Requesting Your Medical Records: Step by Step

Requesting your medical records is something most patients will need to do at some point — when switching providers, seeking a second opinion, compiling a health history for a specialist, or simply keeping a personal copy. HIPAA gives you a clear right to access your own records, and providers are legally required to respond. The process is straightforward once you know what to submit, who to contact, and what timelines to expect.

Your right to access under HIPAA

Under the HIPAA Privacy Rule, you have the right of access to inspect and obtain copies of your protected health information held in what is called your designated record set. This includes your medical records, billing records, any records used by the covered entity to make decisions about your care, and enrollment and claims records held by your health plan.

The right of access applies to health information held by covered entities: healthcare providers who transmit health information electronically, health plans, and healthcare clearinghouses. If your provider accepts insurance or uses electronic health records — which is true of the vast majority — they are a covered entity.

A covered entity may deny your request only in narrow circumstances defined by HIPAA, such as when a licensed professional determines that access to certain psychotherapy notes could endanger you or another person. Routine medical records — visit notes, lab results, imaging reports, medication lists, surgical records — are within your right to request without justification. You do not need to explain why you want your records.

Step-by-step: how to submit your request

Step 1 — Identify the right department

For hospitals, contact the Medical Records department (sometimes called Health Information Management or HIM). For physician offices, call the main number and ask who handles medical records requests. For specialists or clinics, the front desk or a designated records coordinator usually manages requests.

Many providers have an online patient portal where you can directly download visit notes, lab results, and some records without submitting a formal request. Check the portal first — it may save you significant time.

Step 2 — Determine what records you need

Be as specific as possible. Requests for “all records” are valid but may produce large volumes and involve higher fees. If you need records from a specific time period, specific types of records (such as cardiology notes from 2023 to 2025, or all imaging reports), or records related to a specific condition, specifying this upfront will make the request more efficient.

Step 3 — Complete the request form or write a letter

Most providers will ask you to complete their standard records request form. If no form is available, a written letter is sufficient. Your request should include:

1. Your full legal name and date of birth (for identification)
2. Your current address and contact information
3. A description of the records you want (dates of service, types of records)
4. The format you prefer (electronic PDF, CD, paper, direct send to another provider)
5. Where records should be sent (to you, to another provider, to another address)
6. Your signature and the date

You may be asked to present a photo ID when submitting or picking up records in person.

Step 4 — Submit the request

Submit the form or letter to the appropriate department. You can submit by:

• In person at the provider’s office or records department
• By mail to the address provided on the provider’s records request form
• By secure fax (ask for the dedicated medical records fax number)
• Online through the provider’s patient portal or records request system, if available

Keep a copy of your request and note the submission date. Ask for a reference number or confirmation if submitting electronically or by phone.

Step 5 — Track the timeline

Under HIPAA, the provider has 30 calendar days from the date they receive your request to fulfill it. If they cannot meet that deadline, they may extend by one additional 30-day period, but they must provide written notice explaining the reason and the expected completion date before the first 30 days expire. That means the maximum allowable timeline is 60 days total.

If the 30-day mark passes without a response or explanation, follow up with the records department. If you cannot get a response, contact the provider’s patient advocate or administration. If the provider continues to fail to respond, you can file a complaint with the HHS Office for Civil Rights.

Step 6 — Review what you receive

When records arrive, review them for completeness. If records from specific dates or providers appear to be missing, contact the records department to identify what happened. Errors in medical records — incorrect medications listed, wrong diagnoses, events attributed to the wrong date — can be corrected by submitting an amendment request under HIPAA.

Documents and terms you’ll see

When requesting records, these terms appear on forms, responses, and HHS guidance:

• Right of access — the HIPAA provision giving you the right to inspect and copy your designated record set; providers cannot condition this on payment of outstanding bills or require you to justify your request
• Protected health information — the category of information you are requesting; under HIPAA it includes any individually identifiable health information created, received, or maintained by a covered entity
• Personal representative — if you are requesting records on behalf of another person, you are acting as their personal representative; you will need documentation such as a healthcare power of attorney, guardianship order, or evidence of parental relationship for a minor child
• Covered entity — the type of organization HIPAA applies to; confirms the provider is subject to the 30-day response requirement and fee limitations under HIPAA

Requesting records on behalf of someone else

If you are a personal representative requesting records for another person, you will need to provide documentation of your authority:

• For a minor child: You are generally the personal representative as a parent or legal guardian. Some states create exceptions for certain sensitive services — reproductive health, substance use treatment, mental health care for minors of a defined age — where the minor’s records are not accessible to parents without the minor’s consent.
• For an adult who has granted you authority: A healthcare power of attorney, durable medical power of attorney, or similar legal document. The provider will want a copy.
• For a deceased person: An executor, administrator, or next of kin may have access rights; state law and the circumstances of the death determine who qualifies. A death certificate and letters testamentary may be required.

Requesting records sent directly to another provider

If you are switching doctors or seeking a second opinion, you can request that records be sent directly to your new provider rather than to yourself. Specify the receiving provider’s name, address, and fax number (or direct secure messaging address if applicable). This is often faster than receiving paper copies yourself and then forwarding them.

The HIPAA and your medical records guide covers the broader landscape of your rights under HIPAA, including what HIPAA covers, how to file a complaint, and what disclosures your providers can make without your authorization.