Short answer: Check the provider's own portal first. If it lacks what you need, send the records department a written request under your HIPAA right of access (45 CFR 164.524), which covers health plans and most providers: name the records, ask for an electronic copy and the fee in advance. HHS says a covered provider must act within 30 calendar days, or 60 if it tells you in writing within 30 days why and when. If it is not covered by HIPAA, check your state's law.
MyChart is the patient portal that many health systems license from Epic, but plenty of practices, labs, imaging centers, therapists and smaller clinics use a different portal, or none. If the provider has a portal, sign in and look for a download, export or 'request records' option first. HHS says that if your doctor offers a web portal, you may be able to view and download your health information whenever you want, and that a provider cannot charge you a fee when it fills your access request through the view, download and transmit function of its certified electronic health record technology.
A portal usually shows only part of your record. When it does not have what you need, such as older visits, scanned paper charts, imaging, billing records or a complete chart, use the formal route below. It works with or without MyChart, and it is the same right you would use with any health care provider or health plan covered by HIPAA.
The HIPAA Privacy Rule gives you a legal, enforceable right to see and get copies of the health information that HIPAA covered entities keep about you. HHS describes covered entities as health plans and most health care providers; its complaint page says OCR can investigate covered health care providers that conduct certain transactions electronically. A provider outside that group is not covered by the HIPAA access rule, although state law may still give you a right to your records.
The right covers what HHS calls the designated record set, which is broader than the chart you see in a portal. The table summarizes what HHS's guidance on 45 CFR 164.524 says.
| Question | What HHS guidance says | Where it comes from |
|---|---|---|
| What can I ask for? | Medical records, billing and payment records, insurance information, clinical laboratory test results, medical images such as X-rays, wellness and disease management program files, and clinical case notes, among other records used to make decisions about you; old or archived records are included | HHS access guidance; 45 CFR 164.501 and 164.524 |
| What is expressly excluded? | Psychotherapy notes kept separately from your medical record, and information compiled for a legal proceeding (the underlying medical and billing records stay accessible); records not used to make decisions about individuals, such as peer review files, are also outside the right | HHS access guidance; 45 CFR 164.524(a)(1) |
| Do I have to ask in writing? | A provider may require a written request if it tells you so, and may ask you to use its own form, but not in a way that creates a barrier or unreasonable delay. It may not require you to come in person to make the request or prove your identity when you want the copy mailed or emailed, to use a web portal, or to mail the request | HHS access guidance; 45 CFR 164.524(b)(1) |
| Do I have to say why? | No. A provider may not require a reason, and your reason, if you give one, is not a permitted ground to deny access | HHS access guidance |
| Will they check my identity? | Yes, the provider must take reasonable steps to verify who you are, but HHS says verification may not create barriers or unreasonable delay | HHS access guidance; 45 CFR 164.514(h) |
| Can they refuse because I owe a bill? | No. HHS says a provider may not withhold or deny access because you have not paid for health care services | HHS access guidance (FAQ) |
| Can a family member ask? | A personal representative, generally someone with authority under state law to make health care decisions for you, has the right of access within the scope of that authority. You can also direct the provider in a signed written request to send an electronic copy of your electronic health record to a family member | HHS access guidance; 45 CFR 164.502(g) and 164.524(c)(3)(ii); HHS Ciox court-order notice |
These are the federal outer limits. HHS calls 30 days an outer limit and encourages providers to respond as soon as possible, and it says state laws that give you a shorter deadline, a free copy or lower fees still apply. Every row below comes from HHS's right-of-access guidance and FAQs.
On fees, HHS says providers should give individuals copies free of charge, but the rule permits a limited, reasonable, cost-based fee. The flat fee of up to $6.50 is one option a provider may choose for electronic copies of records it keeps electronically; HHS's 2016 clarification says it is not a cap on all fees, because a provider may instead charge its actual or average allowable costs. Whichever method it uses, it must tell you the approximate fee in advance.
| Rule | What HHS says | Citation |
|---|---|---|
| Deadline | The provider must act on your request no later than 30 calendar days after receiving it | HHS access guidance; 45 CFR 164.524(b)(2) |
| Extension | One extension of no more than 30 more days is allowed, only if, within the first 30 days, the provider tells you in writing the reasons for the delay and the date it will act | HHS access guidance; 45 CFR 164.524(b)(2) |
| What a fee may include | Only labor for copying, supplies for paper copies or portable media you ask for, postage if you ask for mail, and preparing a summary or explanation if you agreed to one and its fee in advance | HHS access guidance; 45 CFR 164.524(c)(4) |
| What a fee may not include | Costs of verification, documentation, searching for and retrieving records, maintaining systems, or other costs not listed above, even if state law authorizes them | HHS access guidance |
| Per-page fees | Not permitted for paper or electronic copies of records the provider keeps electronically | HHS access guidance (FAQ on calculating fees) |
| Flat-fee option | A provider may charge a flat fee for electronic copies of records it keeps electronically, not to exceed $6.50 including labor, supplies and postage; this is an option, not a cap on all fees | HHS access guidance (FAQ); HHS clarification, May 23, 2016 |
| Advance notice | The provider must tell you the approximate fee in advance; HHS says it should post an approximate fee schedule and give you a breakdown of the charges if you ask | HHS access guidance (FAQ) |
| Looking, not copying | No fee may be charged if you only inspect your records, including if you take notes or photograph them with your own phone; the provider may set reasonable rules for using your own device | HHS access guidance (FAQ) |
| Partial denial | If part of a request is denied, the provider must, to the extent possible, still give you the rest, and must send a written denial within the same 30 days (60 with an extension) | HHS access guidance; 45 CFR 164.524(b)(2) and (d) |
A clear written request avoids the most common delays: the wrong records, the wrong format or a surprise fee. Our free Medical-records request letter (HIPAA right of access), available as a Word (.docx) file you can edit and as a printable PDF, has a space and a check box for each item below. You can also use the provider's own form if it has one, as long as it asks for the same things.
Send it the way the provider accepts requests (its records email, fax, portal message or mail), keep a copy, and write down the date it was received; HHS says the 30-day clock starts when the provider receives your request. If you do not hear back, follow up in writing and refer to that date.
| Include | Why |
|---|---|
| Your full name, any former names, date of birth, address, phone and email | So the records office can find the right record and verify your identity |
| That you are requesting access under the HIPAA right of access, 45 CFR 164.524 | Makes clear this is your own access request; HHS says a HIPAA authorization (release form) is not required to request access |
| Which records: the complete designated record set, or named items and a date range | Visit notes, lab results, imaging reports and images, medication lists and billing records are separate in many systems |
| The electronic format you want, with a fallback | The provider must use your format if readily producible, or an agreed readable electronic format |
| How to deliver it: secure email, download link, portal, or mail on a USB drive or CD | HHS says mail and email are generally readily producible, and a provider may not make you pick up a copy in person |
| Whether you accept unencrypted email if secure delivery is not possible | You have a right to unencrypted email after the provider warns you of the risk; it is your choice |
| A request for the approximate fee in advance, and the amount you approve without being contacted | The provider must tell you the approximate fee in advance |
| The 30-day deadline and the written-denial requirement | Sets expectations and asks for a written explanation if anything is withheld |
| Your signature and the date | HHS says a provider may require a written request; a signature helps it act on and verify it |
Download the free letter: Medical-records request letter (Word, .docx) · Medical-records request letter (PDF). It is general information, not legal advice.
If the provider keeps your records electronically and you ask for an electronic copy, HHS says it must give you the copy in the electronic form and format you ask for if it is readily producible, or otherwise in a readable electronic format you both agree on. HHS lists examples you can ask for: Microsoft Word, Microsoft Excel, PDF, or structured, machine-readable data such as a Consolidated Clinical Document Architecture (C-CDA) document. A provider may give you paper only if you turn down every electronic format it can readily produce. Records kept only on paper must be scanned for you if the provider can readily do so.
A practical request is a PDF of everything, plus a machine-readable file if the provider can produce one. The PDF is the copy you can read, print and keep; a machine-readable file is useful for apps and other providers. If you plan to use PatientPower, ask for a PDF as well: PatientPower can read a PDF or a photo of a document, but it does not import structured record files such as FHIR, Blue Button, C-CDA or CSV.
Images such as X-rays and MRIs are part of your right of access. HHS notes that large image files may not fit in an email, in which case the provider should offer another way, such as portable media that can be mailed to you; the provider may decline to plug in a USB drive you bring, based on its security risk analysis, but may not require you to buy one from it.
You can also ask a provider to send a copy straight to another person or organization, such as a new doctor or an app. HHS says this request must be in writing, signed by you, and clearly identify the recipient and where to send the records. After the federal court decision in Ciox Health v. Azar (January 2020), HHS says this third-party directive under the right of access applies only to an electronic copy of records in an electronic health record, sent in electronic format, and that the HIPAA fee limits apply only when you request your own records, not when you direct them to a third party.
If you want the federal fee limits and the widest choice of records and formats, ask for the copy to be sent to you, then share it yourself. If what you want is for your treating providers to share your records with each other, HHS says they can and should do so for treatment without you having to file an access request.
Once the records arrive, keep the original files somewhere secure, and keep the whole folder if you received a ZIP. Then add them to one place. PatientPower, an independent app at beyondmychart.com, lets you type in records from a provider that is not on MyChart, with an AI that can read a PDF or a photo of a paper document to help, so they can sit next to your MyChart records.
For health systems that use Epic MyChart, you can connect your account directly: PatientPower's Epic MyChart connection is live, approved for use on 16 September 2026, and you connect by signing in on your health system's own MyChart page. That approval does not mean Epic endorses PatientPower. A connection brings in the categories you approve, not necessarily your complete record, so you may still want a written request for imaging, billing or older records. See How to download your MyChart records for the MyChart side, and How to organize MyChart records from multiple providers for putting everything together.
Read any app's privacy policy before you add health records. PatientPower's privacy policy says it never sells your health information and never uses it for advertising, and that you can export your data or ask for it to be deleted. PatientPower is for education and organization; it does not give medical advice, and this page is general information, not legal advice.
If 30 days pass with no records and no written extension notice, follow up in writing and cite the date your request was received. If the fee looks wrong, ask for the breakdown of labor, supplies and postage, which HHS says providers should give you on request, and point to the limits above.
A denial must come in writing, in plain language, within the same deadline. HHS says it must explain the reason, whether you can have it reviewed and how, and how to complain to the provider or to the HHS Office for Civil Rights (OCR). If the provider does not have the records but knows who does, it must tell you where to send your request. Some denials, such as one based on a licensed professional's judgment that access is reasonably likely to endanger someone's life or physical safety, can be reviewed by another licensed professional.
You can file a complaint with OCR online through the OCR Complaint Portal, or in writing by mail, fax or email. HHS says a complaint must name the provider, describe what happened, and be filed within 180 days of when you knew about it (OCR may extend this for good cause), and that HIPAA prohibits retaliation for filing. Your state may also give you stronger rights; HHS says those state laws still apply.
Under HHS guidance on 45 CFR 164.524, a provider must act on your request no later than 30 calendar days after receiving it. It may take one extension of up to 30 more days only if, within the first 30 days, it tells you in writing why and when it will act. HHS calls 30 days an outer limit, and a state law with a shorter deadline still applies.
HHS says providers should give copies free, but may charge a reasonable, cost-based fee covering only labor for copying, supplies for a paper copy or portable media you ask for, postage and an agreed summary. Search and retrieval costs are not allowed, per-page fees are not allowed for records kept electronically, and the provider must tell you the approximate fee in advance. A flat fee of up to $6.50 for electronic copies of electronic records is one option, not a cap on all fees. These limits apply when the copy is for you; HHS says they do not apply when you direct records to a third party.
No. HHS's May 2016 clarification says $6.50 is not the maximum for all requests. It is an optional flat fee for electronic copies of records kept electronically, inclusive of labor, supplies and postage. A provider may instead charge its actual or average allowable costs, within the limits of 45 CFR 164.524(c)(4), and must tell you the approximate fee in advance.
Usually, yes. If the records are kept electronically and you ask for an electronic copy, HHS says the provider must provide it in the format you request if readily producible, or in an agreed readable electronic format. HHS says email is generally readily producible, and you can choose unencrypted email after the provider warns you of the risk.
No. HHS says a provider may not withhold or deny access because you have not paid your bill for health care services. It also may not require you to explain why you want the records.
A provider may ask you to use its own form, and may require a written request if it tells you so, but HHS says the form may not create a barrier or unreasonably delay access. A letter that gives the same information, like our free template, is a written request.
The HIPAA right of access applies to health plans and most health care providers; HHS's complaint page says OCR can investigate health care providers that conduct certain transactions electronically. If a provider is not covered, ask it directly and check your state's medical records law.
Yes, by typing the information in; PatientPower's AI can read a PDF or a photo of a paper document to help. PatientPower's Epic MyChart connection is live (approved for use on 16 September 2026); you connect through your health system's own MyChart sign-in. PatientPower is an independent app and is not affiliated with or endorsed by Epic.