Your HIPAA right of access, and what to do when it's ignored

This is not clinical evidence and not medical advice. It does not replace your care team. Discuss anything here with your clinician before you act on it. It isn't legal advice either. The right comes from the HIPAA Privacy Rule, and the HHS Office for Civil Rights (OCR) enforces it. In HHS's words, the Privacy Rule gives you, with few exceptions, the right to inspect, review, and receive a copy of your medical and billing records held by providers and health plans the rule covers. It isn't limited to what's recent or digital. OCR's access FAQs say it reaches records in electronic or paper form, records that are very old or archived, information you gave the provider yourself, and information other providers added to your chart. OCR also says the age or location of the information isn't a ground to deny you. The first time a records clerk tells you the file is "in storage," it helps to know that's a logistics problem for them, not a reason to say no. This page is about the right itself and what to do when it isn't honored. For how to make a request, what copies cost, and what a portal leaves out, see Getting your medical records, How to get copies of your medical records, and Patient portal vs full medical record.

HIPAA covered entities: health plans and most health care providers. OCR's complaint guidance lists most doctors, clinics, hospitals, psychologists, chiropractors, nursing homes, pharmacies, dentists, health insurers, company health plans, and government programs like Medicare and Medicaid. Business associates count too. OCR's FAQ says your right extends to records a business associate keeps on a covered entity's behalf, such as a records vendor. When you ask, the covered entity is responsible for giving you what it holds and what its business associates hold. Some organizations that hold health information aren't covered at all, like employers and life insurers. Getting your medical records lists them. OCR can only investigate the organizations HIPAA covers.

OCR names two exclusions in its denial FAQ. The first is psychotherapy notes: a mental health professional's notes from conversations with a patient, kept separate from the medical and billing record. The second is information compiled in reasonable anticipation of, or for use in, a legal proceeding. Even then, OCR says you keep the right to the underlying information in your record that was used to create that material. A provider can also deny information that isn't part of a designated record set. Your medical records, billing and payment records, test reports, and X-rays are part of it.

Only in very limited circumstances, according to OCR. Besides the two exclusions above, the main ground it describes is when a licensed health care professional decides, using professional judgment, that access is reasonably likely to endanger your life or physical safety or someone else's. OCR says this ground is read narrowly and should apply in extremely rare cases. General concerns about psychological or emotional harm aren't enough, such as worry that you won't understand the information or will be upset by it. Neither is the mere possibility of harm. If you're denied on this ground, you have a right to have the decision reviewed. The full list of grounds is in the regulation OCR's FAQ points to. You also don't have to say why you want your records. OCR says your reason, even if the provider knows it, isn't a permitted reason to deny you.

It has to be in writing, within the same 30-day window (60 days if you were told about an extension). OCR says it must be in plain language and give the basis for the denial. Where it applies, it must also explain your right to have the decision reviewed and how to ask for that review. And it must say how to complain to the provider or to OCR. A partial denial doesn't close out your whole request. OCR says the provider must, to the extent possible, give you the rest of what you asked for. If the denial was based on the safety ground, the review is done by a licensed health care professional the provider designates who wasn't part of the original decision. If all you got was a vague no on the phone, consider asking for it in writing.

Here the 30 days does the work. OCR says a covered entity must act on an access request no later than 30 calendar days after receiving it. It can take up to 30 more days, but only if it gives you a written statement within the first 30 explaining the delay and saying when it will finish. OCR calls these outer limits. The clock keeps running while the provider waits on a vendor or haggles with you over format. So when day 31 comes with no records and no letter, you're no longer just waiting on a busy office. Write down when and how you sent the request, and keep a copy. If you're stuck, you might consider a written follow-up asking for a firm date, then asking for a written denial if they won't release the file. If that goes nowhere, an OCR complaint is an option. Keep the 180-day window in mind. For request mechanics and typical timing, see Patient portal vs full medical record and Sharing medical records with a new doctor.

The right of access belongs to you, not only to your next doctor. HHS says you have the right to inspect, review, and receive a copy yourself. OCR's FAQ adds that you generally have a right to get copies by mail or email if you ask. A provider may not require you to travel to pick up a copy that you asked to have mailed or emailed. Sending a copy straight to someone else is narrower. After the 2020 Ciox court order, that third-party directive covers electronic copies of an electronic health record. Sharing medical records with a new doctor explains that route.

File within 180 days of when you knew about the problem. OCR may extend that if you show good cause. The complaint has to be in writing: through the OCR Complaint Portal, or by mail, fax, or email. It has to name the provider, plan, or business associate and describe what they did or didn't do. OCR offers a form package, or you can write your own complaint. Include your contact details, what happened and when, and your signature and date. OCR won't investigate a complaint without a name and contact information, but you can ask it to keep yours confidential. HIPAA also bars retaliation for filing, and OCR asks you to tell it right away if retaliation happens. Getting your medical records says to raise a refusal with the provider. OCR's deadline still runs either way.

OCR reviews complaints and generally acts only on ones filed within 180 days that are about an organization HIPAA covers. At the end of an investigation it sends a letter with the outcome. If it finds a likely violation, the organization has to comply voluntarily, take corrective action, or agree to a settlement. If that doesn't resolve it, OCR can impose civil money penalties. OCR's resolution-agreements page lists settlements under its HIPAA Right of Access Initiative going back to 2019. In an October 8, 2026 announcement, OCR called its settlement with a Pennsylvania dental practice its 56th Right of Access enforcement action. That case started with one person's complaint that she didn't get timely access after multiple requests.

It can be a separate issue under a separate law. The 21st Century Cures Act defines information blocking as a practice by an 'actor' that is likely to interfere with access to, exchange of, or use of electronic health information, unless a law requires it or an exception applies. The actors are health care providers, developers of certified health IT, and health information exchanges and networks. Information blocking claims go to ONC's Report Information Blocking Portal, not the OCR complaint portal. A third party can submit one for you. HHS has also set disincentives for providers that the Office of Inspector General finds committed information blocking. The right of access is the HIPAA rule. Information blocking is the Cures Act rule. Which one fits depends on the facts. Consider reading both agencies' pages before deciding where to file.