Your rights under HIPAA
Under the federal Health Insurance Portability and Accountability Act, every patient has the right to inspect and obtain a copy of their own medical records maintained by any covered entity — hospitals, physician practices, imaging centers, laboratories, pharmacies. The request must be in writing. The covered entity must respond within 30 days of the request, with the option of a single 30-day extension if they provide written notice of the reason for the delay. The patient must also be permitted to direct the records to a third party (for example, an attorney) with a signed authorization.
Fees for record copies are restricted by HIPAA — providers can charge a reasonable cost-based fee for copying, but not search, retrieval, or processing charges. Many states have stricter fee caps than the federal rule. Electronic copies, when available, are usually provided for a very low flat fee or free of charge via the patient portal. Be aware that what looks like a large bill for paper copies may be negotiable, especially if you or your attorney cite the federal rule directly.
Records can be denied in narrow circumstances — psychotherapy notes, records compiled for legal proceedings, certain research protocols. Routine clinical records, including everything relevant to a gallbladder malpractice case, are not in the denial categories. If a provider refuses or delays without a valid reason, escalation to the Office for Civil Rights of the Department of Health and Human Services is available and, in practice, often moves the process quickly.


