What to Do If You Are Denied Access to Your Medical Records

Just because the law says you have a right to get copies of your medical records doesn't mean all covered entities are willing to supply them. Your healthcare provider or your insurer may deny you access for reasons that make no sense to you but are important to them.

In most cases, it's illegal for them to deny you access, according to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) laws. If they do deny your request, you need to determine whether you have a legal right to them and what steps to take.

Do You Have the Right to Them? Are They Available?

Be sure you have the right to get those records, and that the records are available. There are some circumstances under which you do not have a right to them.

Also, there are medical records storage time requirements which vary by the state you live in, the type of record, your record of medical problems, and where the records are being kept.  

Have You Followed the Protocol?

Be sure you have followed the right protocol for getting copies of your medical records.

Simply making a phone call may not be enough. There are certain steps you may need to take, including letter-writing and signatures. Included in the protocol is payment for the records.

You may be required to pay for the copies of your medical records before they are provided.   The amount you can be charged will vary by state. If you can't afford them, each state also provides a procedure for reducing the cost.

Was it a Covered Entity?

Be sure you have made the request from a covered entity. These are designated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and include providers who transmit health information in electronic form, health plans, and healthcare clearinghouses.

If you make your request from a non-covered entity then your request will not fall under HIPAA laws and requirements. Find one of the covered entities that have your records and make the request there.

Have You Waited Long Enough?

Be sure you have waited the entire length of time the organization has, by law, to delay fulfilling your request.

By federal law, the maximum amount of time they can delay is 60 days.

Making a Complaint

Be sure you have followed all these steps:

• Verifying you have a right to those records
• Following the right steps for getting them
• Double checking you've made the request of a covered entity
• Waiting long enough

Once you are sure you have them completed, if you are still being denied access to your health records, you can make a complaint to the U.S. Department of Health and Human Services.

Follow their complaint process against the covered entity that's denying you access.

Important: This complaint must be filed within 180 days of the denials. Also, the law prohibits retaliation on the part of the covered entity.

These medical records laws do have teeth. Cignet Health, a Maryland health center, denied records to 41 patients in 2008 and 2009. In 2011, $4.3 million worth of fines were levied against Cignet Health for violating the law.

That action came as a result of complaints made by patients through the complaint process described above.

Verywell Health uses only high-quality sources, including peer-reviewed studies, to support the facts within our articles. Read our editorial process to learn more about how we fact-check and keep our content accurate, reliable, and trustworthy.

1. United States Department of Health and Human Services. Individuals’ right under HIPAA to access their health information 45 CFR § 164.524.
2. HHS. Individuals' rights under HIPAA.
3. United States Department of Health and Human Services. How OCR investigates a health information privacy and security complaint.
4. United States Department of Health and Human Services. Civil money penalty: Cignet Health fined a $4.3m civil money penalty for HIPAA privacy rule violations.

• U.S. Department of Health and Human Services. Individuals' rights under HIPAA.

By Trisha Torrey
Trisha Torrey is a patient empowerment and advocacy consultant. She has written several books about patient advocacy and how to best navigate the healthcare system.

• Meet Our Medical Expert Board
• About Us
• Editorial Process
• Diversity Pledge
• Privacy Policy
• In the News
• Advertise
• Terms of Service
• Careers
• Contact
• EU Privacy

Verywell Health's content is for informational and educational purposes only. Our website is not intended to be a substitute for professional medical advice, diagnosis, or treatment.

We Care About Your Privacy

We and our 100 partners store and/or access information on a device, such as unique IDs in cookies to process personal data. You may accept or manage your choices by clicking below, including your right to object where legitimate interest is used, or at any time in the privacy policy page. These choices will be signaled to our partners and will not affect browsing data.

We and our partners process data to provide:

Store and/or access information on a device. Use limited data to select advertising. Create profiles for personalised advertising. Use profiles to select personalised advertising. Create profiles to personalise content. Use profiles to select personalised content. Measure advertising performance. Measure content performance. Understand audiences through statistics or combinations of data from different sources. Develop and improve services. Use limited data to select content. List of Partners (vendors)