How to Get Your Medical Records

Your medical records, also known as health records, are an important part of your care. Under federal law, you have the right to access the information contained in these records and to make updates or corrections when needed. Doing so gives you better control over medical decisions.

Healthcare providers or insurance companies can also share information in your medical records when the information is essential for treatment. They are also allowed to share certain aspects of your information when attempting to collect payment.

This article explains how to make a request for medical records and what to do if a request is denied. It also describes the types of information that can be shared without your consent and how to make corrections if there are errors or omissions in your file.

What Information Does a Medical Record Contain?

A medical record is a written account of a person's health history. Today, most medical records are kept and shared electronically, although some providers will maintain paper records.

Your medical records may include:

• Information about your past history, family history, and social history
• Records of diagnoses, including provisional diagnoses
• Prescribed medications and treatments
• Lab and imaging test results
• Diagnostic procedures, like electrocardiogram (ECG) or colonoscopy
• Immunization records
• Observations by the healthcare provider
• Hospital admissions, including consent forms and discharge summary
  
• Insurance requests and responses
• Billing information
  
• Authorizations like medical power of attorney and organ donation
• Records shared by other healthcare providers
  

How to Request Your Medical Records

Many medical practices today maintain an online patient portal so that patients can access their medical records on demand. These websites are secure and allow you to make appointments or message your provider directly.

If a provider doesn't have an online portal, you would need to request the records by phone or email. Most have forms that you would need to fill out.

If the office doesn't have a form, you can make a written request, providing:

• Your full name
• Social Security number
• Date of birth
• Address
• Phone number
• Email address
• The list of records being requested
• The dates of service
• Delivery options (fax, post, email, in person)
• Signature
• A copy of your ID

Once the request has been made, you may have to wait before the record is actually received. State laws vary but typically require delivery within 30 to 60 days.

Be sure to keep a copy of the original request. Contact your state’s Department of Health if you fail to receive the documents after repeated attempts.

Who May Request Medical Records

According to the Health Insurance Portability and Accounting Act (HIPAA) of 1996, you have the right to obtain copies of most of your medical records, whether they are electronic or on paper.

While HIPAA regulations are designed to protect your privacy, they are so extensive that many providers are confused about how to enforce them. This can make it difficult to obtain your records even if you are entitled to them.

According to HIPAA, you have the right to request medical records if:

• You are the patient or the parent or guardian of the patient whose records are being requested.
• You are a caregiver or advocate who has obtained written permission from the patient.

Many people assume that only they or their designees can obtain copies of their medical records. Under federal law, there are others who may also have the right.

This not only includes your primary care provider but any third party to whom you may have unknowingly granted the right when registering with them. These include not only other practitioners but also insurance companies, hospitals, labs, nursing homes, rehabilitation centers, and billing providers.

Some people also request that their information be shared with mobile apps (such as those that monitor your heart disease or diabetes). Under HIPAA, you have the right to make the request, but your provider is not responsible for how the mobile app uses or secures the information.

Which Records Can Be Provided

Generally, you have the right to see and get a copy of your medical records in full. This is true whether you have paid a provider or not. Under federal law, your provider must give you access to your records even if you have an unpaid bill.

With that said, there are limitations as to how far back in your history you can go. Though state laws vary, most providers in the United States (including medical practitioners, hospitals, and labs) are required to keep adult medical records for seven years.

By contrast, the medical records of children must be kept until the age of majority (18 in some states and 21 in others). There are even a few states that require practitioners to maintain records several years beyond the age of majority.

Among the various records you have the right to obtain:

• Any notes or records that a provider has created themselves
• Any diagnostic results for which a provider has copies including blood tests, X-rays, mammograms, genetic tests, biopsies, etc.
• Any information provided by another healthcare provider that was used to establish a diagnosis and/or direct treatment

If you’re seeking a specific lab test or hospital record, it is often best to request them from the facility rather than from your primary care provider. The records are not only more likely to be complete but they are usually kept longer than in private practice.

Records Your Provider May Deny

There are records you may be denied access to. These mainly involve mental health records that are considered “impressions” rather than diagnoses. Disclosing these may harm the provider-patient relationship if they are misconstrued or taken out of context.

With that said, a provider cannot deny access because it might hurt your feelings. It can only be denied if the information might cause you to hurt yourself or others. The denial must be provided to you in writing.

Under federal law, you can also be denied access to medical information compiled for use in a lawsuit.

If you feel you've been unfairly denied access to your medical records, you can file a complaint with the Office of Civil Rights (OCR) at the Department of Health and Human Services.

If the OCR agrees with your complaint, it will instruct the provider to release the information. It can even enforce a settlement if actual harm was done. The complaint must be filed within 180 days of the violation.

You can also file a complaint if your medical confidentiality has been breached.

Do the Records Cost Anything?

Obtaining your records through an online patient portal is usually free. Some providers may charge if you want them delivered on paper or electronic media (such as a USB drive), but the price must be reasonable.

For example, a provider cannot charge an excessive fee to recoup money you have not paid them. If there is an unpaid bill, they have to take that up separately, either by filing a lawsuit or hiring a debt collection agency.

When you request your health record, be sure to ask how much it will cost and if there are any less costly options.

What if My Healthcare Provider Is No Longer in Practice?

If your healthcare provider retires or is no longer in practice, all medical records must still be maintained under the law. This is true even if the provider has died or dissolved the practice.

If a provider has left a group practice but the practice is still operating, your records must be maintained by the remaining members.

If the practice is sold, the new practice is responsible for your records and may be liable if they are lost or mishandled. The new practice must also receive your written consent before the files can be transferred.

Tracking down your records can be especially challenging if a provider’s office is closed without any forwarding details.

In such instances, there are several things you can do:

• Contact your state or local medical society: Many of these organizations require annual registration and will likely have the latest contact information.
• Speak with your health insurance company: If the healthcare provider is still an approved provider, your insurer will have contact details.
• Contact any hospital where your healthcare provider made rounds: Healthcare providers undergo a formal process to obtain hospital privileges. Human resource departments will usually have details on file.

If all else fails, you may need to reconstruct your file by contacting the labs, hospitals, or specialists you used. Your health insurers, both past and present, can also provide you with details of any claims made on your behalf.

How to Correct Errors

Once you’ve obtained a copy of your medical records, review them carefully. If you find errors or omissions, you will want to have them corrected to ensure they don’t compromise your future care.

Most providers will readily agree to correct factual errors or track down missing reports.

On the other hand, they are not required to change a record because you don't agree with them or would rather have certain facts left out. Examples include a diagnosis of alcohol or HIV. Cutting these is not only unethical but may subject the provider to legal action.

With that said, if you believe that the refusal is unjust or places you in harm’s way, submit a complaint to the OCR describing the dispute. They can decide if the correction is warranted.

Summary

Under federal law, you are allowed access to and copies of your medical records. You can often access these through an online patient portal but may need to request medical records if one is not available.

Knowing how to get your medical records can give you better control over medical decisions. This includes knowing who can access your records without your consent (such as health insurers and billing agencies) and who cannot.

Certain records may also be denied to you, including certain psychiatry notes or any information obtained for a lawsuit. If you've been unfairly denied access or your privacy has been breached, you can file a complaint with the Office of Civil Rights (OCR).

Verywell Health uses only high-quality sources, including peer-reviewed studies, to support the facts within our articles. Read our editorial process to learn more about how we fact-check and keep our content accurate, reliable, and trustworthy.

1. Department of Health and Human Services Office for Civil Rights. HIPAA privacy rule and sharing information related to mental health.
2. Department of Health and Human Services Office for Civil Rights. Your health information, your rights.
3. Department of Health and Human Services Office for Civil Rights. Individuals’ right under HIPAA to access their health information 45 CFR § 164.524.
4. Health Information and the Law Project. Medical record retention required of health care providers: 50 state comparison.
5. Department of Health and Human Services Office for Civil Rights. Filing a complaint.
6. American Medical Association. Obtaining medical records from closed practices.
7. American Academy of Family Physicians. Starting, closing, or selling a practice.

By Trisha Torrey
Trisha Torrey is a patient empowerment and advocacy consultant. She has written several books about patient advocacy and how to best navigate the healthcare system.

• Meet Our Medical Expert Board
• About Us
• Editorial Process
• Diversity Pledge
• Privacy Policy
• In the News
• Advertise
• Terms of Service
• Careers
• Contact
• EU Privacy

Verywell Health's content is for informational and educational purposes only. Our website is not intended to be a substitute for professional medical advice, diagnosis, or treatment.

We Care About Your Privacy

We and our 100 partners store and/or access information on a device, such as unique IDs in cookies to process personal data. You may accept or manage your choices by clicking below, including your right to object where legitimate interest is used, or at any time in the privacy policy page. These choices will be signaled to our partners and will not affect browsing data.

We and our partners process data to provide:

Store and/or access information on a device. Use limited data to select advertising. Create profiles for personalised advertising. Use profiles to select personalised advertising. Create profiles to personalise content. Use profiles to select personalised content. Measure advertising performance. Measure content performance. Understand audiences through statistics or combinations of data from different sources. Develop and improve services. Use limited data to select content. List of Partners (vendors)