How long does a provider have to give me my records?

Generally 30 calendar days from your request, with one possible extension of up to 30 more days if the provider explains the delay in writing.

Can a hospital charge me for my records?

It may charge a reasonable, cost-based fee for copies, but not for searching or retrieving them. Ask for the fee before the copies are made.

What is information blocking?

It is a practice by a provider, health IT developer or network that is likely to interfere with access to or use of electronic health information without a valid reason. Federal rules under the 21st Century Cures Act prohibit it, with specific exceptions.

Are there records I cannot get?

Psychotherapy notes and information gathered for legal proceedings are not covered by the HIPAA right of access. Most other records are.

Your legal right to your health records in the US

November 6, 2026 · 5 min read · Vita Health Coach

The short answer

In the US, HIPAA gives you a legal right to see and get copies of most of your health records, usually within 30 days, for a reasonable cost-based fee. The 21st Century Cures Act adds rules against information blocking, so providers should not delay or block access to electronic records without a valid reason. You can also use an app of your choice to get records from certified hospital systems.

The HIPAA right of access in plain words

HIPAA is the Health Insurance Portability and Accountability Act, the main federal health privacy law. It applies to covered entities: most doctors, hospitals, clinics, pharmacies and health plans, and the companies that work for them.

Under HIPAA, you have a right to see and get copies of your health information held in what the law calls a designated record set. In plain words, that is the set of records used to make decisions about you. It includes medical records, test results, imaging reports, medicine lists and billing records.

There are a few exceptions. Psychotherapy notes, which are a therapist’s separate private notes, are not covered by the right of access. Neither is information gathered for a lawsuit or legal proceeding. Most other records are.

Time limits and fees

A provider generally must give you access within 30 calendar days of your request. It can take one extension of up to 30 more days, but only if it tells you in writing, within the first 30 days, why it needs more time and when you will get the records. Many providers are much faster.

The provider may charge a reasonable, cost-based fee for copies. That can include labor for making the copy, supplies, and postage. HHS guidance says it may not charge for searching for or retrieving records. You can always ask to inspect your records in person.

A provider may ask you to make the request in writing, and may check your identity. It should not create barriers that make access hard, such as requiring you to come in person when you could reasonably request by mail or online.

Format, and sending records to someone else

You can ask for your records in the form and format you want, such as paper or electronic, if the provider can readily produce it. If records are kept electronically, you can ask for an electronic copy.

You can also ask that a copy be sent to another person you choose, such as a family member or a new doctor. Make that request in writing, signed, and say clearly where the copy should go. A 2020 federal court decision narrowed parts of this right, mainly around fees and which records it covers, so ask the provider how it handles these requests.

Family members do not have their own right to an adult’s records. An adult child usually needs the parent’s written permission, or legal authority as a personal representative.

The 21st Century Cures Act and information blocking

The 21st Century Cures Act is a federal law passed in 2016. Rules issued under it, which began to apply in 2021, address information blocking. That means practices by health care providers, health IT developers and health information networks that are likely to interfere with access to, exchange or use of electronic health information.

In practice, these rules mean many hospitals now release lab results and notes to the patient portal soon after they are ready, instead of holding them until a doctor calls. The rules include specific exceptions, for example to prevent harm to a patient, to protect privacy or security, or when a request is truly not possible to fulfill.

These rules sit alongside HIPAA rather than replacing it. Both sets of rights apply at the same time.

If you think a provider is blocking access to your electronic health information, HealthIT.gov has a portal for reporting possible information blocking.

Your right to use an app

Federal health IT certification rules require certified hospital record systems to offer a standard connection, built on SMART on FHIR, that patients can use with an app of their choice. With your permission, the app can read your records directly from the hospital.

Separate federal rules from the Centers for Medicare and Medicaid Services, or CMS, also require many health plans, such as Medicare Advantage and Medicaid plans, to offer patient access through apps.

An app you choose yourself is usually not covered by HIPAA. Some health apps fall under Federal Trade Commission rules instead. Read an app’s privacy policy before you connect it.

Other rights, and what to do if a provider says no

HIPAA gives you several related rights, listed below. They are worth knowing when you manage your own records or help a parent with theirs.

If a provider denies or delays access, start by asking for the answer in writing, with the reason. Many problems are simple mix-ups that a call to the records office fixes. If not, you can file a complaint with the HHS Office for Civil Rights, which enforces HIPAA. Complaints are generally due within 180 days of when you learned about the problem.

The right to ask for a correction if something in your record is wrong or missing.
The right to a notice of privacy practices that explains how a provider uses your information.
The right to a list of certain disclosures of your information.
The right to ask a provider to limit some uses, and to require a limit on sharing with your health plan for care you paid for in full yourself.
The right to file a complaint if you think your rights were not respected.

How Vita Health Coach helps

Vita Health Coach, an iPhone and iPad app from VitaMedas, Inc., uses the patient access standard these rules created. You sign in on each hospital’s own page, and Vita never sees the portal password. Your results, medicines, allergies and visit summaries then come into your own file. You can share a record with a doctor through a code-protected link and switch it off later. Vita is free to try, with paid plans in the App Store.

Questions people ask

How long does a provider have to give me my records?: Generally 30 calendar days from your request, with one possible extension of up to 30 more days if the provider explains the delay in writing.
Can a hospital charge me for my records?: It may charge a reasonable, cost-based fee for copies, but not for searching or retrieving them. Ask for the fee before the copies are made.
What is information blocking?: It is a practice by a provider, health IT developer or network that is likely to interfere with access to or use of electronic health information without a valid reason. Federal rules under the 21st Century Cures Act prohibit it, with specific exceptions.
Are there records I cannot get?: Psychotherapy notes and information gathered for legal proceedings are not covered by the HIPAA right of access. Most other records are.

Sources

Vita Health Coach is an iPhone app that keeps a parent’s hospital results in their own file and explains each new one in plain words. Free to try; paid plans in the App Store.

Vita Health Coach on the App Store

General health information, not medical advice. Vita Health Coach explains; it never diagnoses. In an emergency, call 911 or your local emergency number. Read the medical disclaimer.