How to Get Your Medical Records: Fees and Deadlines by State

The right of access is in the HIPAA Privacy Rule at 45 CFR 164.524, and it belongs to you, not to the clinic. It covers everything in your "designated record set": the chart, test results, imaging reports, billing records, anything used to make decisions about you. Two things are excluded: psychotherapy notes a therapist keeps separately from the chart, and information "compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding."

On timing the regulation is specific: the provider "must act on a request for access no later than 30 days after receipt of the request." It may take one extension of up to 30 more days, but only if it tells you in writing, within the first 30 days, why and when. HHS's guidance calls the 30 days "an outer limit" and says providers "are encouraged to respond as soon as possible." A provider that needs the full month to hand over a lab result it already has is not following the rule's spirit, and one that takes longer is breaking it.

The fee must be "reasonable, cost-based," and the regulation lists what it may include: "labor for copying the protected health information requested by the individual, whether in paper or electronic form," supplies for paper or a USB drive if you asked for one, postage if you asked for mailing, and the cost of preparing a summary or explanation only if you agreed to receive one instead of the records. Nothing else. HHS guidance says a provider may charge "a flat fee for all requests for electronic copies of PHI maintained electronically, provided the fee does not exceed $6.50, inclusive of all labor, supplies, and any applicable postage."

Three charges to refuse: a "retrieval" or "search" fee, a per-page fee applied to records you asked for electronically, and a charge for records sent to another provider at your request through the clinic's own portal. And one rule that surprises people: an unpaid balance is not a reason to withhold records. HHS says so directly in its access guidance. If the office says "once the account is settled," ask for that in writing and then file the complaint described below.

• Put it in writing, dated. The 30-day clock starts when the request is received. Email through the patient portal counts, and the portal timestamp is your proof.
• Say exactly what you want and in what form. "A complete copy of my medical record from January 1, 2024 to today, as a PDF sent to my portal or to this email address." The rule entitles you to an electronic copy in the format you ask for "if it is readily producible."
• Ask for the fee up front. The provider should tell you the cost before it fills the request. If a number appears that is not copying, supplies or postage, quote the regulation.
• Direct it to someone else if you want. You can instruct the provider in writing to send your records to another clinician, a lawyer or a family member. The same fee limits apply.
• Keep a log. Date requested, who you spoke to, what they said. That log is the complaint if you need one.

States may set their own copying caps and deadlines, and where a state rule gives you more (a shorter deadline, a lower cap, free copies for a benefits application), the state rule applies; where it gives you less, HIPAA controls. We opened each state's statute on October 27 and 28, 2026. The table shows what it says about fees and deadlines, in the statute's own words, and links to it.

A provider can deny access only on narrow grounds, and most denials people meet are not among them. The regulation allows a denial without review for the two excluded categories above, and a reviewable denial where a licensed professional decides that access "is reasonably likely to endanger the life or physical safety of the individual or another person," a finding you can have reviewed by a different licensed professional. "We do not release records to patients," "you need a lawyer," "the doctor has to approve it" and "the account is past due" are not grounds.

Past 30 days with no records and no written extension, or quoted a fee outside the list, file a complaint with the HHS Office for Civil Rights. It is free, it can be done online through the OCR complaint portal, and the deadline is 180 days from the violation. Right-of-access failures are the HIPAA violations OCR has pursued most steadily in recent years, with settlements against practices that stalled a single patient's request. Name the provider, attach your dated request, and state the dates.

Your records are where every next step starts. An appeal of a denied claim, a disability application, a second opinion, a malpractice consult and a complaint about discrimination all start with the chart, and the person who controls the chart controls the timeline. Black patients report being disbelieved and undertreated at rates that are documented in the medical literature, and the chart is where that shows up: what was ordered, what was declined, what was written about you. Read it. If something in it is wrong, HIPAA also gives you the right to request an amendment, in writing, with a 60-day response deadline, and to have your disagreement attached to the record if the provider refuses.