Records and paperwork

How to request your medical records: hospitals, specialists, home health, and more

If you are trying to pull records for yourself or a loved one, the hardest part is usually not "whether you have a right". You do. The hard part is knowing exactly who to ask, what to request, what timeline applies, and what to do when an office stalls. This guide gives you a practical, step-by-step process.

This is general U.S. information, not legal advice. Rules vary by state and by organization type.

Last verified: February 26, 2026 (HIPAA federal rules, VA workflows/forms, and a 50-state medical-records-law survey reviewed).^{1, 10, 11, 13}

Quick-start checklist

List every source you need: hospital, specialist, PCP, home health agency, rehab/SNF, imaging center, lab, and insurer claims portal.
Decide your date range and scope before requesting (for example: last 24 months, all visit notes, labs, imaging reports, and discharge summaries).
Submit requests to each source's Health Information Management (HIM) or Medical Records office, not only to the front desk.
Ask for delivery format up front (PDF by secure portal/email, paper, CD/USB for large imaging files, or direct transfer to another provider).
Track each request date. Under HIPAA, response is generally due within 30 calendar days, with one allowed extension of up to 30 more days if they notify you in writing.¹
If records are incomplete or delayed, escalate to the provider's Privacy Officer, then file an OCR complaint if needed.²

Want a faster start? Use the Medical Records Request Email Builder to generate a tailored request email and attachment checklist.

What healthcare organizations are legally required to respond?

HIPAA access rights apply to covered entities: health plans, healthcare clearinghouses, and healthcare providers that conduct standard electronic transactions (this includes most hospitals, clinics, specialists, nursing homes, and pharmacies).³

Usually covered

Hospitals and health systems
Primary care and specialist practices
Home health agencies (especially Medicare-certified HHAs)
Clinical labs and imaging centers
Medicare Advantage and other health plans

May not be covered in every case

Some private-pay non-medical home care agencies
Employers holding workplace records
Life insurers
Apps not acting on behalf of a covered entity

If an organization is not HIPAA-covered, you still may have rights under state law, contract, or organizational policy - but timelines and fees may differ.

Your core HIPAA access rights (practical version)

Timeline and scope

Covered entities generally must act within 30 calendar days.¹
They may take one additional 30-day extension, but must send a written reason and new date within the first 30 days.¹
Your right applies for as long as they maintain the record - there is no federal "older than X years" cutoff for access while records still exist.¹

Format and delivery

You can request records in a specific form and format if readily producible (for example, electronic copy, paper copy, or image file output).⁴
You can direct records to a third party in writing (another provider, family member, attorney, care coordinator).⁴
If you request unencrypted email and accept risk, they generally must accommodate if feasible.¹

Fees

Fees must be reasonable and cost-based for copying/supplies/postage (and summary prep only if you agree).⁴
They generally cannot charge for searching/retrieving records or overhead unrelated to the copy itself.¹

What can be excluded

Psychotherapy notes kept separately can be excluded.¹
Information prepared for legal proceedings can be excluded.¹
Some requests can be denied on limited legal grounds, but denials must be in writing and explain next steps.⁴

Do imaging files, old records, and home health records count?

Usually yes. HIPAA access includes a broad designated record set, and HHS guidance explicitly includes items such as lab reports and medical images (for example, X-rays), as long as they are maintained in the record set used to make decisions.¹

Hospitals

Medicare-participating hospitals must retain medical records for at least 5 years in original or legally reproduced form; state law may require longer.⁵

Home health agencies

Medicare-certified HHAs must retain records for 5 years after discharge (or longer if state law is longer). They also have specific retrieval obligations for patient requests.⁶

Practical takeaway: there is no universal "older than 7 years" rule across all organizations. Ask anyway. If records are outside retention windows, request written confirmation that records no longer exist.

How to request records on behalf of a loved one

If the person is competent, the fastest route is usually a signed HIPAA authorization plus ID verification. If they lack capacity or are deceased, organizations often require legal representative documentation under state law.⁷

Have these ready before you submit

Patient full name, DOB, address, and phone
Date range and record types requested
Your government ID
Signed HIPAA authorization (provider-specific if required)
Healthcare POA or guardianship paperwork (if acting as personal representative)
For deceased patients: executor/administrator paperwork and death documentation, if requested

Language that reduces back-and-forth

"Please process this as a HIPAA right-of-access request under 45 CFR 164.524."
"Please provide all records in your designated record set for the requested period."
"If any portion is denied, please send a written denial with legal basis and review rights."
"If records no longer exist, please confirm that in writing."

Common pitfalls (and how to avoid them)

Pitfall 1: Request is too vague

"Send my entire chart" can trigger delays. Define date range, provider, and record classes (notes, labs, imaging reports, medication history, discharge paperwork).

Pitfall 2: You asked the wrong office

Front desk teams often cannot process formal release requests. Send directly to Medical Records/HIM or the privacy office portal.

Pitfall 3: Signature mismatch or missing authority

Most stalls are identity/authority checks. Make names, addresses, signatures, and supporting legal docs consistent across all forms.

Pitfall 4: Format confusion

Ask for both reports and imaging files when needed. A PDF radiology report is not the same as DICOM image data.

Pitfall 5: No tracking system

Track request date, method, confirmation number, and due date. Follow up in writing around day 20-25.

Pitfall 6: You accept incomplete records without challenge

Compare what you received against your request list. If key items are missing, send a written deficiency list and request completion.

If you're managing requests across multiple organizations — particularly for a loved one — the tracking burden alone can stall the process. With the Averyn Record Vault, a navigator identifies every record source, submits all the requests on your behalf, follows up when providers are slow, and organizes everything that comes back into one structured, portable bundle. You don't track anything — your navigator does.

What format and volume should you expect?

For medically complex, Medicare-age patients, records are often large and fragmented. Expect multiple file types and a high page count across organizations.

Common formats

PDF chart exports (visit notes, summaries, reports)
Portal downloads (ZIP + PDFs)
CCD/C-CDA continuity documents
DICOM image files on CD/USB or image-share link
Paper packets for older systems

Planning-level volume expectations

Routine outpatient, multi-specialist (1-2 years): often hundreds of pages
One or more hospitalizations with detailed inpatient notes: often 1,000+ pages
Home health episode documentation: dozens to hundreds of pages per episode
Imaging data: much larger file sizes than reports; expect separate delivery

Treat this as logistics planning, not a legal limit. Start with a priority set (last 12-24 months, major diagnoses, meds, allergies, recent imaging) before requesting every historical document ever created.

For families dealing with this volume across multiple providers, some prefer to hand the entire process to someone else. The Averyn Record Vault is a one-time engagement where a navigator handles every step described in this guide — submitting requests to every provider, pursuing digital and mail/fax retrieval, organizing the records as they arrive, and delivering a plain-English summary your whole household can actually use.

50-state nuance snapshot: what changes your request package vs what is guide-only

Most states do not require a special state-specific attachment for a basic adult self-request. In practice, the request package usually changes only in a few scenarios. Use this snapshot as an operational guide and verify local policy when submitting.

Wizard branches (changes wording/docs)

Colorado: Include explicit "office notes" language and ask for electronic format when readily producible.⁸
California imaging transfer scenario: If needed, ask to transfer original radiographic materials to another provider (include receiving provider details).⁹
VA (federal, not state): Use VA Release of Information workflow and attach VA form 10-5345a (self) or 10-5345 (third-party disclosure).^{10, 11}

Guide-only monitoring (usually no extra attachment)

California: State timelines/fee structure can be more specific than HIPAA baseline.⁹
New York: Inspection/copy timing and paper fee cap are state-defined.¹²
All states: Keep HIPAA baseline rights as default and layer state nuances for fees/timelines/representative status.

All 50 states (operational grouping)

We reviewed all 50 states in a dedicated state-law survey and then mapped each state to one of two implementation categories: package-changing branch vs baseline package.¹³

State	Wizard impact	Implementation note
Alabama	No branch	Baseline package; track state timing/fee details.
Alaska	No branch	Baseline package; track state timing/fee details.
Arizona	No branch	Baseline package; track state timing/fee details.
Arkansas	No branch	Baseline package; track state timing/fee details.
California	Conditional branch	Branch only for imaging-transfer workflows; otherwise baseline package with CA timing/fee awareness.
Colorado	Branch	Use explicit office-notes and electronic-format language.
Connecticut	No branch	Baseline package; track state timing/fee details.
Delaware	No branch	Baseline package; track state timing/fee details.
Florida	No branch	Baseline package; track state timing/fee details.
Georgia	No branch	Baseline package; track state timing/fee details.
Hawaii	No branch	Baseline package; track state timing/fee details.
Idaho	No branch	Baseline package; track state timing/fee details.
Illinois	No branch	Baseline package; track state timing/fee details.
Indiana	No branch	Baseline package; track state timing/fee details.
Iowa	No branch	Baseline package; track state timing/fee details.
Kansas	No branch	Baseline package; track state timing/fee details.
Kentucky	No branch	Baseline package; track state timing/fee details.
Louisiana	No branch	Baseline package; track state timing/fee details.
Maine	No branch	Baseline package; track state timing/fee details.
Maryland	No branch	Baseline package; track state timing/fee details.
Massachusetts	No branch	Baseline package; track state timing/fee details.
Michigan	No branch	Baseline package; track state timing/fee details.
Minnesota	No branch	Baseline package; track state timing/fee details.
Mississippi	No branch	Baseline package; track state timing/fee details.
Missouri	No branch	Baseline package; track state timing/fee details.
Montana	No branch	Baseline package; track state timing/fee details.
Nebraska	No branch	Baseline package; track state timing/fee details.
Nevada	No branch	Baseline package; track state timing/fee details.
New Hampshire	No branch	Baseline package; track state timing/fee details.
New Jersey	No branch	Baseline package; track state timing/fee details.
New Mexico	No branch	Baseline package; track state timing/fee details.
New York	No branch	Baseline package; track NY timing/fee caps for follow-up/escalation.
North Carolina	No branch	Baseline package; track state timing/fee details.
North Dakota	No branch	Baseline package; track state timing/fee details.
Ohio	No branch	Baseline package; track state timing/fee details.
Oklahoma	No branch	Baseline package; track state timing/fee details.
Oregon	No branch	Baseline package; track state timing/fee details.
Pennsylvania	No branch	Baseline package; track state timing/fee details.
Rhode Island	No branch	Baseline package; track state timing/fee details.
South Carolina	No branch	Baseline package; track state timing/fee details.
South Dakota	No branch	Baseline package; track state timing/fee details.
Tennessee	No branch	Baseline package; track state timing/fee details.
Texas	No branch	Baseline package; track state timing/fee details.
Utah	No branch	Baseline package; track state timing/fee details.
Vermont	No branch	Baseline package; track state timing/fee details.
Virginia	No branch	Baseline package; track state timing/fee details.
Washington	No branch	Baseline package; track state timing/fee details.
West Virginia	No branch	Baseline package; track state timing/fee details.
Wisconsin	No branch	Baseline package; track state timing/fee details.
Wyoming	No branch	Baseline package; track state timing/fee details.

Why this split: many states have important fee/timing nuances that matter for expectation-setting, but do not require a different attachment packet for common self-requests. We branch only where wording/docs often change the outcome.

VA is handled as a separate federal workflow, not a state-law branch.^{10, 11}

If a provider does not respond

Send a written follow-up that cites your original request date and HIPAA right of access timeline.
Escalate to the provider's Privacy Officer and request written status.
If unresolved, file a complaint with HHS OCR (generally within 180 days of when you knew of the issue).²

Keep copies of every form, email, fax confirmation, and upload receipt. Documentation matters if you need escalation.

This follow-up cadence is exactly the kind of work that stalls when you're also managing appointments, medications, and daily care logistics. An Averyn navigator handles the entire request-and-chase cycle — sending the follow-ups, escalating to privacy officers, and documenting every step — so the records actually arrive. If requests keep slipping to the bottom of your list, a short conversation can help you figure out whether that support makes sense.

Ready to start requesting?

Use our questionnaire-based builder to choose destination, scope, format, and authorization details, then generate a ready-to-send request email. Or, with authorization and at your direction, Averyn can help organize request lists, submit release paperwork, track deadlines, and consolidate what comes back.

Open the email builder See Record Vault Start here

Averyn is non-clinical administrative coordination; medical decisions remain with licensed clinicians.

Sources

U.S. Department of Health and Human Services (HHS), Office for Civil Rights. "Individuals' Right under HIPAA to Access their Health Information (45 CFR 164.524)." hhs.gov
HHS OCR. "How to File a Health Information Privacy or Security Complaint." hhs.gov
45 CFR 160.103 (Definitions: Covered Entity). ecfr.gov
45 CFR 164.524 (Access of individuals to protected health information). ecfr.gov
42 CFR 482.24 (Hospital medical record retention requirement). ecfr.gov
42 CFR 484.110 (Home health clinical record retention and retrieval). ecfr.gov
HHS OCR. "Personal Representatives" (45 CFR 164.502(g)). hhs.gov
Colorado Revised Statutes, Title 25, Article 1, Part 8 (Patient Records). olls.colorado.gov
California Health & Safety Code 123110 (patient access to records, timelines, imaging transfer provisions). leginfo.legislature.ca.gov
U.S. Department of Veterans Affairs. "Get your VA medical records online." va.gov
U.S. Department of Veterans Affairs. VA Form 10-5345 (Request for and Authorization to Release Health Information). va.gov
New York Public Health Law 18 (Access to patient information). nysenate.gov
Triage Cancer. "State Laws: Medical Records" (50-state survey and state-specific statutory references). triagecancer.org

Related guides

Records readiness Portal access and proxy setup Averyn Record Vault Support options

Are you a professional caregiver? See tools and guides for private-duty caregivers