How to Get Your Medical Records (And Why You Should)

Most people have never seen their own medical records. They've had appointments, tests, procedures, and diagnoses — sometimes for decades — but the actual documentation of all of that care sits in systems they've never accessed, in formats they've never seen, across institutions that may have no awareness of each other.

This is a problem that feels abstract until it isn't. The moment a patient needs a second opinion, faces an unexpected hospitalization, sees a new specialist, or wants to understand why a treatment isn't working, the absence of complete, organized records stops being a background inconvenience and becomes an active obstacle. The information that could change the clinical picture is somewhere — in a portal from a hospital visited four years ago, in paper files at a practice that has since closed, in imaging studies that exist on a disc no one has thought to retrieve.

The good news is straightforward: those records belong to the patient. Not to the hospital, not to the physician, not to the insurance company. The legal right to access medical records in the United States is clear and specific, and the process — while sometimes frustrating — is navigable.

Here is how to navigate it.

Your Legal Right to Your Medical Records

The foundation of patient record access in the United States is the Health Insurance Portability and Accountability Act of 1996 — HIPAA — and its subsequent regulations, including the HITECH Act of 2009. Under these laws, patients have the right to access, inspect, and receive copies of their medical records held by any covered healthcare provider or health plan.

This right is broad. It covers medical records, billing records, laboratory results, imaging reports, clinical notes, pathology reports, medication records, and most other documentation related to a patient's care. It applies to hospitals, physician practices, outpatient clinics, laboratories, pharmacies, and health plans — essentially any entity that handles protected health information in the course of providing or paying for healthcare.

There are limited exceptions. Psychotherapy notes — the notes a mental health provider writes during a therapy session, as distinct from a general mental health record — may be withheld in some circumstances. Information compiled for legal proceedings may be excluded. And in rare situations, a provider may determine that access could endanger the patient or another person. Outside of these narrow exceptions, the right to access is essentially absolute.

Importantly, a provider cannot deny access because of an unpaid bill. This is a misconception that leads some patients to believe their records are being held until they settle a balance. Under federal law, that is not permitted.

Since April 2021, federal rules under the 21st Century Cures Act have expanded patient access rights further, requiring most healthcare providers and health plans to provide patients with electronic access to their records — including clinical notes — without charge, through certified patient-facing applications. This represents a significant expansion from the prior standard, under which providers could charge fees for producing copies and had more latitude on what to include.

How to Request Your Records

The process for requesting medical records varies somewhat by institution, but follows a consistent general pattern.

The starting point is identifying what records you need and where they are held. For patients who have received care at multiple institutions over many years, this requires some inventory-taking: primary care physicians, specialists, hospitals, urgent care facilities, laboratories, and imaging centers may each hold portions of the relevant history. A records request to a hospital does not automatically capture records from the outpatient physician practices affiliated with that hospital — these are often separate legal entities with separate record systems.

Most institutions accept records requests in writing, either through a formal records release form that the institution provides or through a written letter that includes the patient's full name, date of birth, the specific records being requested, the period of time to be covered, the preferred format for receiving the records, and a signed authorization. Many institutions now also allow requests to be submitted through patient portals, which can significantly speed up the process.

For requesting records from a physician's office, the starting point is typically the practice's medical records department or, in smaller practices, the front desk or practice manager. Requests should be specific: asking for "all records" is appropriate but may benefit from a clarifying list — office visit notes, laboratory results, imaging reports, referral letters — to ensure nothing is overlooked.

For hospital records, the medical records or health information management department is the appropriate contact. Large hospital systems typically have dedicated departments that handle records requests routinely. Patients should ask specifically for the complete record of any hospitalization or procedure, including operative notes, anesthesia records, pathology reports, and discharge summaries, not just a discharge summary alone.

For imaging studies — X-rays, CT scans, MRIs, PET scans — patients should request the images themselves in addition to the radiologist's report. The images are typically provided on a disc or through a digital transfer. A consulting physician who needs to review imaging should have the actual images, not just the report describing them.

Electronic Records, Patient Portals, and Digital Access

The shift toward electronic health records over the past fifteen years has made patient record access substantially easier in many respects — and introduced new complications in others.

Most major healthcare systems now offer patient portals — online platforms, typically accessed through a web browser or a smartphone app, that allow patients to view portions of their records, including recent laboratory results, medication lists, visit summaries, and in many cases after-visit notes. Under the expanded access rules that took effect in 2021, patients are entitled to access their clinical notes through these portals, meaning the actual text of physician notes rather than just structured summaries.

The limitation of patient portals is that they are institution-specific. A patient who has received care at three different health systems has three different portals — and the records in each contain only what that institution has documented. There is no consolidated view that brings everything together automatically. A patient managing care across multiple providers must access each portal separately and piece together the full picture themselves.

For patients who want to consolidate records from multiple sources, Apple Health and similar applications allow certain types of health records to be downloaded from connected institutions and stored in a single place. This functionality is improving and expanding, but it remains imperfect — not all institutions participate, and not all record types are included in the data that can be transferred.

When records are not available electronically or through a portal, patients should request them in a digital format — typically a PDF — rather than paper copies when possible. Digital records are easier to share with consulting physicians, easier to store, and more practical to organize into a comprehensive personal health record.

Timelines, Fees, and What to Expect

Under HIPAA, covered entities are required to provide requested records within 30 days. This can be extended by an additional 30 days if the provider notifies the patient of the delay and provides a reason — but the extension is the exception, not the rule. In practice, many institutions can provide records significantly faster than 30 days, particularly for electronic records delivered through a portal or by secure email.

Fees for records are a more complicated topic. Historically, providers were permitted to charge reasonable, cost-based fees for producing copies of records. Under the expanded access rules that took effect in 2021, electronic records provided through certified applications must be provided without charge. For other formats and for records provided through traditional request processes, providers may still charge fees, though these are regulated and should reflect actual costs rather than serving as a barrier to access.

Patients who find fees to be a genuine obstacle should know that they can request an itemized breakdown of any charges and can, in many cases, negotiate or request a waiver, particularly if the records are needed for continuity of care or a second opinion at another institution.

What to Do If a Provider Is Slow or Uncooperative

Most records requests are handled without significant difficulty. When they aren't, patients have recourse.

The first step when a request is slow is a follow-up contact — by phone, with documentation of the original request date and a specific inquiry about the expected timeline. Medical records departments are often understaffed, and a polite follow-up that establishes a specific deadline can move things forward.

If a provider is refusing to release records — for reasons that aren't within the narrow exceptions permitted under HIPAA — patients can file a complaint with the Department of Health and Human Services Office for Civil Rights, which enforces HIPAA. The complaint process is available online, and providers who are aware that a complaint has been filed or is forthcoming often respond more promptly to outstanding requests.

Patients can also seek assistance from a patient advocate or navigator in facilitating records requests — particularly when records are needed from multiple institutions simultaneously, when the records in question are complex or voluminous, or when a provider has been unresponsive to direct requests. Having a physician's office make the request on a patient's behalf can sometimes move things faster, particularly in physician-to-physician contexts where professional relationships facilitate cooperation.

Why Having Your Records Actually Matters

The practical arguments for maintaining a complete, organized personal medical record are strong enough that it's worth making them explicitly, because many patients don't fully appreciate what complete records enable.

Second opinions require them. A consulting physician who sees a patient without access to the underlying diagnostic material — the actual pathology report, the imaging files, the longitudinal laboratory results — is limited in what they can offer. A second opinion based on a patient's account of what they were told is substantially less valuable than one based on a careful review of the original data. Getting records in order before seeking a second opinion is not a logistical nicety — it is what determines the quality of the consultation.

Catching errors depends on them. Medical records contain errors — medication doses that were recorded incorrectly, diagnoses that were applied and never removed, allergy lists that are outdated or incomplete. A patient who has never seen their own records has no way to identify and correct these errors. When errors in the medical record influence clinical decisions — as they sometimes do — the consequences can be significant.

Continuity of care requires them. A patient who sees a new physician without adequate records transfers the burden of reconstructing their history onto that physician — and onto whatever incomplete account the patient can provide from memory. Critical information is lost. Decisions are made without context. Tests are repeated unnecessarily because no one can confirm they were done before. A complete portable record eliminates this problem.

Emergency preparedness makes them essential. In an emergency situation, access to a patient's medication list, allergy history, significant diagnoses, and recent test results can be immediately clinically relevant. A patient who arrives at an emergency room unconscious or unable to communicate, and whose family can provide this information, receives better care than one who arrives without any of it.

And comprehensive review reveals what individual appointments miss. This is perhaps the most consequential argument. When Pilot Rock Medical Navigators reviews a patient's complete medical records — across all providers, across the full relevant history — what emerges is often a picture that no individual physician has seen. Results that were borderline at one point but have been trending in a concerning direction. A symptom reported years ago that connects meaningfully to a current presentation. A medication interaction that is visible only when the full medication list is considered alongside the relevant lab results. An incomplete workup that stopped short of the test that would have produced a diagnosis.

These findings don't require a new test. They require someone to look at what's already there — carefully, comprehensively, and with the clinical knowledge to recognize what's significant. That is what a thorough records review provides, and it is why patients who have never assembled or reviewed their complete medical history are often surprised by what it contains.

Building Your Personal Health Record

For patients who want to take a proactive approach, building and maintaining a personal health record is a practical and worthwhile investment of time.

The foundation is a document — digital or paper — that captures the essential information any physician would need to understand a patient's health: a current problem list of active diagnoses, a complete medication list with dosages, a documented allergy history, a record of significant past medical events including hospitalizations and surgeries, a list of current treating physicians with contact information, and a summary of recent significant test results.

This document should be updated after any significant medical development, kept accessible to the patient and to designated family members, and brought to any new physician visit or emergency room presentation.

Beyond this summary, patients should maintain a more complete archive: copies of all significant test results, imaging reports and images, specialist notes, operative reports, and pathology reports. These don't need to be immediately accessible, but they should be organized and retrievable when needed.

The process of assembling this archive — particularly for patients with complex histories who have received care across multiple institutions — can be time-consuming. But it is a task that, once completed, significantly changes the patient's position in any future medical encounter. A patient who arrives at a second opinion consultation with a complete, organized set of records gets a meaningfully different consultation than one who arrives without them.

Records are the raw material of informed medical care. Having them — and knowing what's in them — is one of the most consequential things any patient can do for their own health.

___________

If you or a loved one wants to have medical records comprehensively reviewed by an experienced physician, or needs help identifying what information may be missing or incomplete, Pilot Rock Medical Navigators can help. Book a free 15-minute introductory call to discuss your situation. Learn how Pilot Rock can help →