How to get copies of your medical records

You have a legal right to see and get copies of your own medical and billing records. Ask each provider’s records office in writing, say exactly what you want and in what format, and keep a copy of your request. Under federal HIPAA rules, the provider generally has 30 days to act, and state laws can add their own timelines and fee rules.

This guide explains the federal right that applies nationwide, uses Florida and Arizona as examples of state rules, and ends with a checklist for your request letter. Rules differ by state, and an attorney licensed in your state can tell you what applies to you.

Your right to your records under federal law

The HIPAA Privacy Rule gives you “the right to inspect, review, and receive a copy” of your medical and billing records held by covered health care providers and health plans, with few exceptions, according to the U.S. Department of Health and Human Services (HHS, Your Medical Records). The rule itself describes this as a right to inspect and obtain a copy of your health information in a “designated record set” for as long as the provider keeps it (45 C.F.R. § 164.524(a)(1)).

Two kinds of information are excluded from that right:

• Psychotherapy notes. HHS explains that these are notes a mental health professional takes during a conversation with a patient and keeps separate from the medical and billing records.
• Information compiled in reasonable anticipation of, or for use in, a legal action or proceeding (45 C.F.R. § 164.524(a)(1)(ii)).

HIPAA applies to “covered entities.” HHS describes the health care providers it covers as those that conduct certain transactions electronically (HHS, Filing a Health Information Privacy Complaint). State law can give you access rights too, and the two can apply at the same time.

What to ask for

Be specific. If you’re trying to understand what happened during a course of care, it helps to ask for the complete record for the dates involved rather than a visit summary. Items people commonly ask for include:

• office visit notes, histories, and physical exams;
• hospital records: admission notes, progress notes, nursing notes, and the discharge summary;
• operative and procedure reports, and anesthesia records;
• medication records, including what was ordered and what was given;
• lab and test results, and imaging reports;
• the images themselves, such as X-rays (HHS lists “x-rays and other medical images” among the things you can get);
• billing records and itemized statements.

State law may spell this out. Florida requires licensed practitioners to furnish copies of “all reports and records” of an examination or treatment, “including X rays and insurance information” (Fla. Stat. § 456.057(6)). Arizona’s law covers both “medical records” and “payment records” (A.R.S. § 12-2293(A)).

If you saw several providers, you’ll need to ask each one separately. A hospital, the doctors who treated you there, an outside lab, and an imaging center may each keep their own records.

How to make the request: a letter checklist

A provider may require requests in writing, as long as it tells you so (45 C.F.R. § 164.524(b)(1)). If your provider has its own form, it’s fine to use it. Either way, a written request gives you a date to count from. Include:

1. Your identifying details: full name, any former names, date of birth, and your patient or account number if you have it.
2. The provider and location: the name of the practice, hospital, or facility, and the department if you know it.
3. The dates of care: the date range you want, such as “all records from March 1 through May 31.”
4. What you want: “my complete medical record and billing records for those dates,” plus any specific items from the list above.
5. The format: paper, or an electronic copy (for example, by secure email, a download, or on a disc or drive).
6. Where to send it: your mailing address or email, or a pickup request.
7. If someone else should receive a copy: their name and address (see “Having copies sent elsewhere” below).
8. If you’re requesting for someone else: your relationship and a copy of the document that gives you authority.
9. Your signature and the date.

Keep a copy of the request and note how you sent it. Certified mail, a fax confirmation, or a screenshot of a portal submission all give you proof of the date.

If your provider has a patient portal, HHS notes you may be able to view and download your information there (HHS, Get it. Check it. Use it.). Check whether the portal shows everything you need. If it doesn’t, make a written request as well.

How long they have to respond

Under HIPAA, a provider must act on your request no later than 30 days after receiving it. If it can’t, it may take one extension of no more than 30 more days, but only if it tells you in writing, within the first 30 days, why it needs more time and when it will finish (45 C.F.R. § 164.524(b)(2)). HHS adds that your doctor “often can provide the information much sooner.”

State laws can set different timelines:

• Florida: practitioners must furnish copies “in a timely manner, without delays for legal review” (Fla. Stat. § 456.057(6)). Hospitals and other licensed facilities must do the same on written request after the patient is discharged, and must also let you examine the original records on reasonable terms (Fla. Stat. § 395.3025(1)).
• Arizona: response times depend on why you’re asking. Requests for upcoming medical treatment get 10 or 15 business days, depending on how old the records are. Other requests, including those for litigation, personal copies, and records of a patient who has died, get 30 calendar days (A.R.S. § 12-2293(E)).

Put a reminder on your calendar for the response date. If it passes with no answer, call the records office, refer to the date of your written request, and ask when you’ll receive the copies.

Format and cost

You can ask for your records in the form and format you want. The provider must provide it that way if the records are “readily producible” in that form, or else in a readable hard copy or another format you both agree on. If the records are kept electronically and you ask for an electronic copy, you’re entitled to an electronic copy (45 C.F.R. § 164.524(c)(2)). A provider can give you a summary instead of the full record only if you agree to that in advance.

On cost, HIPAA allows a “reasonable, cost-based fee” that may include only certain costs: labor for copying, supplies, postage, and preparing a summary if you agreed to one (45 C.F.R. § 164.524(c)(4)). HHS’s consumer guidance adds that:

• a provider cannot deny you a copy because you haven’t paid for the care you received;
• a provider cannot charge you for searching for or retrieving your records;
• the fee may not be a per-page fee if your information is stored electronically.

States also regulate copy charges. Florida limits what practitioners may charge to the actual cost of copying, including reasonable staff time, or an amount set by rule (Fla. Stat. § 456.057(17)), and sets specific limits for hospitals and facilities, with no copying charge when the records are for continuing care (Fla. Stat. § 395.3025(1)). Arizona allows a reasonable fee but bars charging a patient who needs the records for the demonstrated purpose of obtaining health care (A.R.S. § 12-2295). Ask the records office for the charge in writing before it copies anything.

If your request is denied or ignored

A provider that denies all or part of your request must tell you in writing, in plain language. The denial must give the reason, explain any right you have to a review, and describe how to complain to the provider or to HHS (45 C.F.R. § 164.524(d)(2)). It must still give you the parts of the record it has no ground to withhold.

Some denials can be reviewed. If access was denied because a licensed professional decided it was reasonably likely to endanger someone, or to cause substantial harm, you can ask for a review by a different licensed health care professional who wasn’t involved in the first decision (45 C.F.R. § 164.524(a)(3)–(4)). Arizona has similar grounds and also requires a written explanation of the reason (A.R.S. § 12-2293(B)–(D)).

If a provider doesn’t have the records but knows where they are, it must tell you where to send your request (45 C.F.R. § 164.524(d)(3)).

If you believe your access rights were violated, you can file a complaint with the HHS Office for Civil Rights (HHS, Filing a Health Information Privacy Complaint). A complaint must be filed within 180 days of when you knew or should have known about the problem, unless HHS waives that limit for good cause (45 C.F.R. § 160.306(b)(3)).

Records for a child, an adult you care for, or someone who died

HIPAA treats a “personal representative” as the patient for records purposes (45 C.F.R. § 164.502(g)). HHS explains who that usually is (HHS, Personal Representatives):

• An adult: someone who can make health care decisions for the person, such as under a health care power of attorney.
• A minor child: usually a parent or legal guardian, though state law and custody orders can affect this.
• Someone who has died: the executor or administrator of the estate, or a person authorized by a court or by state law to act for the person or the estate.

State law can widen that group. In Florida, if there is no guardian or personal representative, a hospital or facility must furnish records to the next of kin of a patient who has died, or to the parent of a minor (Fla. Stat. § 395.3025(1)). In Arizona, if no personal representative has been appointed, a provider may release a deceased patient’s records to family members in a set order of priority that begins with the spouse and includes adult children, parents, and adult siblings. It can’t do so if the patient, or someone higher on that list, told the provider in writing that the patient opposed the release (A.R.S. § 12-2294(D)).

Include a copy of the document that shows your authority, such as a power of attorney, guardianship order, or letters of administration, with your request.

Having copies sent elsewhere, and keeping your own

You can direct a provider to send a copy of your records straight to another person you choose. The request must be in writing, signed by you, and clearly say who should receive the copy and where to send it (45 C.F.R. § 164.524(c)(3)(ii)). If you hire an attorney, they may handle requests this way.

Keep the copies you receive in one place, in date order, and work from duplicates so the originals stay clean. Your records are yours: keep them, and share them only with your own doctors and, if you choose, an attorney you hire. We never ask for copies of your medical records. For what else to keep and do while you gather records, see what to do if you think a doctor made a mistake. For background on how claims work, see what medical malpractice is.

Sources and corrections

We wrote this guide from the primary sources below and checked it against them on September 25, 2026.

• 45 C.F.R. § 164.524: HIPAA right of access, timing, format, fees, and denials
• 45 C.F.R. § 164.502(g): personal representatives, including for deceased patients
• 45 C.F.R. § 160.306: filing a complaint with HHS
• HHS, Your Medical Records: access, charges, and psychotherapy notes
• HHS, Get it. Check it. Use it.: timing, format, portals, and fees
• HHS, Personal Representatives: who can request records for someone else
• HHS, Filing a Health Information Privacy Complaint: who HIPAA covers and how to complain
• Fla. Stat. § 456.057: Florida practitioner records and copy charges
• Fla. Stat. § 395.3025: Florida hospital and facility records
• A.R.S. § 12-2293: Arizona access, response times, and denials
• A.R.S. § 12-2294: Arizona release of a deceased patient’s records
• A.R.S. § 12-2295: Arizona copy charges

We are not attorneys, and this guide is not legal advice. Laws change and differ from state to state. If anything here is out of date or wrong, email support@malpracticeattorneys.com with the page name, and we’ll review it and update the page.