Sometimes you do not want a copy of your records for yourself; you want them sent somewhere else. To a new doctor, to a lawyer handling an injury claim, to a school that needs a physical form, to a family member helping manage your care, or to an app that organizes your health information. HIPAA gives you a specific way to do that, called a third-party directive, and it comes with the same timing and fee protections as a request for your own copy. This guide explains how it works and when a different form is needed instead.
What a third-party directive is
The HIPAA Privacy Rule's right of access lets you obtain a copy of your protected health information from your provider or health plan. The same provision says that if you ask, in a signed written request that clearly identifies the recipient and where to send the information, the provider must transmit the copy directly to another person or entity you designate. That written instruction is the third-party directive. It is your access right, exercised on your behalf toward a destination you choose, and the provider must honor it under the access rule's timeline of 30 days, with one 30-day extension if you are told the reason.
The directive applies to records held in a designated record set, which is the medical and billing records used to make decisions about you. It applies whether the recipient is a person, a business, a lawyer, or an app.
Directive versus authorization
Providers often hand patients a HIPAA authorization form when asked to send records elsewhere. An authorization is a different instrument with different rules, and the difference affects your cost and timeline.
| Third-party directive (access right) | HIPAA authorization | |
|---|---|---|
| Who initiates | You, exercising your own right | You permit the provider to disclose to someone |
| Provider's obligation | Must comply | May comply; not required to |
| Deadline | 30 days, one 30-day extension | None set by HIPAA |
| Fees | Limited to a reasonable, cost-based fee | Fee limits do not apply; state law may cap |
| Required content | Signed, clearly names the recipient and destination | Specific required elements, expiration, revocation statement |
Following a federal court decision, HHS clarified that the access fee limits apply when the copy is sent to you or, for electronic copies of electronic PHI, when you direct it to a third party. When the third-party request is for records in other formats, the provider may treat it under its normal fee rules. That nuance is why asking for an electronic copy of your electronic record to be sent to a third party usually gives you the strongest position on both timing and cost.
How to make the request
- Put it in writing and sign it. Email is fine if the provider accepts electronic requests; a portal message with your name typed is often accepted; a letter always works.
- State clearly that you are exercising your right of access under HIPAA and directing the copy to a third party.
- Name the recipient exactly: person or organization, mailing address, fax number, or email address, and whether you want it sent through the recipient's secure portal if one exists.
- Specify what records you want. "All records from 2023 to present" or "the operative report and discharge summary from my March admission" are both fine. Broad requests are permitted.
- State the format you want, such as PDF by email or through a portal. If the provider can readily produce that format, it must.
- Keep a copy and note the date. The 30-day clock starts when the provider receives it.
If you are sending records to an app, some providers can connect it directly through the patient portal's app access, which is faster than a directive and uses the same underlying right. Check the portal first.
Fees and format
When the directive is for an electronic copy of electronic records, the provider may charge only a reasonable, cost-based fee covering labor for copying, supplies, and postage. It may not charge a per-page rate set by state law for that kind of request, and it may not charge for searching or retrieving. Many providers charge nothing for portal or emailed copies. The provider must tell you the approximate fee in advance if you ask.
The provider may send the records unencrypted by email if you request it that way, after warning you of the risk. It may not refuse a directive because the destination is a personal email address or an app it does not endorse, though it may express concerns.
What the directive does not cover
- Psychotherapy notes kept separately by a mental health professional, and information compiled for litigation, are excluded from the access right entirely.
- Records the provider does not hold. A directive to your primary care office does not reach your hospital's records; send one to each.
- A request made by the third party rather than by you. If a lawyer or another provider sends the request, it is not your directive unless you signed it, and the provider may treat it as an authorization request.
- Some state laws provide additional protections for specific categories such as substance use treatment records, which have their own federal rules, or HIV status, and a provider may need an authorization with specific language for those.
If the provider pushes back
Common responses include insisting on the provider's own authorization form, quoting a large fee, or saying records cannot be emailed. You can politely cite the right of access and its third-party provision, ask for the fee to be itemized against the cost-based standard, and ask for the response in writing. If the provider does not act within the deadline or refuses, you may file a complaint with the HHS Office for Civil Rights, which has taken enforcement action repeatedly over access delays. Keep the paper trail; it is usually what resolves the issue.
Common questions
Do I have to use the provider's form for a third-party directive?
No. HIPAA requires a signed, written request that clearly identifies the recipient and where to send the records. A provider may offer its own form for convenience but cannot reject a request that meets those requirements.
Can a provider charge more to send records to my lawyer than to me?
For an electronic copy of your electronic records that you direct to a third party, the same reasonable, cost-based fee limit applies as for a copy to you. For other formats or requests initiated by the third party under an authorization, the provider may apply its standard fees, subject to state law.
How long does the provider have to send the records?
Thirty days from receipt of your request, with one extension of up to 30 days if the provider tells you in writing why it needs more time. Many states require faster responses.
Can I direct my records to a health app?
Yes. The access right allows you to designate any third party, including an app. If the app connects through your patient portal's app access feature, that may be faster than a written directive.