In the United States, you can generally ask a HIPAA-covered health care provider or health plan to let you inspect or copy your medical and billing records, and you can request an amendment to information you believe is inaccurate or incomplete. Start by contacting the organization’s medical-records or privacy office, make your request in writing if possible, and keep a copy and proof of when it was received.
These federal rights apply to covered providers and health plans, not necessarily every organization that holds health information. State law may provide additional protections or affect the process.
First, decide whether you need a copy or a correction
An access request gets existing records. An amendment request asks the provider or plan to change information you believe is inaccurate or incomplete. You can make both requests, but they serve different purposes and have different response timelines.
| Request | What it does | General HIPAA response period | What to expect |
|---|---|---|---|
| Access | Lets you inspect or obtain copies of information in a designated record set, which can include medical and billing information. | Generally 30 days; in some circumstances, up to 60 days, with one additional 30-day extension if the organization gives written reasons and an expected delivery date. | Copies or an opportunity to inspect existing information. An access request does not itself change the record. |
| Amendment | Asks the provider or plan to amend information you believe is inaccurate or incomplete. | Generally 60 days, with a possible additional 30 days if the organization provides a reason. | The organization must respond, but it may deny a request in circumstances allowed by HIPAA. A denial does not erase the original entry. |
HIPAA access generally covers protected health information in a covered entity’s designated record sets, not only the main clinical chart. For a plain-language overview of both rights, see HHS’s Your Medical Records page.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
How to request a copy of your records
- Find the right contact. Contact the provider’s medical-records or health-information-management office, or its privacy office. For insurance records, contact the health plan’s privacy contact. Ask which submission methods it accepts and whether it has a request form; there is no single HIPAA form or office name required nationwide.
- Describe exactly what you want. Identify yourself and the provider or plan, the records or types of records you want, and the date range if you know it. You can request paper or electronic copies, and can ask that the copy be sent to a recipient you designate. You generally do not have to explain why you want the records.
- Specify a practical delivery format and destination. If information is maintained electronically, you may request a readily producible electronic format. If the exact format is not readily producible, the organization can provide a readable electronic alternative agreed with you. Ask where the copy should be sent and include a reliable contact method in case the office needs clarification.
- Submit it using an accepted channel and save proof. A covered entity may require a written request if it has informed patients of that requirement. It may use its own form, but its process cannot create an unreasonable barrier or delay. Follow the organization’s instructions for its accepted portal, email, mail, or in-person process; do not assume every office accepts every channel. Keep a copy of the request and any submission confirmation.
- Complete reasonable identity verification. The organization must take reasonable steps to verify your identity. Respond to a legitimate verification request, while keeping a record of what you sent and when.
Your request can include paper, electronic, older, or archived records if they are still maintained by or for the covered entity. HHS explains the access right, format rules, designated recipients, and request-process limits in its guidance on individuals’ right to access health information.
Deadlines, fees, and records HIPAA may not provide
When access is due
Access is generally due within 30 days. If the information is not maintained or accessible on-site, the organization may have up to 60 days. It may take one additional 30-day extension only if it gives you a written explanation of the delay and an expected completion date.
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
What you may be charged
Under HIPAA, an organization cannot charge you for searching for or retrieving your records. It may charge a reasonable fee for copying and mailing. State law may provide stronger protections, so check the rules that apply where you live. A provider cannot deny access because you owe money for care.
Psychotherapy notes are a distinct category
Do not confuse ordinary mental-health records with psychotherapy notes. HHS describes psychotherapy notes as a mental health professional’s separately maintained notes from conversations; patients generally do not have a HIPAA right to access those notes, even though other mental-health information may be part of the accessible record.
How to request an amendment to an error
- Identify the specific entry. Give the date, document, or section where the information appears, and describe what you believe is inaccurate or incomplete.
- Explain the correction you are seeking. State the accurate information or the context you want added. For example, distinguish a mistaken medication dose from a disagreement about a clinician’s judgment; the request should make clear what factual change or added context you are asking for.
- Send the request to the entity that maintains the information. Follow that provider’s or plan’s published amendment process, and retain a copy and proof of submission. HIPAA does not require one universal amendment-request template.
- Wait for a response and preserve it. The organization must respond to your request. Most amendment requests should be handled within 60 days; it may take one additional 30-day extension if it gives a reason.
An amendment is not a guarantee that the original entry will disappear. If the provider or plan denies your request, you can submit a statement of disagreement for the record. That preserves your perspective alongside the disputed information. As HHS ONC explains, “If you and your health provider or health plan do not agree that an amendment is necessary, you still have the right to have your disagreement noted in your record.” See Your Health Information Rights.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do if the request is delayed or denied
- Follow up in writing. Restate when and how you submitted the request, identify whether it is an access or amendment request, and ask for its status and expected completion date. Keep the follow-up with your original request and any replies.
- Use the organization’s complaint process. Contact the provider’s or insurer’s complaint or privacy office if you cannot exercise your rights or need to challenge how the request was handled.
- Consider an external complaint. HHS ONC identifies complaints to the provider or insurer, the U.S. Department of Health and Human Services Office for Civil Rights (OCR), or a state attorney general as possible routes. Check the current instructions and any state-specific rules before filing.
ONC’s guide also lays out a practical sequence for getting, checking, and using health records: Patient Access Information for Individuals.
Quick Recap
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
