Medical Records: What's Inside Them, Who Legally Owns Them, and How to Get Your Copy

Your medical records contain much more than a list of diagnoses. They can include your visit notes, test results, imaging reports, prescriptions, treatment history, and other information that helps tell the story of your care.

Knowing what is in your medical records, who controls the records, and how to get a copy can make it easier to switch doctors, prepare for a specialist visit, deal with insurance or disability paperwork, or simply keep track of your own health information.

TL;DR: Key Takeaways

• Medical records can include visit notes, diagnoses, lab results, imaging reports, prescription history, and other information related to your care.
• Healthcare providers and organizations generally maintain and control the physical or electronic record, while you have important rights to access the health information in it.
• Under HIPAA, you generally have the right to inspect and receive copies of your protected health information.
• A covered healthcare provider generally must respond to an access request within 30 days, although an extension may be available in certain circumstances.
• Many healthcare organizations now provide electronic access through patient portals.
• Providers may be allowed to charge reasonable, cost-based fees for certain copies, but they generally cannot deny access simply because you have an unpaid medical bill.
• Your medical information generally cannot be shared without authorization except when an exception under privacy law applies, such as treatment, payment, healthcare operations, or certain public health purposes.
• If you believe information in your record is incorrect or incomplete, you generally have the right to request an amendment.

Need help deciding whether a health concern needs medical attention? Try August AI's free symptom assessment.

What Are Medical Records?

Medical records are the collection of information healthcare providers create or maintain about your care.

Depending on where you receive treatment, your records may include:

• Doctor and nursing notes
• Diagnoses and medical history
• Laboratory results
• Imaging reports, such as X-rays, CT scans, or MRIs
• Medication and prescription history
• Treatment plans
• Allergy information
• Immunization records
• Referrals and specialist reports
• Procedure notes
• Discharge summaries
• Information you provide during appointments

Your medical record may be spread across several healthcare organizations. For example, your primary care provider may have one set of records while a hospital, specialist, imaging center, or laboratory has additional information.

That can make it useful to know how to request records from different providers, especially if you are changing doctors or trying to reconstruct older medical history.

If you need to request records from a hospital specifically, see our guide on Medical Records Request Form Templates and How to Use Them.

Who Owns Your Medical Records?

The question of who "owns" your medical records is more complicated than it sounds.

Healthcare providers and organizations generally maintain and control the medical record itself. That can include the physical chart or the electronic system where the record is stored.

At the same time, you have rights to access the health information contained in your record.

In other words, the healthcare organization may maintain the record, but that does not mean you lose control over your ability to obtain and use information about your own care.

This distinction matters when you want to get a copy of your records. You usually do not need to prove that you own the physical file. Instead, you exercise your right to access the protected health information maintained by the covered entity.

Rules can vary depending on the type of information and the organization holding it, so particularly sensitive records may have additional requirements.

HIPAA and Your Rights to Your Medical Records

The Health Insurance Portability and Accountability Act, commonly known as HIPAA, gives individuals important rights regarding their protected health information.

One of those rights is the ability to access and receive copies of certain health information maintained by covered healthcare providers and health plans.

You can generally request access to records such as:

• Medical histories
• Test results
• Billing information
• Clinical notes
• Medication information
• Imaging information
• Other protected health information maintained by the covered entity

The U.S. Department of Health and Human Services provides information about these rights through its HIPAA guidance for individuals.

How long does a provider have to respond?

Under HIPAA's access rules, a covered entity generally must act on an access request within 30 days.

In certain circumstances, the organization may be able to extend the response period by another 30 days. If an extension is needed, the organization generally must provide a written explanation.

The exact process can vary depending on the type of record and the organization involved.

Can a provider refuse to give you your records because you owe money?

Generally, an unpaid medical bill does not by itself eliminate your HIPAA right to access your protected health information.

A provider may be able to charge certain reasonable, cost-based fees for copies, depending on the circumstances. However, access rights and outstanding billing are separate issues.

If a provider tells you that you cannot receive your records because you have not paid a medical bill, you may want to ask for the reason in writing and review the applicable access rules.

How to Get a Copy of Your Medical Records

Requesting your records is usually straightforward, although the exact process varies by provider.

1. Identify where your records are stored

Start by making a list of the doctors, hospitals, specialists, laboratories, imaging centers, and other healthcare organizations that may have relevant information.

If you have moved or changed doctors several times, older records may be held by previous providers.

2. Check your patient portal

Before submitting a formal request, sign in to your healthcare organization's patient portal.

You may already be able to download:

• Lab results
• Visit summaries
• Medication lists
• Immunization records
• Imaging reports
• After-visit notes
• Other health information

If the information you need is available online, downloading it may be the quickest option.

3. Find the medical records or health information management department

If the information is not available through your portal, contact the healthcare organization's medical records, health information management, or release-of-information department.

Some organizations provide a specific medical records request form.

4. Submit a written request

Your request should clearly explain what records you want and where you want them sent.

Depending on the provider, you may be able to submit your request online, by mail, by fax, or in person.

A useful request can include:

• Your full name
• Date of birth
• Contact information
• The dates of treatment, if known
• The specific records you are requesting
• The provider or facility holding the records
• Your preferred format, such as electronic or paper
• Where you want the records sent
• Your signature, if required

For a ready-to-use form, see our guide to medical records request form templates and how to use them.

5. Be specific about what you need

You do not always need your entire medical history.

If you only need your most recent laboratory results, for example, you can request those records specifically.

If you are changing doctors and want a complete history, you may want to request a broader set of records.

Being specific can make it easier for the records department to understand your request.

6. Confirm how you will receive the records

Ask whether the records will be delivered through a secure portal, encrypted electronic system, mail, or another method.

If you are requesting electronic records, ask what file format will be provided and whether there are additional steps needed to access the files.

7. Keep a copy of your request

Save your request and any confirmation you receive.

If the provider does not respond within the applicable timeframe, having a record of when you submitted the request can make follow-up easier.

Electronic Access and Patient Portals

Electronic medical records have made it much easier for patients to access some health information without submitting a separate request every time.

Many healthcare organizations now use patient portals where you can review information such as test results, appointment notes, medications, and other parts of your medical record.

The information available through a portal varies by organization.

Your portal may not contain every record the healthcare organization maintains. Some records may need to be requested separately.

Electronic access can also make it easier to keep your health information organized when you see multiple providers.

If you regularly use different healthcare systems, consider downloading important records and keeping them in a secure location.

Who Can Access Your Medical Records?

Your medical information is generally protected by privacy rules, but HIPAA does allow certain uses and disclosures without your separate authorization.

For example, healthcare providers may generally share relevant information for:

• Treatment
• Payment
• Healthcare operations
• Certain public health activities
• Other purposes permitted by law

You can also authorize certain people or organizations to receive your information.

For example, you may choose to have records sent to another doctor who is treating you.

Family members do not automatically have unrestricted access simply because they are related to you. Whether another person can access your records depends on factors such as your authorization, applicable law, and the circumstances involved.

Employment records can also be subject to different rules. If you are concerned about workplace access to health information, see our guide on who should not have access to employee medical records.

How to Organize and Correct Your Medical Records

Getting your records is only part of the process. Keeping them organized can make them much more useful.

Consider maintaining a secure digital folder containing important information such as:

• Current and previous medication lists
• Major diagnoses
• Allergies
• Laboratory results
• Imaging reports
• Specialist notes
• Procedure records
• Immunization records
• Hospital discharge summaries

You may also want to keep a simple timeline of major medical events.

What if something in your record is wrong?

Medical records can contain mistakes, outdated information, or details that you believe are incomplete.

Under HIPAA, you generally have the right to request an amendment to protected health information that you believe is incorrect or incomplete.

A correction request should identify the information you believe is inaccurate and explain what you believe should be changed.

The provider does not necessarily have to agree with every requested change. There are specific rules governing amendment requests and how providers respond to them.

If a provider denies your request, you generally have the right to submit a written statement of disagreement that can be associated with the record.

Conclusion

Your medical records contain important information about your healthcare, and knowing how to access them can make managing your care easier.

Your healthcare provider or organization generally maintains the medical record, but you have important rights to access the health information contained in it. Patient portals may provide immediate access to some records, while a formal medical records request may be necessary for information that is not available online.

If you need your records, start by checking your patient portal and then contact the provider's medical records or health information management department. Be specific about what you need, keep a copy of your request, and follow up if you do not receive a response within the applicable timeframe.

Keeping your own organized copy of important health information can also make future appointments, specialist visits, and changes in care easier to manage.