Pilots for HIMS Reform Logo

How to Request Your Medical Records

A pilot-friendly guide to HIPAA “Right of Access” — including what to request, timelines, fees, and escalation steps if a provider refuses or stalls.
Educational only. This guide is not legal advice and does not create an attorney-client relationship. If your situation is urgent or high-stakes, consider consulting a qualified attorney.
P4HR note: Each person can request their own records. We do not encourage or coordinate harassment, mass-contact campaigns, or any conduct that could be mischaracterized as intimidation. This is about knowing your rights and using professional, lawful steps to enforce them.

Quick navigation

Your core rights under HIPAA (high level)

Under the HIPAA Privacy Rule (45 C.F.R. § 164.524), individuals generally have the right to inspect and obtain a copy of their protected health information (PHI) maintained by a covered provider in a designated record set. This can include more than “the chart” — often including billing and payment records as well.

Timeline rule (30 days, calendar days): Providers generally must act on an access request within 30 calendar days. If they need an extension, they must send a written notice within the first 30 days explaining the delay and stating a completion date. In most cases, the extension means a total timeframe of no later than 60 calendar days from the original request.
No “pay first” gatekeeping: HIPAA does not allow a provider to withhold or deny access to your PHI because of an unpaid bill.
Format matters: If records are maintained electronically, request an electronic copy (e.g., PDF) and ask for delivery by secure portal, secure email, or another reasonable method.

What to request (use this checklist)

When you ask for records, be specific. Many disputes happen because pilots request “my records” and offices respond with a partial printout — or claim they “already sent everything.”

A) Clinical records

  • Provider notes, evaluation reports, letters, summaries, addenda
  • Test results and supporting documentation (including scoring sheets where applicable)
  • Any documents used to make decisions about you (when maintained as part of the designated record set)

B) Billing + payment records

  • CPT codes and ICD-10 codes billed
  • Itemized invoices/statements
  • Dates and amounts of payments received, adjustments, write-offs (as applicable)

Step-by-step: the clean process

  1. Send a written request. Email or secure-portal messaging is typically fine. Keep it professional. Include your full name, DOB, date(s) of service, and (if you have it) your patient ID/MRN. Request both clinical and billing/payment records.
  2. Start a simple timeline log. Note the date/time you sent the request, any responses, and names/titles of staff you spoke with.
  3. Follow up before Day 30 if you hear nothing. A short follow-up is often enough to get traction.
  4. If they stall or refuse, request a written position. If they claim something “cannot be released,” ask for a written denial citing the legal basis and describing complaint options.
  5. If needed, escalate to HHS OCR. Keep your request/responses organized. OCR can sometimes resolve access issues through technical assistance or voluntary compliance, and in other situations may initiate a formal investigation.

Fees and common “gotchas”

  • Fees must be reasonable and cost-based. Ask for an advance estimate.
  • Watch for “search/retrieval” charges. Those are often not permitted for HIPAA access requests.
  • Ask for an electronic copy (PDF) if maintained electronically. This is usually fastest and easiest to store.
  • Optional flat-fee note: Some providers use a flat fee option for electronic copies of records maintained electronically (often referenced as not to exceed $6.50) — but this is not a universal cap for every situation.
  • Don’t accept “we already sent it to the FAA/another doctor” as an answer. You’re requesting your own copy.

What to do if they refuse or delay

If the provider does not comply, your goal is simple: create a clear paper trail showing (1) a proper request, (2) the timeline, and (3) the provider’s failure to provide timely access or a valid written denial.

What an HHS OCR complaint is (and when to file one)

HHS OCR stands for the U.S. Department of Health & Human Services’ Office for Civil Rights. OCR is the federal office that accepts and reviews complaints involving potential violations of the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule — including access problems like refusing to provide records, failing to provide timely access, or imposing improper limits/fees.

What OCR can do (high level):
  • Review your complaint to determine whether it falls under HIPAA and whether the provider/entity is covered.
  • Seek voluntary compliance and/or provide technical assistance to resolve access issues.
  • In some situations, open a formal investigation and require corrective action.
Timing matters: OCR generally expects HIPAA complaints to be filed within 180 days of when you knew the act/omission occurred. If you’re close to that window, don’t delay.

Official government links:

P4HR tip: Before you file, assemble your “evidence packet” as PDFs: (1) your request, (2) provider responses, (3) fee demands, (4) a simple timeline log, and (5) anything showing delay past the 30-day window.

Copy/paste templates

Use these as starting points. Replace the bracketed placeholders.

Template 1 — Initial request

Subject: Request for copies of my records (HIPAA Right of Access)

Hello [Office/Records Department],

I’m requesting copies of my records for [date(s) of service]. Please include both clinical records and billing/payment records.

Requested records:
1) Clinical records (notes/reports/results, evaluations, and any addenda)
2) Billing and payment records (CPT/ICD codes, itemized statements/invoices, and payments/adjustments)

Format & delivery:
Records are maintained electronically (to the best of my knowledge). Please provide an electronic copy in PDF via [secure portal/secure email/mail].

If you intend to charge a fee, please provide an advance estimate and confirm it is limited to a reasonable, cost-based fee.

Thank you,
[Full Legal Name]
DOB: [MM/DD/YYYY]
Patient ID / MRN (if known): [__________]
Date(s) of service: [__________]
Phone: [ ]
Email: [ ]

Template 2 — Follow-up (firm, professional)

Subject: Follow-up: records request — 45 C.F.R. § 164.524 (Right of Access)

Hello [Office/Dr. Last Name],

Following up on my records request dated [date sent].

Under HIPAA (45 C.F.R. § 164.524), I am requesting copies of my PHI maintained in the designated record set, including both clinical and billing/payment records related to my visit(s) on [date(s) of service].

Requested records:
- Clinical records (notes/reports/results, evaluations, and any addenda)
- Billing/payment records (CPT/ICD codes, invoices/statements, payments/adjustments)

Format & delivery:
Please provide an electronic copy in PDF via [secure portal/secure email/mail].

Timeline:
HIPAA generally requires action within 30 calendar days. If an extension is needed, a written extension notice must be provided within the first 30 days stating the reason for delay and the completion date (often no later than 60 days total).

Fees:
If you intend to charge a fee, please provide an advance estimate and confirm it is limited to a reasonable, cost-based fee.

If you believe any portion is not releasable:
Please provide a written denial identifying the legal basis and instructions for how to file a complaint.

Thank you,
[Full Legal Name]
DOB: [MM/DD/YYYY]
Patient ID / MRN (if known): [__________]
Date(s) of service: [__________]
Phone: [ ]
Email: [ ]

Template 3 — If they mention an unpaid balance

Subject: Records request — payment is not a condition of access (HIPAA)

Hello [Office/Records Department],

I understand there may be a balance on my account. However, HIPAA does not allow withholding or denying access to my PHI because of an unpaid bill.

Please provide the requested records as soon as possible in PDF via [secure portal/secure email/mail].

Thank you,
[Full Legal Name]
DOB: [MM/DD/YYYY]
Patient ID / MRN (if known): [__________]
Date(s) of service: [__________]
Phone: [ ]
Email: [ ]

Template 4 — Second notice (before an OCR complaint)

Subject: Second notice: overdue access request (45 C.F.R. § 164.524)

Hello [Office/Dr. Last Name],

This is a second notice regarding my records request dated [date sent]. I have not received the requested records or a compliant written extension/denial.

Please respond by [date — e.g., 5 business days] with either:
1) The requested records (clinical + billing/payment), in PDF via [secure portal/secure email/mail], or
2) A written denial identifying the legal basis for withholding any portion and instructions for how to file a complaint.

If I do not receive a compliant response, I intend to file a complaint with HHS OCR.

Sincerely,
[Full Legal Name]
DOB: [MM/DD/YYYY]
Patient ID / MRN (if known): [__________]
Date(s) of service: [__________]
Phone: [ ]
Email: [ ]

Downloadable examples (for Toolkit)

Add these to your “Legal Templates & Forms” section as PDFs (recommended). Suggested file names are included. Update the href paths to match your site’s folder structure (e.g., /files/).

Pro tip: Keep everything in one place — your request email, the provider’s responses, your timeline log, and any invoices/fee demands. If you ever need to escalate, organization wins.