The 5-Step Process
Identify who holds the records
Records live with the specific practice, hospital, lab, or imaging center that provided the service. There is no single central US medical records repository. If you saw a specialist through a hospital system, the hospital's release office handles it. Independent practices handle their own.
Submit a signed records-release request
Most practices use their own HIPAA release form. Ask the office or download from their website. Some accept letters. Include: your full legal name, date of birth, dates of service, records requested (all records vs specific types), format, where to send them, and your signature and date.
Choose format and delivery method
Under HIPAA you have a right to request records in the format you want (paper, PDF, patient portal download, CD for imaging) if the provider can reasonably produce them in that format. Electronic delivery is required if the records exist electronically. For imaging, always ask for a DICOM-format CD or download so a second-opinion provider can view the actual scans.
Wait up to 30 days
Federal HIPAA requires providers to fulfill requests within 30 days of receipt. One 30-day extension is permitted if the provider notifies you in writing. Most complete within 1-2 weeks. Some states have shorter deadlines (e.g. California requires 15 business days for inspection).
Escalate if refused or delayed beyond limits
If a provider refuses or misses the deadline, file a complaint with the HHS Office for Civil Rights at hhs.gov/hipaa/filing-a-complaint. Complaints are free and confidential.
Sample Medical Records Release Letter
Cost Limits Under HIPAA
Providers can only charge reasonable, cost-based fees. Allowed:
- Labor for copying (paper or electronic)
- Supplies (paper, toner, USB, CD)
- Postage if you request mail
- Summary preparation only if you specifically request one
NOT allowed:
- Search or retrieval fees
- Review or interpretation fees
- Overhead or administrative surcharges
Many states cap per-page fees (typically $0.65-$1.00 for first pages, less thereafter). Electronic delivery of already-electronic records must be free or at very low cost per HHS guidance.
Common Situations
Getting records for a second opinion
Request records to be sent directly to the second-opinion doctor's practice. Many practices exchange records via secure fax or direct-messaging systems. Allow 1-2 weeks; pathology slides may need to be shipped separately from a pathology lab. See how to get a second opinion.
Records after a doctor retires or a practice closes
State law dictates retention. Most states require 7-10 years for adult records; longer for pediatric. When a practice closes, records typically transfer to a successor practice, a storage service, or the state health department. Contact your state medical board for guidance if the practice is gone.
Records for a deceased family member
The personal representative (executor or administrator of the estate) has HIPAA-equivalent rights. Include a copy of the death certificate and letters testamentary or letters of administration.
Frequently Asked Questions
How long does it take to get medical records?
Federal HIPAA requires providers to fulfill records requests within 30 days of receipt. One 30-day extension is permitted if the provider notifies you in writing. Most practices complete requests within 1-2 weeks.
How much can a doctor charge for medical records?
HHS allows only reasonable, cost-based fees: labor for copying, supplies, postage, and summary preparation if you request one. Providers cannot charge for retrieval, review, or search time. Many states cap per-page fees. Electronic delivery of already-electronic records must be free or at very low cost.
Can a doctor refuse to give me my medical records?
Very rarely. Under HIPAA you have a right of access to your own records. Providers can deny access in narrow circumstances (psychotherapy notes, records compiled for litigation, or when access is reasonably likely to endanger you or another person) but must provide a written denial and, in most cases, allow you to request review of the denial.