How to Get Your Medical Records (and What They Can Legally Charge You)

The Federal Right That Gets You the Complete File Within 30 Days

Federal law gives you the right to a copy of your complete medical record, and the provider has 30 days to hand it over.

The fee has to be reasonable and cost-based, you never have to give a reason, and an unpaid bill is not a legal ground to refuse you.

Those rules come from HIPAA's right of access, 45 C.F.R. § 164.524, and providers violate them often enough that federal regulators run a standing enforcement program about it.

If you suspect a diagnosis was missed or a surgery went wrong, the record is where the answer lives.

Getting the complete file, quickly and cheaply, is the first move.

Call (888) 713-6653 for a free case review; if the records show malpractice, we know what to look for.

What a Complete Records Request Covers: The Designated Record Set

The law entitles you to the designated record set, which is much more than the visit summary a portal shows you. It includes the medical chart, the billing records, clinical lab results, medical images such as X-rays and MRIs, and the clinical notes used to make decisions about your care.^[1]

A summary or abstract does not satisfy a request for the full set, and the difference matters in an injury case: the medication administration records, nursing flowsheets, and billing codes are frequently where a malpractice case is found. Here is how to ask so you get everything:

• Put it in writing to the provider's health information management or medical records department, and keep a copy.
• Ask for the complete designated record set, naming the billing records and imaging specifically so nobody trims the request to the chart alone.
• Request electronic copies in the format you want; if the records are electronic and the format is readily producible, they must comply.
• Date the request. The 30-day clock runs from receipt.
• List every provider separately. The hospital, the imaging center, the specialist practice, and the lab each hold their own set.

Two narrow exceptions exist: psychotherapy notes a therapist keeps separate from the chart, and material compiled for a lawsuit. Everything underneath those documents, the treatment record itself, stays accessible to you even while a claim is underway.

The Federal Access Rules: Deadlines, Fees, and Format

Request Your Own Copy First: The Fee Rule Most People Never Hear About

Since a 2020 federal court decision in Ciox Health v. Azar, the HIPAA fee limits protect an individual requesting their own records. They no longer cap what can be charged when the request directs records to a third party, and that includes a law firm.^[3]

The practical move is simple. Request your own copy, at the protected cost-based rate, and hand it to whoever needs it. The identical file requested through a third-party directive can lawfully be billed at much higher state or contract rates by the release-of-information vendors most hospitals use.

When we investigate a malpractice case, complete records are the foundation, and our page on how malpractice claims get investigated shows what happens to the file after it arrives: the expert review that a merit filing in most states requires cannot start until the records are in hand.

Late, Incomplete, or Altered Records: OCR Complaints and the Audit Trail

When a provider blows the deadline or stonewalls, the enforcement route is a complaint to the HHS Office for Civil Rights, which has run a dedicated Right of Access Initiative since 2019 and announced its 54th enforcement action, a $112,500 settlement, in December 2025. There is no private lawsuit under HIPAA itself, but the complaint costs nothing and providers respond to it.

If a record looks wrong, you can demand amendment under 45 C.F.R. § 164.526, and if they refuse, you can file a statement of disagreement that must travel with every future disclosure of the disputed record.^[4] In a potential malpractice case, though, talk to a lawyer before you start that fight.

Here is why. Electronic health systems keep audit trails: timestamped logs of who opened, edited, or printed each record and when. Those logs are discoverable in litigation, and they are how after-the-fact chart edits get exposed. A record that was quietly revised after a bad outcome is often more damaging to the provider than the original mistake, so the smart play is to preserve everything and let the metadata tell its story.

Your Test Results Reach the Portal First Now, and the Timestamp Can Matter

Federal information-blocking rules under the 21st Century Cures Act require providers to release electronic health information, including lab results and imaging reports, without sitting on them, and HHS finalized financial penalties for provider information blocking in June 2024.

Patients now routinely see a radiology report or a biopsy result before the doctor calls. For anyone worried about a delayed diagnosis, that changes the evidence: the portal shows exactly when the abnormal result was available, to you and to the practice. When a serious finding sat unactioned, the timeline is no longer a matter of memory, a pattern we see across missed-diagnosis cases.

How Long Providers Keep Records, and Why the Legal Clock Moves Faster

Medicare-participating hospitals must keep medical records at least five years, and state retention laws commonly run five to ten, longer for children.^[5] That sounds like plenty of time. It is not.

The malpractice filing deadline in most states is far shorter than the retention period, and the expert review that has to happen before filing consumes weeks of it. Request the records early, because the deadline math, including the discovery rule and its exceptions, is less forgiving than people assume; our page on how the malpractice statute of limitations actually runs walks through it.