How to request your medical records (HIPAA right of access)

You have the legal right to get your medical records, usually within 30 days of asking. This right is guaranteed by the HIPAA Privacy Rule, 45 CFR 164.524. Whether you’re preparing for a second opinion, enrolling in a clinical trial, or switching oncologists, you’ll need the full record.

What you’re entitled to

• Your own medical records in electronic or paper form
• Pathology slides (you have the right to request the physical slides for review at another institution)
• Imaging studies on CD, flash drive, or via secure portal
• Operative reports, discharge summaries, and progress notes
• Billing records (helpful for insurance or financial aid applications)

How long they have to provide them

• 30 days is the federal maximum for most records
• 60 days with a one-time 30-day extension (they must tell you in writing why)
• Electronic requests for electronic records should be faster in practice

State laws sometimes require faster turnaround. If you’re in a state with a 15-day or 21-day rule, that applies.

What they can charge

Per HHS guidance, the fee must be limited to:

• Labor for copying (either paper or electronic format)
• Supplies (paper, CD, USB drive)
• Postage if you want them mailed

They cannot charge for retrieval, review, or search time for records you ask for under HIPAA’s right-of-access provision. Electronic delivery of electronic records is supposed to be low-cost or free.

If you’re quoted a large fee ($100+ for a routine request), you can push back by citing HHS’s guidance that fees must be “reasonable, cost-based.”

Step-by-step — how to request

1. Find the right office

Most hospitals have a Health Information Management (HIM) or Medical Records department. This is different from billing or patient services. Larger systems may have online request forms through the patient portal.

2. Use the hospital’s form — or a simple letter

Most systems require a signed request form. If they don’t have one, a short letter works:

I am requesting a copy of my complete medical record including all pathology reports, imaging studies, operative notes, clinic notes, lab results, and treatment records for care provided to me at [facility] between [dates]. I am exercising my right of access under 45 CFR 164.524. Please provide electronic copies via [portal / email / USB drive] or mail to [address]. My date of birth is [DOB]. My signature below authorizes release to myself.

3. Specify the format

Ask explicitly for electronic records (PDF or native format) if you want them digitally. Some HIM offices default to paper, which is slower and more expensive.

For imaging, ask for DICOM files on CD or flash drive — the raw imaging format that radiologists use. Some centers also support uploading to PocketHealth or similar services.

4. Follow up

If you haven’t heard back in two weeks, call. Records requests get lost. Document who you spoke to and when.

5. Review before sending to a second opinion

Open the records and verify they contain what you asked for. Missing items are common. Typical omissions:

• Pathology slide review vs just the written report
• Outside imaging (done at a different facility but stored in the record)
• Genetic/molecular test reports (sometimes filed separately)

When you hit resistance

If the HIM office says no, or charges an unreasonable fee, or takes more than 30 days:

• Ask to speak with the HIPAA Privacy Officer (every covered entity has one)
• Cite 45 CFR 164.524
• If still stonewalled, file a complaint with HHS Office for Civil Rights — this process can be done online at hhs.gov/ocr/complaints

In practice, invoking HIPAA and asking for the Privacy Officer usually resolves things within days.

Why this matters for cancer care

• A second opinion requires the full record to be meaningful
• Clinical trial screening needs pathology and imaging verifiable by the trial team
• Switching oncologists is smoother when you arrive with records in hand
• Insurance appeals for denied services require documentation

Your records are your property in this legal sense — they’re yours by right. Use that right.