November 4, 2026 - Xavier Flanagan, Founder

How to get a copy of your medical records in the US

If a doctor, hospital, lab or health plan in the United States holds records about you, you have a legal right to see them and to get a copy. Not just what shows up in a patient portal. The notes, the test results, the imaging reports, the billing records: the whole file.

The right comes from HIPAA, the federal health privacy law, and it has teeth. Here is what it gives you, how to use it, and what to do if a provider drags its feet.

The short version

You can ask any doctor, hospital, lab, pharmacy or health plan covered by HIPAA for a copy of your records.
They must act within 30 days. They can take up to 30 more only if they tell you in writing, within the first 30, why and when.
If the records are electronic and you ask for an electronic copy, they must give you one in the form you ask for if they can readily produce it.
They can charge only a reasonable, cost-based fee for copying. They cannot charge you for searching or retrieving the records.
If they refuse or ignore you, you can complain to the federal Office for Civil Rights, in writing, within 180 days.

What the law says

The right of access is in the HIPAA Privacy Rule, at 45 CFR 164.524. It gives you the right “to inspect and obtain a copy” of the health information a provider or plan holds about you in what the rule calls a designated record set. In plain terms, that is the information used to make decisions about you: your medical records and your billing and payment records.

It applies to “covered entities”: health care providers that handle insurance claims or other standard transactions electronically (almost all of them), health plans and insurers, and health care clearinghouses. It does not apply to every company that holds health information. Many fitness and wellness apps, for example, are outside HIPAA.

There are two things you do not have a right to under this rule: a therapist’s separate psychotherapy notes, and information put together for a lawsuit or other legal proceeding. Almost everything else in your record is yours to ask for.

How to request your records

Find the right office. At a hospital it is usually called Health Information Management or Medical Records. At a small practice, ask the front desk.
Check the portal first. If you just want recent results or visit notes, they may already be in your patient portal, where you can download them.
Put the request in writing. A provider is allowed to require a written request, as long as it tells you so. Many have their own form. Say what you want (for example, all records from 2018 to now, or everything about a particular hospital stay) and how you want it.
Ask for an electronic copy. A PDF by secure email or a download link is usually fastest. If you are fine with regular email, say so. Providers can generally send it that way at your request, after warning you of the risk.
Note the date you sent it. The 30 days start when they receive your request.

You can also direct a provider to send an electronic copy of records kept in an electronic health record straight to someone else, such as a new doctor. The request must be in writing, signed by you, and say who gets the copy and where to send it. For paper records, or anything else, the provider will usually ask you to sign a HIPAA authorization instead. Since a 2020 court decision, the fee limits below apply only to copies sent to you, not to copies sent to someone else.

What it can cost

When the copy comes to you, the rule allows a “reasonable, cost-based fee” that covers only the labor of making the copy, supplies like a USB drive or paper if you ask for them, postage if you ask for it to be mailed, and preparing a summary if you agree to one in advance. HHS guidance says a provider cannot charge you for searching for or retrieving your records.

For an electronic copy of records that are already electronic, guidance from the Department of Health and Human Services lets a provider charge a flat fee of no more than $6.50 instead of working out its actual cost. That is an option, not a cap on every request. Downloading from a patient portal is usually free.

If they refuse or take too long

A provider can refuse in a few narrow situations, for example if a licensed professional judges that access is reasonably likely to endanger your life or physical safety, or someone else’s. A refusal must come to you in writing, explain why, and, in most cases, tell you how to ask for it to be reviewed by another professional.

If you are refused without a good reason, charged for searching, or simply ignored past the deadline, you can file a complaint with the Office for Civil Rights (OCR) at the Department of Health and Human Services. The complaint must be in writing, on paper or online, and filed within 180 days of when you knew, or should have known, about the problem, though OCR can extend that for good cause. OCR has taken enforcement action against providers that were slow to hand over records.

State law can also help. Some states set shorter deadlines than HIPAA, and where a state law gives you more, the provider has to follow it.

Common situations

Your child’s records. A parent is usually treated as a child’s personal representative and can request their records. State law makes exceptions, for example for care a minor can consent to on their own.
A parent who has died. The executor or administrator of the estate, or whoever else state law gives that authority, acts as the personal representative and can request the records. HIPAA keeps protecting them for 50 years after death.
A practice that has closed, or old records. HIPAA does not say how long medical records must be kept; state law does. Your state medical board can usually tell you who holds a closed practice’s files.

Why the portal is not the whole story

Since the 21st Century Cures Act, providers are expected not to block or delay your access to your electronic health information without a valid reason. That is one reason many test results now appear in your portal as soon as they are ready.

But each portal shows one health system’s view of you. If you have seen doctors in different systems, moved states, or changed insurers, your history is spread across several portals and a pile of paper. None of them shows you everything.

Asking for mental health records? Our guide to getting your mental health records in the US covers psychotherapy notes and when access can be denied.

Where exora fits

Once you have your records, exora turns them into one record you can actually use. Upload the PDFs, scans and photos you get back, from any provider, and it reads them, pulls out your medications, conditions, results, procedures and vaccinations, and lays them out in plain language. Every fact links back to the page it came from, so you can always check it.

exora does not connect to your providers’ systems or request records for you. You get them, using the rights above, and exora puts them together.

One thing to know: HIPAA protects the copy your provider keeps. Once you have your own copy, HIPAA no longer covers it, and that includes what you upload to most apps, exora among them. Our privacy policy explains how exora handles your records, and the security page how they are protected.