Medical records are an important part of a patient’s healthcare history. They contain information about diagnoses, hospital visits, treatments, medications, laboratory results, imaging studies, surgeries, and other medical services.
Patients in the United States may need copies of their hospital medical records for several reasons. They may want to consult another doctor, obtain a second medical opinion, continue treatment at a different hospital, file an insurance claim, or maintain a personal record of their healthcare history.
Fortunately, federal privacy law gives individuals the right to access much of their medical information held by hospitals and other covered healthcare providers.
This guide explains how to get medical records from a hospital in the USA, what documents you may need, how long the process takes, whether hospitals can charge fees, and what to do if your request is denied or delayed.
What Are Hospital Medical Records?
Hospital medical records are documents containing information about a patient’s healthcare and treatment.
These records are maintained by hospitals and healthcare professionals to document medical care, support treatment decisions, and coordinate services.
Depending on the patient’s hospital stay, medical records may include:
- Patient identification and registration information
- Admission and discharge summaries
- Physician and nursing notes
- Medical diagnoses
- Laboratory test results
- X-rays, CT scans, and MRI reports
- Medication lists and treatment records
- Surgical and procedure reports
- Emergency department records
- Consultation reports from specialists
- Allergy information
- Pathology reports
- Rehabilitation and therapy notes
Patients may not need every document in their medical file. They can generally request specific records or a complete copy of the information covered by their access rights.
Do Patients Have the Right to Get Their Medical Records in the USA?
Yes. Under the Health Insurance Portability and Accountability Act (HIPAA), individuals generally have the right to inspect, review, and receive copies of protected health information maintained by covered healthcare providers and health plans.
This right generally applies to medical records maintained by hospitals, doctors, clinics, and other covered entities.
Patients can request records in paper or electronic form, depending on how the information is maintained and the applicable requirements.
The HIPAA right of access generally includes medical information in a designated record set. This can include medical records, billing records, and other records used to make decisions about an individual’s healthcare.
However, certain information may be excluded, such as some psychotherapy notes maintained separately and information compiled for legal proceedings.
Official information from the U.S. Department of Health and Human Services (HHS):
How to Get Your Medical Records From a Hospital in the USA
The process is usually straightforward, although individual hospitals may have different request procedures.
Step 1: Contact the Hospital’s Medical Records Department
Start by contacting the hospital where you received treatment.
The department responsible for medical records is often called:
- Medical Records Department
- Health Information Management (HIM)
- Release of Information (ROI) Department
- Medical Records Services
You can usually find its contact information on the hospital’s official website.
Ask how to submit a medical records request and whether the hospital provides an online request option.
Step 2: Complete a Medical Records Request Form
Many hospitals provide a form called an Authorization for Release of Medical Information or Medical Records Request Form.
The form may ask for:
- Patient’s full legal name
- Date of birth
- Contact information
- Medical record number, if available
- Dates of hospital treatment
- Specific records requested
- Preferred delivery method
- Recipient information, if records should be sent to another provider
- Patient’s signature and date
Some hospitals may request additional information to verify the patient’s identity.
Read the form carefully before submitting it. If you only need a particular hospital visit or test result, specify the relevant dates and documents.
Step 3: Provide Proof of Identity When Required
Hospitals must protect patient information from unauthorized access.
They may ask you to verify your identity before releasing medical records.
Acceptable verification methods vary by hospital and may include:
- Government-issued photo identification
- Secure patient portal verification
- Identity verification questions
- Other documents requested by the hospital
Do not send sensitive identification documents through an unverified email address or unofficial website.
Step 4: Select Which Medical Records You Need
You can generally request specific information or a broader copy of your medical record.
For example, you may request:
Complete Hospital Records: A broader collection of available records relating to your hospital care.
Discharge Summary: Information about your diagnosis, treatment, condition at discharge, and follow-up instructions.
Laboratory Reports: Results of blood tests, urine tests, and other laboratory examinations.
Imaging Reports: Written findings from X-rays, CT scans, MRI scans, and other imaging studies.
Surgical Records: Documentation of an operation or medical procedure.
Emergency Department Records: Information about an emergency room visit, evaluation, and treatment.
If another doctor needs your records, ask whether the hospital can send the relevant information directly to that provider.
Step 5: Choose How You Want to Receive the Records
Hospitals may offer several delivery options.
Common methods include:
- Secure electronic download
- Hospital patient portal
- Encrypted electronic delivery
- Paper copies by mail
- In-person pickup, when available
- Direct electronic transfer to another healthcare provider
Under HIPAA, when a patient requests an electronic copy of information maintained electronically, the provider generally must provide it in the requested electronic form and format if readily producible. Otherwise, the provider and patient may agree on another readable electronic format.
Choose a secure delivery method, especially when receiving sensitive medical information.
Step 6: Submit Your Request and Keep a Copy
Submit the completed request using the hospital’s accepted process.
Depending on the facility, this may be through an online portal, secure email, fax, mail, or in-person submission.
Keep a copy of the request and any confirmation number or submission receipt.
This information can help if you need to follow up about a delayed request.
Step 7: Review the Records After Receiving Them
Once you receive your records, check whether the requested documents are included.
Look for:
- Correct patient information
- Accurate hospital dates
- Relevant diagnoses
- Test results
- Medication information
- Procedure and surgery reports
- Discharge documentation
If a document appears to be missing or contains incorrect information, contact the hospital’s medical records department.
How Long Does It Take to Get Medical Records From a Hospital?
Under HIPAA, covered healthcare providers generally must act on an individual’s access request within 30 calendar days after receiving it.
If the provider cannot complete the request within that period, HIPAA permits one extension of up to an additional 30 calendar days, provided the individual receives a written explanation of the delay and the expected completion date within the original 30-day period.
Some state laws may provide shorter access deadlines.
The actual time can also depend on the hospital’s request process, the volume of records, identity verification, and the format requested.
If you need records urgently for surgery, specialist treatment, or another medical appointment, tell the hospital when submitting your request.
Can a Hospital Charge You for Medical Records?
Yes. Hospitals may charge a reasonable, cost-based fee for certain costs associated with providing copies of medical records.
Under HIPAA, permitted costs may include:
- Labor for copying the requested information
- Supplies for paper copies
- Postage, when applicable
- Certain costs of preparing an agreed summary or explanation
A hospital generally cannot include charges for searching for or retrieving records when calculating the fee under the HIPAA access rule.
The rules also limit how fees are calculated for electronic copies.
Patients should ask for an estimate before requesting large volumes of records. State laws may provide additional protections or impose different fee limits.
Importantly, HIPAA does not allow a covered provider to deny an individual’s access to records solely because the individual has an unpaid bill for medical services.
Can You Get Your Medical Records Online?
Yes. Many hospitals in the USA provide online access through secure patient portals.
A patient portal is an online service that allows patients to view certain health information and communicate with healthcare providers.
Depending on the hospital, you may be able to access:
- Laboratory results
- Imaging reports
- Medication lists
- Visit summaries
- Discharge instructions
- Upcoming appointments
- Certain clinical notes
Some hospitals use systems such as MyChart or other electronic health record platforms.
To use a patient portal, you may need to create an account, verify your identity, and follow the hospital’s registration instructions.
Not every hospital record is necessarily available through the portal. If you need a complete copy of your medical records, contact the hospital’s medical records department.
Can You Request Medical Records for a Family Member?
Sometimes. However, being a family member does not automatically give someone the right to access another adult’s medical records.
A hospital may release records to another person when the patient has provided appropriate permission or when the requester has legal authority under applicable law.
Examples include:
A Spouse or Adult Child: A spouse or adult child generally needs the patient’s permission or another valid legal basis to obtain an adult patient’s records.
A Parent or Legal Guardian: Parents or legal guardians may generally request records for a minor when permitted by applicable law. Certain state laws provide exceptions for confidential healthcare services.
A Personal Representative: Someone legally authorized to act for the patient may be able to request records within the scope of that authority.
An Executor or Administrator: A legally recognized representative of a deceased person’s estate may have access rights under applicable HIPAA rules.
Hospitals may request proof of legal authority, identification, or a signed authorization form.
Can You Get Medical Records of a Deceased Family Member?
In certain circumstances, yes.
HIPAA generally protects a deceased person’s health information for 50 years after death.
A person who is legally recognized as the deceased individual’s personal representative under applicable law may generally exercise relevant HIPAA access rights.
Family members who are not personal representatives may also have access in certain circumstances, depending on the law, the patient’s prior wishes, and the information involved.
Hospitals may request documents such as:
- Death certificate
- Proof of relationship
- Executor or administrator documentation
- Legal authority documents
- Hospital-specific request forms
Because access rights can depend on the circumstances, contact the hospital’s medical records department for its requirements.
What If a Hospital Refuses to Give You Your Medical Records?
HIPAA gives individuals broad access rights, but there are limited situations in which a provider may deny access.
For example, certain psychotherapy notes maintained separately may be excluded from the general right of access. Some other narrow exceptions may apply.
If a hospital denies your request, ask for the reason in writing.
Depending on the type of denial, HIPAA may give you the right to request a review by a licensed healthcare professional who did not participate in the original denial decision.
You can also ask the hospital’s privacy officer or Health Information Management department to explain the decision.
If you believe the hospital has violated your HIPAA access rights, you may file a complaint with the HHS Office for Civil Rights (OCR).
Can You Correct an Error in Your Hospital Medical Records?
Yes. HIPAA generally gives individuals the right to request an amendment to protected health information in a designated record set when they believe the information is incorrect or incomplete.
For example, you may find:
- An incorrect date of birth
- An inaccurate medication list
- An incorrect medical history entry
- A wrong treatment date
- Missing information that affects the accuracy of the record
To request a correction, contact the hospital’s medical records department or privacy office and follow its amendment procedure.
The hospital must review the request, but it does not have to approve every requested change.
If the hospital denies an amendment request, it must provide a written explanation. In certain circumstances, patients can submit a statement of disagreement that becomes part of the record.
Why Might You Need Your Hospital Medical Records?
There are several practical reasons to obtain copies of your medical records.
Getting a Second Medical Opinion
Another doctor may need your diagnosis, test results, imaging reports, and treatment history to evaluate your condition.
Changing Hospitals or Doctors
When moving to another healthcare provider, medical records can help the new team understand your previous treatment and avoid unnecessary repetition of tests.
Continuing Treatment
Patients with chronic illnesses or complex medical conditions may need their records for ongoing care.
Insurance Claims and Billing Questions
Medical records may help patients understand the services received and support certain insurance-related questions or disputes. However, the records alone do not guarantee insurance payment.
Personal Healthcare Management
Keeping copies of important medical documents can help patients maintain an organized record of their health history.
What Is the Difference Between a Medical Records Request and an Authorization Form?
These terms are related but not identical.
A medical records request is the process through which an individual asks a hospital to provide copies of their medical information.
An authorization form is a document that may be used to permit a hospital to disclose information to another person or organization, particularly when the disclosure is not otherwise permitted under HIPAA.
For example, a patient may authorize a hospital to send records to an attorney, employer, insurance company, or another recipient when an authorization is required.
However, a patient generally does not need to sign a separate HIPAA authorization simply to exercise their own right to access their medical records.
Frequently Asked Questions (FAQs)
1. Can I get my hospital medical records for free in the USA?
Not always. Hospitals may charge reasonable, cost-based fees for certain copying and delivery expenses. However, fees must follow applicable HIPAA and state-law requirements.
2. Can a hospital refuse to provide records because I have an unpaid medical bill?
Generally, no. HIPAA does not permit a covered healthcare provider to deny an individual’s access request solely because the individual has an unpaid bill for medical services.
3. How far back can I request hospital medical records?
HIPAA does not establish a single nationwide retention period for every type of medical record. Record retention requirements vary by state, record type, and other applicable laws. A hospital may no longer have older records if they were lawfully destroyed under its retention policy.
4. Can I request medical records from a hospital I visited years ago?
Yes. You can contact the hospital and ask whether the records are still available. The hospital will follow its applicable record-retention policy and legal requirements.
5. Can I ask a hospital to send my records directly to another doctor?
Yes. Patients can generally request that their medical information be sent to another healthcare provider, subject to applicable access rules and requirements.
6. Can I get my MRI or CT scan images, not just the written report?
You can request copies of imaging information maintained by the hospital. Depending on the facility, images may be provided through a secure download, imaging portal, or electronic media.
7. Can someone access my medical records without my permission?
HIPAA generally protects medical information, but certain disclosures are permitted or required by law without a separate patient authorization. These may include disclosures for treatment, certain public health activities, and other legally permitted purposes.
8. What should I do if the hospital does not respond to my request?
Contact the medical records department and ask for an update. If the hospital has not met the applicable access deadline or you believe your rights have been violated, you may contact its privacy officer or file a complaint with HHS OCR.
Final Thoughts
Getting your medical records from a hospital in the USA is an important part of managing your healthcare. Whether you need documents for a second opinion, insurance questions, continued treatment, or personal records, HIPAA generally gives you the right to access much of your medical information.
The process usually involves contacting the hospital’s medical records department, completing a request form, verifying your identity, and selecting a delivery method.
Patients should review the documents after receiving them and contact the hospital if information is missing or incorrect.
Keeping an organized copy of your medical records can make future healthcare visits easier and support better communication between healthcare providers.
Medical Disclaimer
This article is for general informational and educational purposes only. It does not constitute medical, legal, or insurance advice. HIPAA access rights, state privacy laws, record-retention requirements, and hospital procedures may vary depending on the circumstances. For questions about your specific rights or a denied records request, contact the hospital’s privacy officer or a qualified professional.