The HIPAA Privacy Rule gives you a strong, federally protected right to inspect and obtain a copy of your own health information. This is commonly called the right of access, and it is one of the most important — and most frequently underused — rights patients have. The U.S. Department of Health and Human Services has made enforcing this right a long-standing priority, which is good news for anyone who has ever struggled to pry their own records loose.
What the right of access covers
You can ask for the information in what HIPAA calls your designated record set — the records a provider or health plan uses, in whole or in part, to make decisions about you. In everyday terms, that typically includes:
- Medical records and clinical visit notes
- Laboratory and other test results
- Imaging reports such as X-ray and MRI readings
- Medication, immunization, and allergy records
- Billing and claims records held by your health plan
You generally have the right to this information for as long as the provider maintains it. There is no requirement that the records be recent, so you can request older records too, as long as they still exist.
Who must give you access
The right applies to "covered entities" — most healthcare providers, hospitals, clinics, pharmacies, and health insurers — as well as the "business associates" that handle data on their behalf. It's worth knowing the limit: many direct-to-consumer wellness apps and devices are not covered by HIPAA at all, so the right of access may not apply to data you've only ever put into such an app.
The timeline and fees
A covered entity must act on your request within 30 calendar days, with one possible 30-day extension if they notify you in writing and explain the delay. They may charge only a reasonable, cost-based fee for copying — covering labor for copying, supplies, and postage — but not for the act of searching for or retrieving your file. If you're quoted a fee that seems steep, ask for an itemized explanation.
Limited exceptions
The right of access is broad, but not unlimited. Providers may withhold certain narrow categories:
- Psychotherapy notes, which are a mental-health professional's private notes kept separate from the rest of the chart.
- Information compiled in reasonable anticipation of, or for use in, a lawsuit or legal proceeding.
- Information that a licensed professional determines, in limited circumstances, is reasonably likely to endanger the life or physical safety of you or another person — and even then you can request that the denial be reviewed by a second professional.
If your access is denied or delayed
If a provider refuses without a valid basis, charges an excessive fee, or simply doesn't respond, you can file a complaint with the HHS Office for Civil Rights (OCR). Complaints are free and can be submitted online. Because OCR has resolved numerous right-of-access cases over the years, providers generally take these obligations seriously.
Your right of access is yours regardless of whether you owe the provider money. A provider cannot withhold your records solely because you have an unpaid bill.
Bottom line
When you ask for your own health information, the default answer under HIPAA is yes. Knowing the 30-day timeline, the limits on fees, the option to direct records to a third party, and the free complaint process puts you in a strong position to get exactly what you're entitled to.