HIPAA Right of Access: How to Get Your Health Records

Your doctor normally has up to 30 days to provide a copy, and many can do it faster.

By Siddharth ShankarUpdated October 23, 2026

Your health records are some of the most sensitive information about you, and in the United States you have a legal right to see them. This guide follows the HHS Office for Civil Rights page “Get it. Check it. Use it.”

Your right

HHS says: you have the right to see and get copies of your health information. This right comes from the HIPAA Privacy Rule and applies to covered health care providers and health plans.

How long it takes

Your doctor normally has up to 30 days to provide a copy. HHS notes that your doctor often can provide the information much sooner than that. If the doctor has a web portal, you may be able to view and download your information at any time.

What format you can ask for

In most cases you can get a copy the way you want it, such as by email.

Fees

Your doctor may charge a reasonable fee for a copy. HHS says the fee may not be per page if the information is stored electronically. A doctor cannot deny you access because you have not paid a medical bill.

Sharing your information with others

You can ask your doctor to share your information directly with others. HHS lists family members, a caregiver, a mobile app or a researcher as examples. This can help if you use a health app that needs your records.

If something is wrong

If you think information in your record is wrong or missing, you can ask your doctor to fix it. If the doctor disagrees, you can still have your disagreement added to your record.

Exceptions

HHS says there are a few exceptions to getting your information but does not list them on that page. If you are refused, ask the provider to explain in writing which exception it relies on and contact OCR if you need guidance.

If your rights are violated

You can file a complaint with the HHS Office for Civil Rights if you believe your health information privacy rights were violated. HHS notes that its guidance applies only to the extent it is consistent with a 2020 court decision, Ciox Health v. Azar, and that provisions vacated by that decision are rescinded.

How to make a request

1. Contact the provider’s records or privacy office. Many have a form on their website or portal.
2. Say what you want: the full record, a date range or specific test results.
3. Choose how you want it: email, portal download or paper.
4. Ask about fees before you agree to pay.
5. Note the date, and follow up after about 30 days if nothing arrives.
6. Check the copy for errors and for entries that you do not recognise, which could point to medical identity theft. See medical identity theft signs and what to do.

Why this matters after a breach

After a health data breach, getting your records helps you see what is held about you and whether anything has been added in your name. Read the Anthem settlement and the Change Healthcare guide.

Rights outside the United States

HIPAA is a US law. Elsewhere, different rules apply. See how to make a subject access request for the UK approach and the Canadian PIPEDA guide. For public records held by government bodies, read what FOIA is.