How to Get Copies of Your Medical Records Online

You’re switching doctors, getting a second opinion, filing a disability claim, or just want to know what’s in your chart. You shouldn’t have to beg for your own medical records, and legally you don’t. Under HIPAA, you have the right to see and get copies of most of the health information your doctors, hospitals and health plans keep about you.

The quickest route is often online. This guide explains what you can download from a patient portal in minutes, how to make a formal request for your full record, how long providers have to respond, what they’re allowed to charge, and what to do if a request stalls.

Your legal right to your medical records

The HIPAA Privacy Rule’s right of access is in federal regulation at 45 CFR 164.524. In plain terms, it says:

• You can see and get a copy of your protected health information in a provider’s or health plan’s “designated record set.” That includes medical records and billing records, and for health plans, enrollment, payment and claims records.
• Providers must act within 30 days of receiving your request. They can take 1 extension of up to 30 more days, but only if they tell you in writing, within the first 30 days, why they need it and when you’ll get the records.
• You can choose the format if it’s readily producible. If your records are electronic and you ask for an electronic copy, the provider must provide it electronically in a format you agree on.
• You can have copies sent to someone else, such as a new doctor, with a written, signed request that names the recipient and where to send it.
• Fees must be reasonable and cost-based. More on this below.

There are a few exceptions. Psychotherapy notes, meaning a therapist’s separate personal notes from counseling sessions, aren’t covered. Neither is information compiled for a legal proceeding. A provider can also deny access in limited situations, for example if a licensed professional decides access is reasonably likely to endanger someone’s life or physical safety. In most of those cases you have the right to have the denial reviewed.

This is not legal advice. Your state may give you additional rights or set its own fee limits.

Option 1: download what’s already in your patient portal

For many people, the patient portal has most of what they need. Look for menu items like “Health summary,” “Test results,” “Visit notes,” “Download my record” or “Share my record.” Many portals let you:

• Download a summary of care document with your problems, medications, allergies, immunizations and recent results.
• View and save visit notes and discharge summaries as PDFs.
• Share your record with another provider electronically, especially if both use compatible systems.
• Connect certain health apps that pull your records through standard data connections.

If you haven’t set up a portal yet, our guide on how to use a patient portal walks you through sign-up and security.

Portals don’t always include everything. Older records, imaging files, scanned documents, outside records and some sensitive results may be missing. When you need the complete chart, make a formal request.

Option 2: make a formal records request

Most hospitals and larger practices have a health information management (HIM) or release of information department. Many now take requests online.

Step by step:

1. Find the request page. Search the provider’s website for “medical records request” or “release of information.” Some health systems handle requests inside the portal. Others use an online form run by a records vendor on their behalf.
2. Be specific about what you want. List the dates of service, the department or clinic, and the record types: visit notes, lab results, imaging reports, the actual imaging files, operative reports, billing records or the complete record.
3. Choose the format and delivery. Ask for an electronic copy by secure download or email, a CD or USB drive for imaging, or paper.
4. Decide who receives it. For your own copy, use the patient access request. To send records directly to a lawyer, insurer or other third party, you’ll usually sign an authorization or a written directive.
5. Verify your identity. Expect to upload an ID or confirm details. That’s a normal privacy safeguard.
6. Write down the date you submitted it and save the confirmation. Your 30-day clock starts when the provider receives the request.

If you’re unsure whether you’ll be charged, ask for a fee estimate before the records are prepared.

What providers can charge

HIPAA allows only a reasonable, cost-based fee when you request your own records. That fee may only cover:

• Labor for copying the records, whether on paper or electronically.
• Supplies, such as paper, or a CD or USB drive if you ask for one.
• Postage, if you ask for the records to be mailed.
• Preparing a summary, only if you agreed to receive a summary and its fee in advance.

Providers can’t charge you for searching for and retrieving records, or for verifying your identity, as part of that fee. HHS guidance has also described a simple option for electronic copies of electronic records: a flat fee of no more than $6.50, inclusive of labor, supplies and postage. Providers aren’t required to use that flat fee, and many give portal downloads free of charge.

There’s one important limit. In 2020, a federal court ruling in Ciox Health v. Azar held that HIPAA’s patient-rate fee limit applies to your request for your own records, not to requests to send records to a third party. When records go straight to a lawyer or insurer, fees can be higher, though state law may cap them.

Key takeaway: If cost matters, request records for yourself rather than having them sent directly to a third party. HIPAA’s cost-based fee limits protect patient access requests, and you can then share the copy with whomever you choose.

Where to find records from different sources

Your health information is often spread across several organizations. Here’s where to look.

If your request is delayed or denied

Most requests go smoothly. If yours doesn’t:

1. Follow up in writing. Note your original request date and the 30-day deadline, and ask for a status update.
2. Ask for the denial in writing. A denial must be in plain language, state the reason, explain any review rights and say how to file a complaint.
3. Request a review if the denial is reviewable. A licensed health care professional who wasn’t involved in the original decision must review it.
4. Escalate inside the organization. Ask for the privacy officer, whose contact information appears in the provider’s Notice of Privacy Practices.
5. File a complaint with HHS. The HHS Office for Civil Rights (OCR) enforces HIPAA and accepts complaints online. OCR has a dedicated Right of Access enforcement initiative and has fined providers that failed to give patients timely access.

Keep your records safe once you have them

Your downloaded records contain highly sensitive information. Treat them like financial documents:

• Store them in an encrypted folder or a secure cloud account with 2-step verification. Our guide on what encryption is explains the basics.
• Be careful with third-party health apps. Apps you choose yourself are often not covered by HIPAA, so read the privacy policy before connecting your records.
• Keep a backup. See how to back up your phone if you store records on a mobile device.
• If you get a call or email asking for your records or member ID out of the blue, assume it’s a scam until proven otherwise. Our guide on how to protect yourself from identity theft covers medical identity theft too.

Where to start

If you need your records this month, do this:

1. Download your portal summary today. It may be enough for a new doctor.
2. List every provider you’ve seen in the period you need, using insurer claims history if you’ve lost track.
3. Submit online requests to each HIM department, asking for an electronic copy sent to you.
4. Calendar the 30-day deadline for each request.
5. Save everything in one secure folder, and share copies with new providers as needed.

Records are also useful for spotting billing problems. If a bill doesn’t match what happened at a visit, our guide on how to negotiate a medical bill explains how to use them.

The bottom line

Your medical records are yours to access. Start with your patient portal, then make a written request to each provider’s records office for anything missing. Providers generally have 30 days to respond, must give you electronic copies when they can, and can charge you only a reasonable, cost-based fee for your own copy. If they stall, escalate to the privacy officer and then HHS.

This is general information, not medical or legal advice.

Sources

• 45 CFR 164.524, Access of individuals to protected health information (Cornell LII) — 30-day timing, extension rules, fee limits, format, third-party directives, exceptions and denial reviews
• HHS: How can covered entities calculate the limited fee? — Fee calculation methods, including the $6.50 flat-fee option
• HHS: Is a health care provider permitted to deny an individual’s request for access because the individual has not paid the bill? — Unpaid bills are not grounds to deny access
• HealthIT.gov: Get it, check it, use it — Requesting records through portals and Blue Button downloads