HIPAA Medical Records Access Request in the U.S.: Rights, Authorization, and Copy Fees
In the United States, a HIPAA medical records access request usually goes to the provider or health plan that holds the records you need. There is no single federal desk that gathers every hospital chart, itemized bill, explanation of benefits (EOB), and claim decision for you. The main practical problems are finding the right record holder, making clear that you want your own copy, and understanding which fee rules apply to your request path.
HIPAA governs access to records held by covered entities, while state law and each organization’s process can affect the details. Certified translation comes later: HIPAA access rights do not require a provider to translate records for you. If a later recipient asks for an English version of a non-English record, translation is a separate step.
Key takeaways
- Request clinical notes, test results, and provider billing records from the provider; request EOBs and claim decisions from the health plan that holds them.
- For your own copy, identify the request as a patient access request. That is different from authorizing a third party to request or receive records.
- A covered entity generally has 30 calendar days to act, with one possible extension of up to 30 additional calendar days if it gives written notice within the first period. An ROI contractor does not give the covered entity a new start date.
- The patient-copy fee rules are limited, but $6.50 is not a universal federal maximum. Direct transmission to a third party has a different federal fee treatment after the Ciox court order.
Who this guide is for
This guide is for patients and people acting as a patient’s authorized personal representative anywhere in the United States who need medical, billing, or health-plan records for insurance paperwork, reimbursement, an appeal, continuing care, or personal files. English–Spanish is a common language pair readers may encounter. The 2024 American Community Survey estimated that 44,867,699 people age five and older spoke Spanish at home; that is general language context, not a measure of HIPAA requests, limited English proficiency, or translation demand. See the U.S. Census Bureau 2024 ACS language table. Typical files include clinical notes, discharge summaries, lab or imaging reports, itemized bills, EOBs, claim decisions, and denial letters.
It is especially useful if a clinic hands you a form that appears to authorize someone else, if a request is sent to the wrong organization, if a copy bill includes a search fee, or if a provider says it needs more time but has not sent written notice. It is a general guide, not legal advice or a determination of whether an insurer must pay a claim.
First identify who holds the records
A request to one organization does not necessarily retrieve records held by another. HIPAA’s designated record set can include medical and billing records, as well as records used by a health plan to make decisions about enrollment, payment, or claims. The federal rule is in 45 CFR § 164.524.
| Records you need | Likely record holder | How to describe the request |
|---|---|---|
| Visit notes, discharge summary, procedure report, lab or imaging results | Hospital, clinic, physician, laboratory, or imaging provider that maintains the record | Name the document type and the visit or date range. If you need the image itself, say so; a radiology report and image file are different items. |
| Itemized charges, payment ledger, or provider billing records | The provider or billing entity that maintains those records | Request the itemized bill and payment history separately from clinical notes if both are needed. |
| EOB, claim status, payment record, or denial letter | Your health plan or insurer | Give the member or claim number and the service dates. A hospital usually cannot produce the insurer’s own claim decision. |
There is no HIPAA portal that retrieves all of these records from every organization. Check the provider’s Notice of Privacy Practices for its Health Information Management (HIM), Release of Information (ROI), or privacy contact. For plan records, use the member-services or claims contact on your insurance card or member portal. If the request is routed to an ROI company working for a provider, keep the date you submitted it to the provider.
How to submit a HIPAA medical records access request
For your own records, use the provider’s or plan’s patient access process. The organization may require a written request if it has told patients to submit requests that way, and it may take reasonable steps to verify your identity. A form can make routing easier, but make sure it describes your request for access to your own records rather than only authorizing a disclosure to someone else.
- Identify yourself. Include your name, date of birth, a reliable way to contact you, and any account or medical record number you know. Provide only the identity information the organization reasonably requests.
- Name the records and dates. Instead of asking for everything if you only need a claim packet, list the relevant notes, reports, itemized bill, or date range. Ask each record holder for the categories it maintains.
- Choose delivery. Request a readable electronic copy if that is what you need and the format can be produced. If you prefer paper or mailed delivery, state that. Keep a copy of your request and proof of submission.
- State that this is your access request. You generally do not need to explain why you want your own records. If staff gives you a HIPAA authorization form, ask whether it is required for your own access request or is intended for a third-party release.
- Track the date received. Save the confirmation, portal receipt, fax report, or delivery record. This helps you follow up if the response period passes.
A concise request can say: “I am requesting access to and a copy of my records under 45 CFR § 164.524. Please provide [specific records] for [date range] in [requested format]. Please let me know promptly if you need reasonable identity verification or clarification.” Do not send sensitive records to an unverified email address or upload portal.
Patient access request versus HIPAA authorization
A patient access request is how you exercise your right to obtain your own records. A HIPAA authorization is a separate tool that permits a covered entity to disclose information to a named recipient for a stated purpose. A provider may have a form for each route. Before signing, check who is requesting the records, who will receive them, which records are covered, and whether the request is for a copy to you or a direct release to another person or company.
This distinction can affect fees. HHS’s notice about Ciox Health, LLC v. Azar explains that the federal fee limitation for an individual’s own access request does not apply to a request to transmit records to a third party; the notice also describes the court’s limit on the third-party directive. If you want your own copy first, say that clearly. If you want the provider to send records directly to an insurer, lawyer, or other recipient, ask which fee schedule applies and check any relevant state protections before approving the charge. See the HHS Ciox notice.
If you are requesting records for another person, the organization may ask for proof that you are authorized to act for that patient. Being a relative does not, by itself, answer every access question. Ask the record holder which representative process applies to your circumstances. State law can matter, particularly for minors, deceased patients, and sensitive records.
HIPAA medical records copy fees: what can be charged?
For a patient’s request for their own copy, HIPAA permits a reasonable, cost-based fee limited to specified costs. Under the federal rule, those costs can include labor to make and deliver the copy after the responsive records have been identified, supplies for the copy or requested portable media, postage when you request mailing, and preparation of a summary or explanation if you agree to it and its fee in advance. The rule does not include search-and-retrieval labor, identity verification, general administration, or system-maintenance overhead in the patient-copy fee. The HHS copy-fee FAQ explains the permitted cost categories and the search-and-retrieval exclusion; its guidance is subject to the Ciox court order.
Ask for an itemized explanation if a bill includes “chart pull,” retrieval, search, or processing charges. Clarify whether the bill is for a copy to you or for a third-party release; those are not interchangeable paths. HHS also says a provider cannot deny access because you have not paid for health care services. See its FAQ on unpaid medical bills and access.
The $6.50 figure is not a universal ceiling. HHS describes it as an optional flat-fee method for certain electronic copies of records maintained electronically, not a required price or an across-the-board maximum. A covered entity may use another permissible method to calculate reasonable costs. The HHS clarification on the $6.50 option explains the limit. Do not assume the first copy is always free under federal HIPAA, and do not assume a quoted amount is valid simply because it is called a copy fee.
| Request path | Fee point to remember | Useful next step |
|---|---|---|
| You request your own copy | Federal fees are limited to reasonable, cost-based copying, supplies, postage, and an agreed summary or explanation. | Ask for a breakdown and confirm whether any search or retrieval charge is included. |
| You direct the provider to send records to a third party | After Ciox, do not assume the same federal patient-copy fee limit applies to the direct-to-third-party route. | Ask for the route and fee basis in writing; check state law before authorizing the release. |
| A personal representative requests for a patient | The person must be authorized for the relevant records and scope of authority. | Ask the provider what documentation it accepts before sending a broad authorization. |
Deadlines, extensions, and ROI vendor handoffs
A covered entity generally must act on a HIPAA access request within 30 calendar days after receiving it. If it cannot, it may use one extension of up to 30 additional calendar days, but it must send you a written explanation and the expected completion date within the first 30 calendar days. The response may be access or a written denial; a vague verbal update is not the written extension described in the regulation.
Some providers use an outside ROI contractor to receive forms, locate files, scan pages, and deliver copies. That handoff can create confusing status updates, but the covered entity remains responsible for acting on the request. Ask the provider to confirm the date it received your request and whether it has issued a formal extension. Also check state law: a state may give patients a shorter deadline or stronger access protection than the federal baseline.
Plan for separate requests when you need records from both a provider and an insurer. No reliable national average wait time or patient-copy price should be treated as a promise; timing and lawful cost depend on the holder, format, request route, and state overlay.
Real-world friction and what the available data can tell you
A 2018 U.S. Government Accountability Office report interviewed patient advocates, provider groups, vendors, state officials, and HHS staff. It described patient concerns about fees and awareness of the right to challenge denials, while noting that providers may need to gather records spread across multiple electronic systems or a mix of paper and digital files. The report examined selected states and is not a current national price or wait-time survey; it is useful as context for why a complete packet may take coordination. See the GAO report on medical-record fees and access challenges.
Individual public forum posts also describe unclear cost estimates or disputes over electronic delivery. For example, one 2025 Reddit post recounts a patient seeking a fee breakdown and an electronic copy from a private practice. That is an unverified individual account, not evidence of how often this happens or how a particular provider will respond. Treat it as a reminder to request the fee basis and delivery method in writing; the official rule, not a forum reply, determines the federal baseline.
If your request is delayed, denied, or billed unexpectedly
- Follow up with the record holder. Reply in writing with the original submission date, the categories and dates requested, and any receipt number. If you asked the wrong organization, request the name of the likely record holder when known.
- Escalate inside the organization. Contact HIM/ROI management, the patient advocate, or the privacy officer listed in the organization’s Notice of Privacy Practices. Ask whether the request is being handled as your own access request or as a third-party authorization, and request a written denial or extension if applicable.
- Use the federal complaint route when appropriate. If you believe a HIPAA-covered entity or business associate violated your access rights, the HHS Office for Civil Rights (OCR) accepts written complaints through its online portal, by mail, fax, or email. The usual filing window is 180 days from when you knew of the act or omission; OCR may extend it for good cause. OCR investigates HIPAA compliance, not whether an insurer should cover a service. Its process and filing instructions are on the HHS OCR complaint page.
Keep copies of your request, confirmation, fee quote, messages, extension notice, and delivery. They make it easier for the organization or OCR to understand the sequence. Do not wait for months to ask about an expired deadline, and do not treat a records complaint as an insurance appeal. For state-specific timing or billing detail, compare Ohio medical-record access and fee information with the Maryland medical records and insurance claims guide; state rules are not interchangeable.
Where certified translation fits after you receive records
HIPAA gives you access to records as maintained; it does not require a provider or health plan to translate a foreign-language record into English or certify a translation. The insurer, court, or other recipient decides what it needs for the next step. Before ordering translation, confirm whether it wants the entire record, selected pages, an itemized bill, an EOB, or a denial letter, and whether it has a preferred format.
If you need an English certified translation of non-English medical records or insurance paperwork, CertOf can translate the documents you provide and deliver a digital file with a translation certification. It does not request records from a hospital, challenge copy fees, file an OCR complaint, or act as your insurance or legal representative. For what pages may belong in a claim packet, see the medical insurance claim packet translation guide. For self-translation questions, see certified translation versus self-translation for U.S. medical insurance paperwork.
Translation service options after access
These are examples of commercially available translation services, not recommendations or guarantees that an insurer will accept a particular format. Compare the provider’s stated medical-document experience, certification, delivery format, and revision process with the receiving organization’s instructions.
| Provider | Publicly stated fit | What to confirm |
|---|---|---|
| CertOf | Online certified translation for medical records and U.S. insurance paperwork; its service flow is document submission and digital delivery. | Confirm the insurer’s preferred scope and whether it needs a full record or selected pages. CertOf does not retrieve records or pursue claims. |
| GTS Translation | Publishes a medical-document translation service and states it can provide certified translations. | Ask about the source-language pair, medical terminology review, certification format, delivery, and revisions for your specific file. |
| RushTranslate | Its public supported-document list includes medical records and describes certified and standard translation options. | Confirm that the requested certified format fits the receiving party’s requirements and ask how charts, stamps, and unreadable text are handled. |
Public and institutional help
| Resource | What it handles | When to contact it |
|---|---|---|
| Provider or plan privacy officer / HIM / ROI office | Request status, identity checks, fee explanations, corrections to routing, and internal privacy concerns. The privacy contact is commonly listed in the Notice of Privacy Practices. | Start here if the request is missing, incomplete, misclassified, or has an unexplained charge. |
| HHS Office for Civil Rights | HIPAA privacy and access complaints against covered entities and business associates. It is a federal compliance route, not an insurance-benefit appeal service. | Consider a complaint if an access issue remains unresolved or the federal response period has passed without a valid extension. |
Frequently asked questions
Can a provider require a HIPAA authorization for me to get my own records?
A provider may require a written access request and reasonable identity verification, but requesting your own copy is different from authorizing a disclosure to a third party. Ask the records office to process it as your patient access request under 45 CFR § 164.524.
Are HIPAA’s 30 days calendar days or business days?
The federal rule says 30 days; plan on calendar days, not business days. One extension of up to 30 additional calendar days is possible only if the entity sends written reasons and an expected completion date within the original period. State law may set a shorter deadline.
Can a doctor charge a retrieval fee for medical records under HIPAA?
For your own-copy access request, HIPAA’s allowed fee is limited to reasonable, cost-based copying, supplies, postage, and an agreed summary or explanation. Search and retrieval labor is not an allowed part of that fee. Ask for an itemized explanation if it appears on your bill.
Is $6.50 the maximum fee for my records?
No. HHS describes up to $6.50 as an optional flat-fee method for certain electronically maintained records delivered electronically, not a universal maximum for every request.
Can a family member request my medical records?
Possibly, if the person qualifies as your personal representative or you authorize a disclosure. The organization may ask for documentation, and the rules can depend on state law and the patient’s circumstances. Being related does not automatically answer every access question.
Does HIPAA require certified English translation?
No. HIPAA’s access right concerns getting the records; it does not require a certified translation. Ask the insurer or other recipient what translation it needs before ordering one.
Where can I complain about a denied HIPAA medical records access request?
Start with the organization’s privacy officer or records department. If you believe a covered entity or business associate violated HIPAA, you can file with HHS OCR, usually within 180 days of when you knew about the issue. OCR does not decide whether an insurance claim should be paid.
Next step
Once you have the records, confirm the receiving party’s requirements and identify only the pages that need translation. You can submit documents to CertOf for translation, review how online ordering works, or read about electronic certified translation formats. Translation can help make non-English records usable for review; it cannot guarantee reimbursement or reverse a denial.
Disclaimer: This article provides general information about U.S. HIPAA access rules and document translation. It is not legal, medical, or insurance advice. Requirements can vary by state, record holder, request route, and the receiving organization.