How to get your medical records

Who has to give you your records

The Health Insurance Portability and Accountability Act (HIPAA), the federal health privacy law, gives you the right to see and get copies of your health information. It covers health plans, most health care providers, such as your doctor's office or hospital, and health care clearinghouses, along with the companies that do work for any of them.

HHS, the U.S. Department of Health and Human Services, says the HIPAA rules do not protect data you have entered into a mobile app for your personal use, or your internet search history. This page is about the records your providers and plans keep.

Sources: Get it. Check it. Use it. and Protecting the Privacy and Security of Your Health Information When Using Your Personal Cell Phone or Tablet, read October 4, 2026; the law's full name, Summary of the HIPAA Privacy Rule, read October 4, 2026.

What you can get

You can look at and get a copy of the health information your provider or plan keeps about you in your records, for as long as they keep it there. Two kinds are left out: a therapist's separate psychotherapy notes, and information put together for a lawsuit or a similar proceeding. The rule also lets them deny access in a few other set cases; for some of those you can ask for the denial to be reviewed by a licensed health care professional who took no part in the decision.

If the records are kept electronically and you ask for an electronic copy, they must give it to you in the form and format you ask for, if they can readily produce it that way; if not, in a readable electronic form you both agree on. HHS puts it this way: in most cases, you can get a copy the way you want it, such as by e-mail.

Sources: 45 CFR 164.524, Access of individuals to protected health information, read October 5, 2026; Get it. Check it. Use it., read October 4, 2026.

How to request your records

Contact your doctor's office, hospital or health plan and ask for a copy of your records. Ask for the medical records department, sometimes called health information management, or use the patient portal.

Who to contact in your state, with each office's own page and what it says: who to contact in the United States.

Sources: Get it. Check it. Use it., read October 4, 2026; 45 CFR 164.524, Access of individuals to protected health information, read October 5, 2026.

Records from a hospital or more than one provider

There is no single place that holds all of your records. Each provider keeps its own, so ask each one: the hospital for a hospital stay, the practice for office visits, the plan for its own records. The right is to the information each one holds, for as long as it keeps it in your record. How far back you can go depends on how long each one keeps records, which this page does not cover.

Source: 45 CFR 164.524, Access of individuals to protected health information, read October 5, 2026.

Seeing your records online

HHS says that if your doctor offers a web portal, you may be able to see your health information there whenever you want.

Source: Get it. Check it. Use it., read October 4, 2026.

How long it can take

A provider or plan covered by HIPAA must act within 30 days of receiving your request, and act means give you the records or tell you in writing why not. It may take one extension of up to 30 more days, and only one, if within the first 30 days it tells you in writing why it needs more time and by what date it will answer. HHS adds that your doctor often can provide the information much sooner than that.

Your state may set a shorter deadline. 11 states do, for all patients or for some; the ticks under the first bar show 10 of them in calendar days; the key gives each in its law's own unit. The table under What your state adds names them.

Sources: 45 CFR 164.524, Access of individuals to protected health information, read October 5, 2026; Get it. Check it. Use it., read October 4, 2026.

What it can cost

They may charge a reasonable, cost-based fee for a copy you ask for yourself. The rule limits the fee to the cost of four things: the labor of copying, on paper or electronically; supplies for a paper copy, or for a USB stick or disc if you asked for the electronic copy that way; postage, if you asked for it by mail; and preparing a summary or explanation, if you agreed to one.

HHS says the fee may not be a per-page fee if your information is stored electronically, and that you cannot be denied access for not paying your medical bill.

The federal rule sets no dollar figure. 32 states make a copy free in at least one case, and 48 states and DC set their own fee rules, from per-page caps to a restatement of the federal cost-based fee; each state's page lists them.

Sources: 45 CFR 164.524, Access of individuals to protected health information, read October 5, 2026; Get it. Check it. Use it., read October 4, 2026.

If you are refused or get no answer

You can file a HIPAA complaint with the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS).

• Online: the OCR Complaint Portal.
• By mail: HHS asks you to send its complaint and consent forms to: Centralized Case Management Operations U.S. Department of Health and Human Services 200 Independence Avenue, S.W. Room 509F HHH Bldg. Washington, D.C. 20201
• By email: send the same forms to OCRComplaint@hhs.gov. HHS warns that unencrypted email may be intercepted by others on the way.
• File within 180 days of when you knew about the problem. OCR may allow more time if you show good cause.
• The provider or plan cannot retaliate against you for filing a complaint.

Sources: Complaint Process (HHS) and Filing a HIPAA Complaint (HHS), read October 5, 2026.

If your electronic record is held back

Information blocking is when a health care provider, a developer of certified health information technology, or a health information exchange or network does something likely to interfere with your getting, sharing or using your electronic health information, unless the law requires it or an allowed exception covers it. You can report it through the federal Report Information Blocking Portal, run by the Assistant Secretary for Technology Policy and Office of the National Coordinator for Health Information Technology (ASTP/ONC), the federal health IT office. The rule is the 21st Century Cures Act information blocking rule (45 CFR Part 171).

Sources: Information Blocking (ASTP/ONC, HealthIT.gov), read October 5, 2026; the office's full name, Assistant Secretary for Technology Policy and Office of the National Coordinator for Health Information Technology.

Find your state: what it adds and who to contact

HIPAA is the floor in all 50 states and DC. A state can add to it with a shorter deadline, for all or some patients, a free copy in some cases, or both. 35 states add something. 13 states and DC add no shorter deadline and no free copy; many still set their own fee rules, listed on each state's page. In Alaska and Idaho we found no state law on this. Each answer is as of October 3, 2026, the day we read the law, with the law behind it; the state's own page quotes that law and the rest of what the state adds.