Your right to your medical records under HIPAA: copies, fees and fixes

The basic right

Under the federal HIPAA Privacy Rule, you have a legal right to see and get copies of your own health information. This is called the right of access. It applies to most doctors, hospitals, pharmacies, labs and health insurers, which the law calls covered entities.

The right covers what HIPAA calls your designated record set. In plain terms, that means your medical records and billing records, plus records a provider or plan uses to make decisions about you. It includes test results, imaging reports, visit notes and claims records. A personal representative, such as a parent of a minor or someone with health care power of attorney, can usually use this right for you.

What isn't included

A few things fall outside the right. Psychotherapy notes, meaning a therapist's separate private notes from counseling sessions, are excluded. So is information gathered for use in a lawsuit or other legal proceeding.

A provider can also deny access in some limited cases, for example if a licensed professional decides that access is reasonably likely to endanger your life or physical safety or someone else's. In many of those cases you can ask for the denial to be reviewed by a different licensed professional. Any denial must be in writing, explain why, and tell you how to complain.

How to ask

Contact the provider's medical records or health information office. A provider may require you to ask in writing, but only if it has told you that in advance. Many offices have a simple form.

• Say exactly what you want, such as all records from a date range or only lab results.
• Say how you want it: paper, a PDF by email, a download, or a USB drive.
• If you want the records sent straight to someone else, such as a new doctor or a family member, say so and give their details in writing.
• Keep a copy of your request and note the date you sent it.

How long they have

A covered entity must act on your request within 30 days of receiving it. If it can't, it may take one extension of up to 30 more days. To do that, it must tell you in writing, within the first 30 days, why it needs more time and when you'll get the records. Some state laws set shorter deadlines, and many providers respond much faster.

What it can cost

Fees must be reasonable and cost-based. A provider can charge only for the labor of making the copy, supplies such as paper or a USB drive, postage, and preparing a summary if you agree to one ahead of time. It can't charge you for searching for or retrieving your records.

For records kept electronically, HHS guidance lets a provider skip the math and charge a flat fee of no more than $6.50, covering labor, supplies and postage. That flat fee is optional and is a ceiling, not a required charge. Whatever method it uses, the provider should tell you the approximate fee up front. Viewing your records in person, or in a patient portal, is generally free.

Electronic copies and patient portals

If your records are kept electronically and you ask for an electronic copy, you must get one in the form you ask for if it can readily be produced, or in another readable electronic format you agree to.

A separate law, the 21st Century Cures Act, adds pressure to share. Its information blocking rules bar health care providers, certified health IT developers and health information networks from practices likely to interfere with access to electronic health information, unless an exception applies. One practical result is that many test results and notes now appear in patient portals quickly, sometimes before your doctor has reviewed them with you.

In September 2025, HHS announced a crackdown on information blocking. Providers found to have blocked information can face penalties under certain Medicare programs, and certified health IT developers and health information networks can face fines of up to $1 million per violation. You can report suspected blocking through the federal Report Information Blocking Portal on HealthIT.gov.

Fixing mistakes in your record

HIPAA also gives you the right to ask a provider or plan to amend information in your record that you believe is wrong or incomplete. The office may ask you to put the request in writing and give a reason.

It must act within 60 days, with one possible 30-day extension if it tells you in writing. It can deny the request if, for example, it didn't create the record or the record is already accurate and complete. If it denies you, it must explain why in writing. You can then file a statement of disagreement, and that statement must be attached to the disputed part of your record and included in future disclosures of it.

If you're refused or ignored

Start by contacting the provider's privacy officer, whose contact information should be in its Notice of Privacy Practices. If that doesn't work, you can file a complaint with the HHS Office for Civil Rights (OCR), which enforces HIPAA.

• File within 180 days of when you knew about the problem. OCR may extend that for good cause.
• You can file online through the OCR Complaint Portal, by mail or by email.
• Include your name and contact information, the name of the provider or plan, what happened and when, and your signature.
• The law bars providers and plans from retaliating against you for filing a complaint.

Good habits

Ask for copies after major tests, hospital stays and surgeries, and keep them in one place. Sign up for each provider's patient portal. If you change doctors, request that records be sent directly to the new office. This is general information, not legal advice, and state laws may give you additional rights.