US FederalWhat are my rights to access my own medical records under HIPAA?
Under HIPAA, you have the legal right to inspect and obtain a copy of your protected health information held by covered entities, with limited exceptions and within specific timeframes.
What the Law Says
The HIPAA Privacy Rule, codified in federal law, gives individuals the right to access their protected health information (PHI) held by covered entities such as doctors, hospitals, and health plans.
Your right to access your medical records is guaranteed under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. This rule applies to 'covered entities' — including healthcare providers, health plans, and healthcare clearinghouses — that electronically transmit health information.
You may request to inspect or receive a copy of your PHI in the form or format you request, if it’s readily producible in that form. Covered entities must act on your request no later than 30 calendar days after receiving it. They may extend this deadline by one additional 30-day period, but only if they provide you with a written statement of the reasons for the delay and the new completion date.
Covered entities may charge a reasonable, cost-based fee for copying and postage — but not for search or retrieval. As of 2024, the maximum fee for electronic copies is $6.50 per request, regardless of the number of records. For paper copies, fees are limited to the actual cost of labor, supplies, and postage.
Certain information may be excluded from access, such as psychotherapy notes, information compiled for civil or criminal proceedings, or information subject to certain other legal restrictions.
Statutory TextA covered entity shall, upon request of an individual, provide the individual with access to the protected health information about the individual maintained by or for the covered entity.
— 42 U.S.C. § 1320d — Health information privacy
What to Do
Submit a written request (some providers accept electronic forms) to your provider or health plan specifying the records you want and preferred format (e.g., electronic PDF or paper).
If denied, ask for a written denial explaining the reason — you have the right to appeal most denials internally.
If your request isn’t fulfilled within 30 days (or 60 days with extension), file a complaint with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights.
Keep copies of all correspondence and note dates of requests and responses.
Sources
Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.