordinator for Health Information Technology (ONC) (2020).ONC's Cures Act Final Rule.The claim that the 21st Century Cures Act requires patients' electronic health information, including clinical notes and test results, to be available at no cost and without special effort, generally through a patient portal or an app the patient chooses.. This is why test results now often land in your portal the moment they are signed, sometimes before your doctor has called.

The practical effect is that patient portal access has become the fastest way to assemble your own record. You can usually download or forward results yourself, without a formal request and without waiting on a records department. For anyone comparing offices or preparing for a second opinion, the portal is the first place to look before filing anything on paper.

information blocking is the name for the practice these rules forbid, and it is the subject of the next section.

What if a provider stalls or refuses?

Most delays are ordinary friction — a busy records office, a request that landed in the wrong inbox — and they resolve with a firm follow-up that cites the 30-day deadline. A flat refusal is rarer and more serious. When the records are electronic, an unjustified refusal to share them can amount to information blocking: under the Cures Act (45 CFR Part 171), that is a practice by a provider, a health IT developer, or a health information network that is likely to interfere with your access to, or exchange of, your electronic health information — unless one of a defined set of exceptions applies 5Ref 5Office of the National Coordinator for Health Information Technology (ONC/ASTP) (2024).Information Blocking.The definition of information blocking under 45 CFR Part 171 as a practice by a provider or health IT actor likely to interfere with access to electronic health information (subject to defined exceptions), and that ONC sets the rules while HHS OIG oversees enforcement.. The rules are set by federal health-IT regulators, and enforcement runs through the HHS Office of Inspector General 5Ref 5Office of the National Coordinator for Health Information Technology (ONC/ASTP) (2024).Information Blocking.The definition of information blocking under 45 CFR Part 171 as a practice by a provider or health IT actor likely to interfere with access to electronic health information (subject to defined exceptions), and that ONC sets the rules while HHS OIG oversees enforcement..

The access right is broad, but it is not unlimited. A narrow, defined set of materials sits outside it — the best-known example being the psychotherapy notes exception — and a small number of denials must be reviewed by a licensed professional before they stand. Which situations count, and what a lawful denial looks like among the various HIPAA access denial grounds, is its own topic. So is the formal remedy: when access is denied or slow-walked past the deadline, the OCR complaint process exists precisely for that, and it is worth knowing before you need it.

A delay is common and almost always fixable. A genuine, lawful refusal is the rare case — and even then there is a defined path, not a dead end.

How to actually get your records

Ask in writing. A short signed request that names you, the specific records and date range you want, and the format you prefer is faster and cleaner than a phone call, and it starts the 30-day clock on a documented date. Most offices have a form; a plain letter works just as well. Putting a records request in writing also gives you a paper trail if the deadline slips.

Three details make the difference when the records are for a second opinion:

• Ask for the right things. A useful file is more than a summary. For a second opinion you generally want the actual pathology and imaging for review — the reports and, where it matters, the images on a disc or drive and the pathology slides themselves, not just the typed conclusions. Assembling the right records for a second opinion is worth a checklist of its own.
• Choose the format. You can ask for paper, a PDF, or images on a disc or USB drive. If you want an electronic copy and the office can produce one, it must give you that form 1Ref 1U.S. Department of Health and Human Services, Office for Civil Rights (2024).Individuals' Right under HIPAA to Access their Health Information.The core claim that the HIPAA Privacy Rule gives an enforceable right to inspect and receive a copy of protected health information in the designated record set (medical and billing records), that access must be provided in the form and format requested when readily producible, that a covered entity must respond within 30 days, and that any fee must be reasonable and cost-based..
• Send it straight to the second reviewer. You can direct a provider to transmit a copy directly to another person or practice — including the specialist giving the second opinion — so you never become the courier 6Ref 6MedlinePlus, U.S. National Library of Medicine (NIH) (2024).Your cancer diagnosis - Do you need a second opinion?.The lay point that seeking a second opinion is the patient's right and that patients are expected to gather or transfer copies of their records and imaging to the reviewing doctor, including via a directed transfer.. A second opinion is your right, and doctors are generally used to arranging exactly this transfer 6Ref 6MedlinePlus, U.S. National Library of Medicine (NIH) (2024).Your cancer diagnosis - Do you need a second opinion?.The lay point that seeking a second opinion is the patient's right and that patients are expected to gather or transfer copies of their records and imaging to the reviewing doctor, including via a directed transfer..

That directed transfer is the quiet workhorse of the whole process. It is how a slide in one city gets read in another without anything landing on your kitchen table.

The two rights that travel with access: correcting and tracking

Getting a copy is the first of three related rights. The second is the right to ask a provider to amend information in your record that you believe is wrong or incomplete — a mistaken diagnosis, a medication you never took, a mixed-up identifier 2Ref 2U.S. Department of Health and Human Services, Office for Civil Rights (2024).HIPAA for Individuals.The enumeration of the three related individual HIPAA rights used here — access to records, requesting corrections or amendments, and an accounting of certain disclosures.. A provider does not have to agree, but it must consider the request and, if it declines, let you file a statement of disagreement that travels with the record. The third is the right to an accounting of certain disclosures — a list of some of the places your information was shared 2Ref 2U.S. Department of Health and Human Services, Office for Civil Rights (2024).HIPAA for Individuals.The enumeration of the three related individual HIPAA rights used here — access to records, requesting corrections or amendments, and an accounting of certain disclosures..

Together, these turn a passive file into something you can actually govern. You can read it, correct it, follow where it went, and move it to whoever you choose. For the person weighing a second opinion, that control is the point: the record is the raw material of the next doctor's judgment, and the law makes sure you hold the master copy.

Common walls — and what actually moves them

A few obstructions come up again and again when people request their own records, and almost every one has a plain, unintimidating answer that does not require a lawyer. Recognizing the script is half the battle; here are the most common lines and what actually moves them.

• "You have to come in to sign a release." Some offices prefer their own authorization form. That is allowed, but it cannot be used to stall — the 30-day clock still runs whether you sign in person or send the request another way 1Ref 1U.S. Department of Health and Human Services, Office for Civil Rights (2024).Individuals' Right under HIPAA to Access their Health Information.The core claim that the HIPAA Privacy Rule gives an enforceable right to inspect and receive a copy of protected health information in the designated record set (medical and billing records), that access must be provided in the form and format requested when readily producible, that a covered entity must respond within 30 days, and that any fee must be reasonable and cost-based..
• "The doctor has to approve it first." Access to your own designated record set is your right, not a clinical decision the doctor signs off on 1Ref 1U.S. Department of Health and Human Services, Office for Civil Rights (2024).Individuals' Right under HIPAA to Access their Health Information.The core claim that the HIPAA Privacy Rule gives an enforceable right to inspect and receive a copy of protected health information in the designated record set (medical and billing records), that access must be provided in the form and format requested when readily producible, that a covered entity must respond within 30 days, and that any fee must be reasonable and cost-based.. The review that a few denials require is a narrow exception, not a routine gate.
• "We only send records to other doctors." You can direct records to another provider, but you are also entitled to a copy yourself. Both can be true at once.
• "That will be a large fee." Ask for the charge to be itemized and for an electronic copy, which is often free through the portal. A fee far above the cost of copying and postage is worth challenging.

None of this requires a confrontation. It usually requires one written request, the date of the deadline, and the willingness to follow up once. The right is already yours; these steps are just how you use it.