How to Request Your Health Records

You have the right to all of your medical records. Period. It may seem like healthcare providers try to play keep-away with your healthcare records, but you absolutely should be able to get that information.

DoNotPay is here to help you navigate the process of getting the medical records for you or a family member, quickly and without stress and hassle.

HIPAA Is Confusing

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is designed to keep your medical records private and secure. It's a mandated policy of the federal government (45 CFR § 164.524), so there is no way around HIPAA. Your medical history should be private, so this rule really is for your benefit. The information you can access includes the provider's notes, test results and lab reports, and billing details. You are not entitled to see psychotherapy notes. Also, if there's a lawsuit pending, you can't access information that is part of the suit.

There are three sections to the HIPAA policy:

1. Privacy Rules

These set the standards for your healthcare privacy:

• Patient's rights over their health information, and defines what is protected health information (PHI)
• How different organizations can use and share PHI

The entities that are involved with your PHI and HIPAA would be your health insurance plan, health care clearinghouses (billing services, other middlemen), and your care providers.

2. Security Rule

This defines the parameters for how your PHI is protected, mostly in digital format. While some providers may still keep hard copies of records, the great majority now are electronic (ePHI). The rule covers both providers and their professional associates, like the clearinghouses. They are all legally obligated to protect any information they create, send, or store.

Each organization is also mandated to perform a routine risk analysis of their systems, and develop a risk management plan to mitigate ePHI risks.

3. Breach Notification Rule

Any iePHI information that is disclosed or used without permission is considered a breach of privacy. HIPAA requires the affected agency (doctor's office, lab, insurance carrier) to let you know about the security breach within 60 days. They're also required to alert Health and Human Services  (HHS) and if necessary, the media. That means if more than 500 people are impacted by the breach, both HHS and the organization would have to post it on their websites.

As you can see, the government takes your medical privacy very seriously, and there is a pretty airtight process for proving your identity before you can access your records.

How to Get (Electronic) Copies of Your Medical Records

Every state has different rules for obtaining your medical records, but here's the general process.

Many of the large healthcare providers in the US—the Cleveland Clinic, Mayo Clinic, Mercy Medical, Baptist Medical, Kaiser, and others—have already made your medical records available online. If you have registered with your provider's online portal to make appointments, then you probably already have access to any records that the provider has in their system. If you haven't registered on the provider's portal, this is the information you'll need.

If you want to request the records in writing, you'll need the same info.

• Name
• Date of birth
• Social Security Number
• Street address, phone number, and email address
• List of records you are requesting and dates of service
• Signature—e-signature if you're making the request online

If you're making the request in writing, let the provider know how you want the records delivered to you: hard copy, fax, on a CD, or digitally.

Medical records are never destroyed; if a provider shuts down, they must transfer records to another provider.

Who Can Request Medical Records?

If you've ever had to list the people who could access your medical records, this is why. Parents, guardians, caregivers, or other advocates can request this information. If you're not the parent or guardian, you do have to get written permission from the patient to obtain the records. Your primary care provider also has the right to see your records, as do any interested third parties—insurance companies, hospitals, labs, rehab centers, nursing facilities, and billing companies. Most people don't realize that they sign off on these third parties receiving their records when they register at the clinic or sign patient intake forms. Read what you sign and don't be afraid to ask questions!

Here is who you should contact if you want to request military/veteran medical records:

We've got lots of experience requesting medical records all over the country. States have different rules for making requests, but we have all that data in our system, so we'll make your request correctly. We will write a clear and concise letter to your providers, and you will get your records with no hassle.

How to Request Medical Records Using DoNotPay:

1. Look up medical records on DoNotPay's website. 
2. Enter the name of the health care provider you'd like to receive medical records from. 
3. Answer a few questions about your provider and where you'd like to send the records. 

What Else Can We Help You with?

We are your go-to source when you need help with the release of your records form, drafting letters, protesting medical bills, or even filing a written request for sick leave. Our crackerjack team of AI robots is on hand 24/7 to assist you with whatever you need.

And Other Stuff, Too

We're pretty handy with other things, too. We can help you file in small claims court, get copies of birth certificates, and more. Life shouldn't have to be hard. DoNotPay makes it a little easier.