If a provider is ignoring, delaying, or refusing your request for your own medical records, you have real options. Under the federal privacy rule (45 CFR 164.524), a provider generally has 30 days to act on your request, and may take one extension of up to 30 more days only if they give you a written explanation of the delay and the date they will finish. If they deny you, the denial must be in writing, in plain language, and must tell you how to complain. And if the deadline passes with nothing but silence, you can file a free complaint with the HHS Office for Civil Rights (OCR) — you must do it within 180 days of when you knew about the problem, and the law forbids the provider from retaliating against you for filing.
The clock they're on
The timing rule is short and specific. Once the provider receives your request, they must act within 30 days — meaning they either give you the records or give you a written denial. They can extend once, by up to 30 additional days, but only if, inside that first 30-day window, they send you a written statement saying why they need more time and when they will be done. There is no second extension. "We're backed up" is not an extension unless it arrives in writing with a date attached.
Reasons that are not reasons
Records staff sometimes give explanations that sound official but do not hold up. A few of the most common:
| What you're told | What's actually true |
|---|---|
| "You have an unpaid balance." | Your right to a copy of your health information does not depend on your account balance. |
| "Your doctor has to approve it first." | The record is about you. Physician sign-off is an internal workflow, not a condition of your right. |
| "We only release records to another doctor." | You can request a copy for yourself, and you can also direct them to send it to a person you choose. |
| "You have to come in and pick it up in person." | They must provide access in the form and format you asked for, if they can readily produce it — including electronically, and by mail if you ask. |
| "That's too old / it's in storage." | The right of access applies for as long as they still keep the information. Search-and-retrieval time is not even a chargeable cost. |
| "You need to tell us why you want it." | You don't. No reason is required. |
When a denial is actually allowed
Denials are narrow, and they fall into two buckets.
Denials you cannot appeal internally
- Psychotherapy notes — the therapist's separate private session notes (not your general mental-health chart).
- Information gathered for a lawsuit — material compiled in anticipation of, or for use in, a legal or administrative proceeding.
- A small set of narrow situations involving inmates, certain ongoing research you consented to, records covered by the federal Privacy Act, and information given by someone else under a promise of confidentiality.
Denials you can have reviewed
A licensed health care professional may decide that giving you access is reasonably likely to endanger the life or physical safety of you or someone else, or would likely cause substantial harm to another person named in the record. In these cases you have the right to have that decision reviewed by a different licensed professional who did not make the original call. Ask for that review in writing.
What a proper denial looks like
If they say no, the denial has to be a real document, not a shrug at the counter. It must be written, in plain language, and must include:
- The basis for the denial;
- If the denial is one of the reviewable kinds, a statement of your right to have it reviewed and how to ask for that; and
- A description of how you can complain — both to the provider's own privacy contact and to HHS — including the name or title and phone number of the person or office responsible.
There's one more useful rule: if the provider doesn't have the records but knows who does, they are required to tell you where to send your request.
Step-by-step escalation
- Re-send the request in writing. Date it. Keep a copy. Be specific about what you want (dates, visits, types of records) and how you want it delivered.
- Ask for the privacy officer. Every organization covered by the rule must designate a privacy contact. This person usually knows the law better than the front desk does, and a polite, informed message often ends the problem in a day.
- Put the deadline in the message. Something as simple as: "I requested my records on [date]. I understand the response deadline is 30 days, with one written extension available. Please confirm the status." You do not need to be aggressive; you need to be specific.
- Ask for the denial in writing. If they're refusing verbally, ask them to send the written denial the rule requires. Many refusals evaporate at this step.
- Request review, if it's a reviewable denial.
- File a complaint if you're still stuck.
Filing a complaint with OCR
The HHS Office for Civil Rights takes complaints from anyone, free of charge. The essentials:
- It must be in writing — through the OCR complaint portal, or by mail, fax, or email.
- Name the organization you believe violated the rule.
- Describe what happened — what you asked for, when, and what they did or didn't do.
- File within 180 days of when you knew about the problem. OCR can extend that window if you show good cause, but don't count on it.
- Include your name and contact information. OCR does not investigate anonymous complaints, though you can ask that your identity be kept confidential during the investigation.
Retaliation for filing is prohibited. If a practice threatens to drop you as a patient because you complained, tell OCR immediately.
The second complaint path
There is a separate federal rule about information blocking — practices that interfere with the access, exchange, or use of electronic health information. It comes from the 21st Century Cures Act and applies to health care providers, health information exchanges and networks, and developers of certified health IT. If your complaint is really about the electronic side — the portal won't show your results, an app you chose is being refused a connection, a provider won't send data electronically without a made-up reason — you can submit a claim through the federal Report Information Blocking Portal. Claims there can be investigated by the HHS Office of Inspector General, and the identity of the person who submits a claim is protected from mandatory disclosure under the Freedom of Information Act.
Filing one does not stop you from filing the other. If your situation involves both a stalled paper request and a stonewalled electronic one, use both paths.
Keep a paper trail
Whatever route you take, the strength of your position comes down to documentation. Keep:
- A copy of every request, with the date you sent it and how you sent it;
- Names of everyone you spoke to and the date;
- Any written denial, extension letter, or fee estimate;
- Screenshots of portal messages, which have a habit of disappearing when accounts are closed.
The short version
They have 30 days. Denials must be written, narrow, and explained. Money you owe is not a lock on your own information. And when a provider stops answering, a free complaint to OCR — filed within 180 days, in writing, with the organization named — is a real and protected option, not a last resort you need permission to use.
Common questions
How long does a provider have to respond to my records request?
Generally 30 days from receiving the request. They may take one extension of up to 30 additional days, but only if they give you a written statement of the reason for the delay and the date they will complete the request.
Can they refuse because I owe the practice money?
No. Your right to obtain a copy of your health information is not conditioned on paying an outstanding bill.
What if they just never answer?
Send a dated written follow-up, ask for the privacy officer, and then file a complaint with the HHS Office for Civil Rights. The complaint is free, must be in writing, must name the organization, and generally must be filed within 180 days of when you knew about the problem.
Can they retaliate against me for complaining?
No. Retaliation for filing a complaint is prohibited. If it happens, notify OCR right away.
Common questions
How long does a provider have to respond to my records request?
Generally 30 days from receiving the request. They may take one extension of up to 30 additional days, but only if they give you a written statement of the reason for the delay and the date they will complete the request.
Can they refuse to release my records because I owe the practice money?
No. Your right to obtain a copy of your health information is not conditioned on paying an outstanding bill.
What if the provider simply never answers my request?
Send a dated written follow-up, ask to speak with the organization's privacy officer, and then file a complaint with the HHS Office for Civil Rights. The complaint is free, must be in writing, must name the organization, and generally must be filed within 180 days of when you knew about the problem.
Can a practice retaliate against me for filing a complaint?
No. Retaliation against you for filing a complaint is prohibited. If a provider threatens or punishes you for complaining, notify the Office for Civil Rights immediately.