Moving records from one provider to another is the single most common bureaucratic friction in modern healthcare. The rules are clearer than the process suggests. This page covers what you can request, how, what it should cost, and what to do when an office stalls.
The short version
- Under HIPAA, you have a right to access your medical records, including in electronic form when readily producible.
- Providers generally must respond within 30 days, with one 30-day extension permitted.
- Fees must be reasonable and cost-based. Per-page fees are not always permitted for electronic copies.
- The 21st Century Cures Act prohibits information blocking by providers and electronic health record vendors.
- Request the actual data, not just summaries: clinical notes, imaging files (DICOM), pathology, labs, and a problem list.
- Complaints about access denials go to the HHS Office for Civil Rights (OCR); information blocking complaints go to the ONC.
Your right of access
The HIPAA Privacy Rule grants individuals the right to access most of their health information held by covered entities — health plans, healthcare providers, and clearinghouses. The right is broad. It applies to the "designated record set," which includes medical records, billing records, and information used to make decisions about you. There are narrow exceptions: psychotherapy notes (the separately kept process notes of a mental health clinician, not regular session documentation), information compiled for a legal proceeding, and a few other categories. The HHS Office for Civil Rights (OCR) enforces this right.
The 21st Century Cures Act, through rulemaking by the Office of the National Coordinator for Health IT (ONC), additionally prohibits "information blocking" — practices by providers, EHR developers, or networks that interfere with the access, exchange, or use of electronic health information. The Cures Act has changed how quickly clinical notes appear in patient portals: in many systems, notes are available essentially as soon as they are signed.
How to request records
Through the patient portal
The fastest path. Most large health systems' portals expose visit notes, lab results, imaging reports, problem lists, medications, and immunizations. Some allow direct download in standardized formats. The portal does not always include older records, scanned documents, imaging files (DICOM), or full pathology — those usually require a formal request.
The release of information request
For the full record, contact the practice's "release of information," "medical records," or "health information management" department. Most practices use a standard authorization form that asks for: your identifying information, the records you want, the date range, the format (paper, fax, electronic), and where the records should be sent. Sign and return it through whatever method the practice accepts. Date-stamp your copy. The 30-day clock starts when the request is received.
Requesting electronic copies
HIPAA generally entitles you to electronic copies if the practice maintains the records electronically and they are readily producible in the form requested. "We only print" is increasingly an unacceptable answer. Common electronic formats are PDF for notes and labs, and DICOM for imaging. Imaging files in particular are useful for second opinions; a written radiology report is a summary, not the data itself. See getting a second opinion remotely.
What to ask for
The phrase "all my records" works but is broad and slow. A more targeted request gets you what you actually need faster.
- Visit notes (also called progress notes or clinical notes) for a specified date range.
- Consultation notes from specialists.
- Operative reports and procedure notes.
- Discharge summaries from any hospitalization.
- Laboratory results, including the lab's full report (not just abnormal flags).
- Pathology reports — and, for second opinions, the actual slides or digital pathology files.
- Imaging reports and the underlying images in DICOM format on disc or via secure transfer.
- Medication list and prescription history.
- Problem list and active diagnoses.
- Immunization record.
- Allergy list.
- Letters from outside providers that have been incorporated into the chart.
Fees
HIPAA permits only reasonable, cost-based fees for the patient's right of access. OCR has issued guidance clarifying what this means: copying labor and supplies, electronic media, and postage if mailed. Fees may not include retrieval costs or "search" fees. For electronic copies of electronic records, some states' per-page paper fee schedules do not apply. State laws sometimes set a flat per-record fee, which may be more or less generous than the federal floor.
Practices that route requests through a third-party release-of-information vendor sometimes try to charge fees that exceed what HIPAA permits. The OCR has taken action on this. If a fee seems disproportionate, ask in writing for a justification of the cost and reference the patient right of access.
Timelines
Generally, providers must act on a request within 30 days of receipt and may extend once by 30 days with written notice and a reason. In practice, requests through portals or addressed to organized release-of-information departments are often fulfilled in days. Paper-based or older records take longer. Imaging on disc is often available the same day from a hospital's radiology department for in-person pickup; a mailed disc takes a week or two.
For an upcoming appointment, request records as soon as the appointment is scheduled. Specialists typically prefer to receive records before the visit so they can review them.
Sending records to another clinician
You can have records sent to another provider in three ways: directly between practices using a standardized exchange (Carequality, CommonWell, or eHealth Exchange networks), through a release-of-information request that you sign with the receiving address, or by downloading them yourself and uploading to the new provider's portal. The first option works when both practices participate in a network and is often invisible to the patient — the new clinic just pulls the prior records.
Patient-uploaded records are widely accepted, but the receiving practice may scan and re-enter rather than ingesting them as structured data. For complex cases — cancer, transplant, complex surgical histories — request a direct provider-to-provider transfer in addition to bringing a copy yourself.
What to do when refused or delayed
If a practice does not respond within the HIPAA timeline, send a written follow-up that explicitly references the patient right of access and asks for a status. If a practice charges a fee that seems excessive, ask in writing for a cost-based justification. If a practice refuses to provide records or to provide them in electronic form, you can file a complaint with the HHS Office for Civil Rights at hhs.gov/ocr; the complaint process is free and OCR investigates.
For information blocking — for example, an EHR vendor's portal that withholds visit notes the law generally requires to be available — complaints go to the ONC. The ONC's information blocking complaint portal is open to patients, providers, and developers.
Special categories
Mental health
The HIPAA category of "psychotherapy notes" is narrow: a clinician's separately maintained personal notes about a counseling session. These are not the rest of the mental health record. Diagnoses, treatment plans, medications, billing information, and most clinical documentation are part of the regular record and accessible like any other. State laws sometimes provide additional protections.
Adolescent records
Adolescent confidentiality varies by state and by service category (mental health, reproductive health, substance use). Parents do not always have full access to a teenager's record. See telehealth for children.
Substance use treatment
Records of federally assisted substance use treatment programs are subject to additional protections under 42 CFR Part 2, separate from HIPAA. Specific consent forms are usually required to disclose them.
Deceased patients
An executor or personal representative can usually access records, with documentation. State law and the practice's policies determine the specifics.
What to keep yourself
Build a personal archive. Useful contents: a current medication list, allergy list, problem list, immunization record, surgical history, recent lab results, and recent imaging on disc or in cloud storage. Update it whenever something changes. For chronic conditions, a one-page summary that you can hand any new clinician saves time and reduces errors. See accessing your medical records for the full legal framework.
What to ask a new provider
- Do you participate in Carequality, CommonWell, or eHealth Exchange? Can you pull my records directly?
- What format do you prefer for outside records — direct send, fax, portal upload, paper?
- Will you accept imaging on a disc, or do I need to upload?
- How long before the visit do you need records to review them?
- How do I confirm you received what I sent?
When this is not enough
Records transfer is a tool, not a remedy. If a relationship with a clinician has broken down, transferring records to someone new is reasonable. If the issue is a single clinical disagreement, see getting a second opinion remotely and advocating for yourself in a remote visit first. If a practice is actively refusing to release records, see accessing your medical records and the OCR complaint process.
Related reading
Not medical advice. This site provides general educational information about navigating remote healthcare. It does not diagnose, treat, or recommend treatment for any condition. For personal medical questions, talk to a licensed clinician.