Pillar guide · 45 CFR § 164.524
Your HIPAA right of access: how to get your medical records
Your medical records are yours to see. A single federal rule — the HIPAA right of access, at45 CFR § 164.524 — gives almost every person in the United States the right to get a copy of their own health information from the providers who hold it. Here is exactly what that right entitles you to, and how to use it.
What the right of access is
Under the HIPAA Privacy Rule, you have the right to inspect and get a copy of the health information a provider or health plan keeps about you in its designated record set — the records used to make decisions about your care. That includes your medical records and your billing records. You can ask for the copy for yourself, or direct the provider to send it to someone else, such as a new doctor.
The 30-day rule (and the one allowed extension)
A provider must act on your request no later than 30 calendar days after receiving it. It may take a single 30-day extension — but only if, within that first 30 days, it gives you a written statement of the reason for the delay and the date it will finish. That makes 60 days the outer limit, and only one extension is ever allowed per request.
What they can — and can't — charge you
A provider may charge only a reasonable, cost-based fee. By law that fee can cover just four things:
- labor for copying the records, on paper or electronically;
- supplies, such as paper or a USB drive or CD if you ask for one;
- postage, if you ask for the copy to be mailed;
- preparing a summary or explanation, only if you agree to one.
They cannot bill you for searching for or retrievingyour records — even in states whose fee schedules seem to allow it. Records sent to you electronically are frequently provided at no cost.
How to use your right, step by step
Find the right records office
Identify where you were treated and how they take requests — usually the patient portal (MyChart and similar) for recent records, or the Health Information Management / Release of Information office for older or complete charts.
Put the request in writing
A written request is your strongest tool. Name the patient, the records and date range you want, and where to send them. A HIPAA right-of-access letter does this for you — findmy.health writes one free, no account.
Ask for the format you want
If the records are kept electronically, you can ask for an electronic copy — which is often free. You can also direct the provider to send a copy to someone else, such as a new doctor.
Start the 30-day clock
The provider must act within 30 calendar days of receiving your request. They may take one 30-day extension, but only with written notice of the reason and a completion date.
Escalate if you're denied or overcharged
If a provider ignores your request or charges more than a reasonable, cost-based fee, file a complaint with the HHS Office for Civil Rights through its online portal — generally within 180 days of the problem.
How to escalate to HHS
If a provider denies your request without a valid reason, drags past the deadline, or charges more than the rules allow, you can file a complaint with theHHS Office for Civil Rights (OCR), which enforces the right of access. File through theOCR complaint portal, generally within 180 days of when you learned about the problem. OCR has repeatedly fined providers for denying patients access or overcharging them.
Common questions
Does this apply to every doctor and hospital?
It applies to almost all US healthcare providers and health plans — any 'covered entity' under HIPAA. That covers hospitals, clinics, physician practices, labs, and pharmacies that bill electronically.
Can they refuse to give me my records?
Only in narrow situations. Psychotherapy notes are excluded from the right of access, and a small set of denials are allowed (for example, if access is reasonably likely to endanger someone). Most refusals to hand over ordinary records are not permitted.
Can they make me use their form?
A provider can ask you to use its own request form, but it cannot create barriers that unreasonably delay you. A clear written right-of-access request that names the records and where to send them must be honored.
Primary source: the HIPAA right of access,45 CFR § 164.524and HHS Office for Civil Rights guidance. Reviewed by the MedicalRecords.com editorial team · Last reviewed July 2026. This is general information about your records rights, not legal advice.