Hands holding phone with dark patient portal screen

How to Request Medical Records: A Step-by-Step Guide

Byryan@coautoinjury.com

Your fastest move is to log into your provider’s patient portal right now. For most people, that single step gets you labs, immunizations, and visit notes within minutes, no paperwork required. If a portal isn’t available, go directly to the provider’s Release of Information (ROI) or Health Information Management (HIM) department and ask for their records request form.

Under HIPAA’s Privacy Rule (45 CFR 164.524), you have a federal right to inspect and receive copies of your medical and billing records held by any covered entity. Providers generally have a legal deadline to respond within a reasonable time, often within about a month. They cannot block access because of an unpaid bill, and electronic delivery is often free.

Before you contact anyone, gather four things: a government-issued photo ID, your full legal name and date of birth, the provider’s name and address, and the approximate date range of the records you need.

Pro Tip: Request electronic delivery whenever possible. Patient portals, encrypted email, and health apps typically carry no copying fee, while paper copies can cost several dollars per page.

Table of Contents

Step-by-step medical records request: the complete walkthrough

Follow these six steps in order. Skipping steps is the most common reason requests stall.

Diagram of six-step medical records request process

Step 1: Identify every records custodian

List every place that holds records you need: hospitals, outpatient clinics, specialist offices, labs, imaging centers, urgent care facilities, and pharmacies. Each one is a separate request. Note the specific date ranges and record types for each location (office visit notes, radiology reports, pathology results, billing records). Narrowing the scope to what you actually need speeds processing and cuts costs.

Exteriors of various medical provider buildings

Step 2: Gather your identity documents and proof of authority

You will need at minimum a government-issued photo ID. If you are requesting on behalf of someone else, you also need:

  • Parent or guardian of a minor: birth certificate or court order establishing guardianship
  • Personal representative: a signed healthcare power of attorney or legal guardianship documentation
  • Executor of a deceased patient’s estate: letters testamentary and a copy of the death certificate

Providers may verify your identity orally or in writing, but HIPAA prohibits verification requirements that unreasonably delay access.

Step 3: Decide on format and recipient

Are you requesting records for yourself, for a new provider, or for an attorney? The answer changes what you fill out. Sending records to a third party requires a signed authorization specifying the recipient’s name, address, and purpose. Directing records to yourself is a direct access request and typically uses a simpler form. Electronic delivery to a personal email or portal download is the lowest-cost option.

Step 4: Complete the request form or write a signed letter

Most providers have their own release-of-information form. Use it when available. If no form exists, a properly structured written request works just as well and creates a paper trail. Every request, whether on a form or in a letter, must include:

  • Full legal name and date of birth
  • Current address and phone number
  • Provider name and facility address
  • Specific date range (e.g., January 1, 2023 through December 31, 2024)
  • Types of records requested (office notes, lab results, imaging, billing)
  • Delivery format preference (electronic, paper, CD)
  • Recipient name and address (if sending to a third party)
  • Your signature and the date

Ready-to-use request template:

[Your Full Legal Name]
[Your Address]
[City, State, ZIP]
[Phone Number]
[Date]

Health Information Management Department
[Provider/Facility Name]
[Facility Address]

Re: Request for Medical Records

I am writing to request a copy of my medical records pursuant to 45 CFR 164.524 (HIPAA Privacy Rule). Please provide the following:

Patient name: [Full Legal Name]
Date of birth: [MM/DD/YYYY]
Date range: [Start Date] through [End Date]
Record types requested: [e.g., office visit notes, lab results, radiology reports, discharge summaries]
Preferred delivery format: [Electronic via portal / encrypted email / paper / CD]
Recipient: [Self / Name and address of third party]

Please contact me at [phone/email] with any questions or to confirm receipt. I understand a reasonable fee may apply for paper copies. Please provide a fee estimate before processing.

Sincerely,
[Signature]
[Printed Name]
[Copy of ID attached: Yes]

Step 5: Submit and document proof

Submit through the provider’s preferred channel and immediately save proof of submission. This documentation starts the 30-day HIPAA clock and becomes your evidence if you need to escalate.

  • Portal submission: screenshot the confirmation screen
  • Mail: send certified mail, return receipt requested, and keep the tracking number
  • Fax: save the transmission confirmation page
  • In-person: ask for a date-stamped copy of your request

Step 6: Track status and verify completeness

Follow up if you haven’t heard back within two weeks. When records arrive, check them against your request: are all the date ranges covered? Are all record types included? If anything is missing, contact the HIM department immediately and ask for the specific gap to be filled. If you believe an entry is inaccurate, HIPAA lets you request an amendment; if the provider refuses, your signed statement of disagreement becomes part of the permanent file.

Pro Tip: Tell the provider upfront if you have an upcoming appointment, surgery, or legal deadline. Many HIM departments will prioritize requests when a clinical or legal urgency is documented in writing.

What are your options for submitting a request?

Choosing the right channel saves time and money. Here is when each method makes sense:

  • Patient portal (fastest, usually free): Log in, navigate to “Health Records” or “Medical Records,” and download directly. Portals commonly provide immediate access to recent labs, immunizations, and visit notes. Best for routine, recent records.
  • Online release form: Many large health systems post a records request form on their website. Fill it out, attach a copy of your ID, and submit electronically. Confirmation is usually automatic.
  • Mail: Use certified mail with return receipt. Best for archived records, older records, or when you need a documented paper trail for legal purposes.
  • Fax: Still common in medical settings. Always request and save the fax transmission confirmation. Use when the provider’s form instructs you to fax.
  • In-person: Bring a photo ID and, if applicable, proof of authority. Ask to speak with the HIM or ROI department directly. Useful for urgent requests or when you want to confirm receipt on the spot.
  • Email: Acceptable at many facilities, but ask whether their system uses encrypted delivery. Unencrypted email carries privacy risk for sensitive records.
  • Phone: Providers may accept verbal requests for certain records, but a written request creates a stronger paper trail and is generally recommended for anything you may need later.

When records are held at an offsite archive or the provider has closed, processing times can stretch beyond the standard 30-day window. Contact the provider’s HIM department early and ask specifically whether the records are archived and what the retrieval timeline looks like.

What do you need to include in a request and who can make one?

Every request needs a core set of fields to be processed without delay. Missing even one commonly triggers a rejection or a call-back that resets the clock.

Required fields for any request

Field What to include
Patient full legal name As it appears on insurance or prior records
Date of birth MM/DD/YYYY format
Contact information Current address, phone, and email
Provider or facility Full name and address of the records custodian
Date range Specific start and end dates
Record types Office notes, labs, imaging, billing, discharge summaries
Delivery format Electronic, paper, CD, or direct-to-provider
Recipient details Name and address if sending to a third party
Signature and date Required on virtually every release form

Who can request records

  • The patient: always, with valid ID
  • Parent or legal guardian of a minor: with birth certificate or court order; note that some states give adolescents independent privacy rights for certain services (reproductive health, mental health, substance use)
  • Personal representative: with a signed healthcare power of attorney or court-issued guardianship order
  • Executor or next of kin of a deceased patient: with letters testamentary and a death certificate

Sensitive records and special authorizations

Psychotherapy notes, substance-use treatment records (governed by 42 CFR Part 2), and HIV/AIDS records carry stricter protections than standard medical records. Accessing or releasing them often requires a separate, specific authorization beyond a standard HIPAA release form. If you are requesting these record types, ask the HIM department explicitly what additional authorization is needed before submitting.

How long does a request take, and what will it cost?

HIPAA timelines

Under 45 CFR 164.524, a covered entity must respond within 30 calendar days of receiving your request. One 30-day extension is permitted if the provider gives you a written reason. Providers are encouraged to respond sooner, and many do.

State law can shorten that window. California, for example, requires providers to respond within 15 days for most requests. Colorado patients should check with the Colorado Medical Board or the provider’s HIM department for any state-specific rules that may apply.

Electronic portal access can be immediate. Paper copies take longer because of printing, copying, and mailing.

Fees

Providers may charge reasonable, cost-based fees for copying and mailing. They cannot charge for search or retrieval time. Unpaid bills cannot be used to block access.

Pro Tip: Before the provider processes your request, ask for a written fee estimate. If the cost is high, consider narrowing the date range or switching to electronic delivery to reduce it.

How do you handle special cases?

Some requests involve extra steps that catch people off guard.

  • Minors: A parent or legal guardian generally has the right to access a minor child’s records. However, many states carve out exceptions for services the minor can consent to independently, such as mental health counseling, reproductive health care, or substance-use treatment. Check your state’s rules before assuming full access.
  • Deceased patients: An executor with letters testamentary or, in some states, the next of kin can request records. You will need to provide the death certificate alongside proof of your legal authority. Some facilities require a notarized affidavit.
  • Psychotherapy notes: These are treated separately under HIPAA and are not automatically included in a standard records release. A provider may decline to release them even when other records are provided. A separate, specific authorization is typically required.
  • Substance-use treatment records: Federal regulations under 42 CFR Part 2 impose stricter confidentiality requirements than standard HIPAA rules. Releasing these records requires a specific written consent form that names the recipient and the purpose.
  • HIV/AIDS records: Many states have additional statutes requiring specific written authorization for disclosure. Verify your state’s requirements before requesting or authorizing release.
  • Large imaging files: MRI, CT, and X-ray files are often too large for standard electronic delivery. Ask whether the facility provides a CD, USB drive, or a secure download portal. Physical media may require an in-person pickup or shipping.
  • Archived or closed-provider records: If a practice has closed, records are typically transferred to a custodian. Contact the state medical board or the Colorado Medical Board for guidance on locating archived records.

For any of these situations, contact the provider’s HIM department directly and ask what additional documentation or authorization is required before you submit.

What do you do if your request is denied or ignored?

Denial or delay does not mean you are out of options. Work through this escalation path in order.

  1. Ask for the denial in writing. HIPAA requires providers to give you a written explanation of any denial. Get it before doing anything else.
  2. Review the reason. Some partial denials are lawful: psychotherapy notes, records compiled for legal proceedings, and certain law-enforcement files can be withheld. Everything else must still be provided.
  3. Narrow your request. If the full record set is denied, ask for an indexed list of what is available and request only the portions you are entitled to.
  4. Request a completion date for delays. If the 30-day window has passed with no response, send a written follow-up asking for a specific completion date and citing 45 CFR 164.524.
  5. File a complaint with HHS OCR. If the provider still fails to respond or denies access without a lawful reason, file a complaint with the HHS Office for Civil Rights. Include: your name and contact information, the provider’s name and address, a description of what you requested and when, copies of any written denials, and proof of submission (certified mail receipt, portal confirmation, fax log).
  6. Contact the state medical board. In Colorado, the Colorado Medical Board can receive complaints about providers who fail to comply with records access requirements.
  7. Consult an attorney. Persistent denial, missing records needed for a legal deadline, or a provider who refuses to respond are all situations where legal help can move things faster than any complaint process.

Sample escalation email:

Subject: Follow-Up on Medical Records Request — [Your Name] — Submitted [Date]

Dear Health Information Management Department,

On [date], I submitted a request for my medical records covering [date range]. As of today, [current date], I have not received the records or a written explanation for any delay. Under 45 CFR 164.524, a covered entity must respond within 30 calendar days of receiving a request.

Please confirm receipt of my original request and provide a specific completion date. If any portion of my request has been denied, please provide the written denial and legal basis as required by HIPAA.

I can be reached at [phone/email].

Sincerely,
[Your Name]

Keep a log of every contact: date, name of the person you spoke with, and what was said or promised. That record matters if you escalate to OCR or need legal help.

  • Document submission dates and confirmation numbers
  • Save every written communication with the provider
  • Note the names of HIM staff you speak with and the date of each call

When should you hire an attorney to help get records?

Most people can obtain their own records without legal help. But there are situations where an attorney moves faster and gets more.

  • Persistent denial or non-response: If a provider refuses to comply after a written request and a formal complaint, an attorney can send a demand letter on firm letterhead or pursue the matter through litigation.
  • Records needed for an injury claim: Missing or incomplete records can directly reduce the value of a personal injury settlement. An attorney who handles injury cases knows which records matter most and how to authenticate them for court use. See the evidence checklist for injury cases for a practical breakdown.
  • Legal deadlines: Colorado’s statute of limitations for personal injury claims is generally two years from the date of injury. If records are missing and a deadline is approaching, waiting is not an option. Review the key deadlines for Colorado injury claims before assuming you have time.
  • Complex custody or executor disputes: When records are needed for a guardianship, custody, or estate matter, an attorney can navigate the authorization requirements and, if necessary, use formal discovery.
  • Litigation: Once a case is in court, records can be obtained through subpoena or formal discovery, which carries legal weight that a personal request does not.

What to bring to a consultation

  • Copies of all prior records requests (dates, methods, confirmation numbers)
  • Any written denials and the stated reasons
  • A valid photo ID
  • Any relevant deadlines (court dates, statute of limitations, upcoming medical procedures)
  • A list of every provider or facility that holds records you need

Attorneys handling personal injury cases typically work on contingency, meaning no fee unless there is a monetary recovery. For a records-only engagement outside of litigation, ask about the fee structure upfront. The consulting a lawyer workflow explains how that process works in practice.

Why timely records access matters more than most people realize

After more than a decade handling personal injury cases in Colorado, one pattern stands out: the cases that stall or settle for less than they should are almost always the ones where records are incomplete or arrived too late.

Medical records are not just paperwork. They are the factual foundation of an injury claim. They document the mechanism of injury, the treatment received, the gaps in care, and the prognosis. When records are missing, an insurance adjuster fills that gap with assumptions, and those assumptions rarely favor the injured person.

What surprises most clients is how often the problem is not a provider refusing to release records. It is the client not knowing they had the right to request them, or waiting until a deadline was close before asking. HIPAA gives you a clear, enforceable right of access. The 30-day response window is real. The fee limits are real. The escalation path through HHS OCR is real and it works.

If you are dealing with an injury claim and you are not sure which records you need or whether what you have received is complete, that is exactly the kind of question worth bringing to a free consultation before assuming everything is in order.

Stubbornattorney helps injured clients get the records their case needs

When records are missing, incomplete, or being withheld, the impact on an injury claim can be significant. Stubbornattorney works with injured clients across Colorado to identify which records matter, obtain them, and authenticate them for use in settlement negotiations or litigation, all on a contingency-fee basis. You pay nothing unless there is a recovery.

If you have been injured in a car accident, truck accident, or any other incident and you are struggling to pull together the documentation your claim requires, a free case review is the right next step. Bring whatever records requests you have already submitted, any denials you have received, and a list of the providers involved. The team at Stubbornattorney will tell you exactly where the gaps are and what to do about them. Start with a free personal injury case review and find out what your records can do for your claim.

Sources

Use these directly to download forms, verify your rights, and file complaints.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

FAQ

What is the quickest way to get my medical records?

Log into your provider’s patient portal. Patient portals frequently provide immediate electronic access to recent labs, immunizations, and visit notes without a formal request, and electronic downloads are usually free.

How do I ask for my full medical records?

Submit a signed written request or complete the provider’s release-of-information form, specifying your full legal name, date of birth, the complete date range, all record types you need, and your preferred delivery format. A properly structured request with a copy of your ID attached processes faster and creates a paper trail.

How long does a provider have to respond under HIPAA?

Under 45 CFR 164.524, a covered entity must respond within 30 calendar days of receiving your request, with one possible 30-day extension if a written reason is provided. State law may set a shorter deadline.

Can a provider deny my records because I owe money?

No. HIPAA prohibits denying access because of an unpaid balance. The provider may charge a reasonable, cost-based fee for copying and mailing, but an outstanding bill is not a lawful reason to withhold records.

When does it make sense to hire an attorney to get records?

If a provider persistently refuses to respond, if records are missing and a legal deadline is approaching, or if you need records authenticated for an injury claim or litigation, legal help is worth it. Stubbornattorney offers a free case review for injured clients in Colorado who need help obtaining and using their medical records.

Leave a Reply

Your email address will not be published. Required fields are marked *