Your medical records are an important component of your care. You have the right to access the information contained in your records and, if necessary, make updates or corrections.
Healthcare providers or insurance companies may share the information in your medical records when that information is needed for treatment. They may also share the information during attempts to collect payment.
How to Request Your Medical Records
Most practices or facilities will ask you to fill out a form to request your medical records. This request form can usually be collected at the office or delivered by fax, postal service, or email.
If the office doesn't have a form, you can write a letter to make your request. Be sure to include:
- Your name
- Social Security number
- Date of birth
- Address and phone number
- Email address
- The list of records being requested
- The dates of service
- Delivery option (fax, post, email, in person)
- Signature
Once the request has been made, you may have to wait a while before the records are actually received. State laws vary but typically require delivery within 30 to 60 days. Be sure to keep a copy of the original request, and contact your state's Department of Health if you fail to receive the documents after repeated attempts.
Historically, medical records were kept and maintained by the primary care provider. In recent years, a trend has emerged that has seen patients taking responsibility for the storage and maintenance of their own medical records.
Unless you are in a healthcare system which provides you access to your electronic medical records (EMR), you will need to take steps to request copies for yourself.
Who May Request Medical Records
While designed to protect your privacy, HIPAA regulations are so extensive that many providers are still confused about how to enforce them. This can sometimes make it difficult to obtain your records, even if you are fully entitled to them.
According to HIPAA, you have the right to request medical records in these circumstances:
- You are the patient or the parent or guardian of the patient whose records are being requested.
- You are a caregiver or advocate who has obtained written permission from the patient. In some cases, the healthcare provider will provide you a permission form that the patient must complete.
Many people assume that only they or their designees can obtain copies of their medical records. Under the law, there are other individuals or organizations who may also have the right.
This not only includes your primary care healthcare provider but third-party covered entities to whom you may have knowingly or unknowingly granted the right when signing a patient intake or registration form. These not only include medical practitioners, but organizations like insurance companies, hospitals, labs, nursing homes, rehabilitation centers, and billing providers.
Today, some people are even requesting their medical information be shared with mobile apps (such as those that monitor your heart health or diabetes). Under HIPAA, you have the right to request this with the understanding that the healthcare provider who releases the information is not responsible for how the mobile app provider uses or secures your information.
To this end, it is in your interest to read any medical registration or intake document to fully understand the rights you are granting and with whom your information may be shared.
Which Records Can Be Provided
Although you have a right to most of your medical records, there are some that healthcare providers can withhold. The age of a particular set of records also can affect the ability to obtain them—most providers, including healthcare providers, hospitals, and labs, are required to keep adult medical records for at least six years, although this can vary by state.
How long records are kept for children is regulated as well. Depending on the state, a child's records must be kept for three to 10 years beyond the age 18 or 21.
Among the various records you have the right to obtain:
- Any notes or records that a provider has created themselves
- Any diagnostic results for which a provider has copies including blood tests, X-rays, mammograms, genetic tests, biopsies, etc.
- Any information provided by another healthcare provider that was used to establish a diagnosis and/or direct treatment
If you're seeking specific lab tests or hospital admission records, often it's best to request them from the lab or hospital rather than your primary care healthcare provider. They are likely to be more complete and may even be kept for a longer period of time than a private medical practice.
Records Your Provider May Deny
There are records to which you may be denied access. These primarily involve mental health records for which the provider's notes may be considered "impressions" rather than diagnoses. It has been argued that disclosure of these records may harm the healthcare provider-patient relationship or be misconstrued when taken out of context.
With that being said, a provider cannot deny your request because it might hurt your feelings. It can only be denied if the release of the information may compel you to harm yourself or others. If denied, the denial must be provided to you in writing.
Under the law, there are some instances when your health information may be withheld, although these limitations are subject to broad interpretation. These include:
- Psychotherapy notes; these are notes taken by the healthcare provider and may not be included in your medical record
- Information that has been compiled for use in a lawsuit
If you feel you are being unfairly denied access to specific medical records, you can file a complaint with the Office of Civil Rights (OCR) at the Department of Health and Human Services. You can do the same if your medical confidentiality has been breached.
If the OCR agrees that your complaint is justified, it will instruct the healthcare provider or facility to take corrective action or enforce a settlement if actual harm was done. The complaint must be filed within 180 days of the violation.
The law also prohibits retaliation on the part of the covered entity if a complaint is lodged, such as the termination of services or an increase in the cost of services.
Cost of Service
Be aware that you may have to pay for the cost of your medical records if you want them delivered on paper, by fax, or via electronic media. While the price can vary, it must be reasonable.
Moreover, you are entitled to the records even if you haven't paid the healthcare provider or facility for the procedure involved. The records cannot be withheld for non-payment, and you cannot be charged an exorbitant fee to compensate for the non-payment of services. If monies are owing, the healthcare provider or facility can pursue avenues for collection, such as legal action or a debt collection service.
For a Healthcare Provider No Longer in Practice
If your healthcare provider retires or is no longer in practice, all medical records must still be maintained under the law. This pertains even if a healthcare provider has died or dissolves the practice without a sale.
Under the law, the medical records should be transferred to another healthcare provider that agrees to accept the responsibility. If a provider cannot be found, the records may be archived with a reputable commercial storage firm.
Similarly, if your healthcare provider has left the practice but the practice is still operating, your records must be maintained by the remaining members. If the practice was sold, the new practice will be responsible for the maintenance of the records and be liable if the records are lost or mishandled.
Tracking down your records can sometimes be a challenge, particularly if a healthcare provider's office was closed with no forwarding details. In this instance, there are several things you can do:
- Contact your state or local medical society. Many of these organizations require annual registration, they will most likely have the latest contact information.
- Speak with your health insurance company. If the healthcare provider is still an approved provider, your insurer will have contact details.
- Contact any hospital where your healthcare provider made rounds. Hospitals require healthcare providers to undergo a formal process to obtain hospital privileges. Human resource departments will usually have details on file.
If all else fails, you may need to reconstruct your file by contacting the various labs, hospital, or specialists you used. Your health insurers, both past and present, can provide you with the details of any claims made on your behalf.
Correcting Errors
Once you've obtained a copy of your medical records, review them carefully. If you find errors or omissions, you will want to have them corrected immediately to ensure that they don't compromise your future care.
Most providers will agree to correct factual errors or track down reports that should have been maintained in your file.
However, this does not extend to differences of opinions for which your healthcare provider has the right to express a medical opinion. This includes notes regarding contributing factors to an illness (such as alcoholism or HIV) that you would rather not have in your medical records. Altering or omitting the records would not only be ethically problematic, it could subject the healthcare provider to legal action.
With that being said, if you believe that the refusal of a correction is unjust or places you in harm's way, submit a complaint to the OCR detailing the dispute. They can review the evidence and decide if the correction is warranted.
A Word From Verywell
Knowing what is in your medical records can be every bit as important as seeing a healthcare provider in the first place. If you have access to your electronic medical record, be sure to review it after every appointment or well-care visit. It allows you to make corrections when needed and participate more actively if and when medical treatment is needed.