How to Request Medical Records from Any Hospital or Doctor (2026 HIPAA Guide)
Complete federal and state guide to requesting medical records under 45 CFR § 164.524 (Patient Right of Access) vs. 45 CFR § 164.508 (Third-Party / Attorney Authorization), mandatory 15-to-30-day response deadlines, and post-Ciox v. Azar copying fee rules.
Quick-Reference Facts: How to Request Medical Records
- Federal Right of Access
- 45 CFR § 164.524(a) — Grants every patient an enforceable legal right to inspect and obtain a copy of their Designated Record Set.
- Mandatory Response Deadline
- 30 calendar days maximum under federal HIPAA (45 CFR § 164.524(b)(2)(i)), or shorter under state law (e.g., 15 days in CA; 15 business days in TX).
- Patient Direct Fee Rule
- 45 CFR § 164.524(c)(4) — Reasonable cost-based labor fee ONLY ($0 search fee; actual labor cost or optional $6.50 flat fee election when electronic EHR copies are sent directly to the patient).
- Third-Party Fee Rule (Ciox v. Azar)
- Under Ciox Health, LLC v. Azar, 435 F. Supp. 3d 30 (D.D.C. 2020), when records are delivered to a third party (such as a law firm, insurer, or third-party vendor), state statutory per-page fee schedules apply.
Patient Direct Request (45 CFR § 164.524) vs. Third-Party / Law Firm Authorization (45 CFR § 164.508)
| Requirement / Rule | Patient Direct Request (§ 164.524) | Third-Party / Law Firm Authorization (§ 164.508) |
|---|---|---|
| Who Receives the Records? | The patient directly (or their personal representative) | Third party (Law firm, insurer, IME doctor, retrieval service) |
| Maximum Allowed Fee | Federal Cost-Based Patient Rate (actual labor cost or optional $6.50 flat election; $0 search fee) | State Statutory Per-Page Fee Schedule + State Search Fee (per Ciox v. Azar) |
| Required Form Elements | Written request signed by patient designating records & delivery address/email | All 6 Core Elements + 3 Required Statements under 45 CFR § 164.508(c) |
| Can Provider Deny for Unpaid Medical Bills? | NO — 45 CFR § 164.524 prohibition; withholding records for unpaid bills is a HIPAA violation | NO — Medical records cannot be held hostage for an unpaid medical balance |
Step 1: Specify the Complete 'Designated Record Set' (Not Just a Portal Summary)
When requesting medical records from a hospital or physician practice, asking vaguely for 'my medical records' typically results in the Health Information Management (HIM) clerk printing a brief Continuity of Care Document (CCD) or discharge summary. To obtain your complete file, cite 45 CFR § 164.524 and request your complete Designated Record Set—or split your request across the three hospital departments that store patient data: (1) Clinical Medical Records (History & Physical, Operative Reports, Progress Notes, Nursing Flowsheets, Lab Results, and Discharge Summary) from HIM/Release of Information, (2) Itemized Billing Statements (Form UB-04 and Form CMS-1500 with CPT and ICD-10 codes) from Patient Financial Services, and (3) Raw Diagnostic Imaging (MRI, CT, and X-Ray studies in DICOM format) from the Radiology Film Library.
Step 2: Understand Your Fee Protections Under 45 CFR § 164.524(c)(4) and Ciox v. Azar (2020)
Under federal HIPAA regulations (45 CFR § 164.524(c)(4)), when you request your own medical records to be delivered directly to you (via encrypted email, portal download, or mail), the hospital or its Release of Information vendor (Datavant/Ciox, MRO, Verisma) is legally prohibited from charging a 'search and retrieval fee' and may only charge a reasonable, cost-based fee covering the actual labor of copying the file (often $0.00 to $6.50 for electronic EHR copies). However, following the federal court decision in Ciox Health, LLC v. Azar, 435 F. Supp. 3d 30 (D.D.C. 2020), if a request directs records to be sent to a third party—such as a personal injury law firm or life insurance company—the federal $6.50 cap does not apply, and the provider may bill up to your state's statutory per-page copying limit.
Priority Hospital System, Pharmacy & Lab ROI Hubs
Select a major health system or laboratory below to view its 3-department routing architecture (Clinical HIM, UB-04 Billing, and Radiology PACS):