Consumer Letter Template
HIPAA Medical Records Request Letter (Right of Access, 30-Day Rule)
Your medical records are yours. HIPAA — specifically the patient right of access under 45 C.F.R. § 164.524 — gives you the right to inspect them and get a copy within 30 days, in whatever format you ask for, at a fee that's capped at reasonable cost.
The letter
Copy, customize, send.
[Your Full Legal Name] [Date of Birth] [Last 4 of SSN — if entity requires identity verification] [Mailing Address] [Phone Number] [Email Address] [Date] [Provider / Hospital / Health Plan Name] [Attention: Medical Records / Health Information Management Department] [Address] [City, State ZIP] Sent via certified mail, return receipt requested Re: Request for Access to Protected Health Information Under 45 C.F.R. § 164.524 Dear Medical Records Department: I am writing to request access to my protected health information, pursuant to the individual right of access at 45 C.F.R. § 164.524. Patient information: • Full legal name: [Your Name] • Date of birth: [DOB] • Medical record number (if known): [MRN] • Dates of service / treatment range: [Start date] to [End date], or "all records" Records requested — please include all records in my designated record set as defined at 45 C.F.R. § 164.501, including but not limited to: • Medical records (physician notes, progress notes, consult notes, history and physical, discharge summaries) • Diagnostic and imaging reports (radiology, pathology, lab) • Test results and lab values • Operative reports, anesthesia records, recovery notes • Medication lists, prescription records, and immunization records • Billing records and insurance claims records • Any other records used to make decisions about my care [Optional inclusions/exclusions — modify as needed:] • [ ] Please include behavioral-health / mental-health records to the extent they are not psychotherapy notes excluded by 45 C.F.R. § 164.524(a)(1)(i). • [ ] I am NOT requesting psychotherapy notes. • [ ] I am NOT requesting information compiled in anticipation of, or for use in, any civil, criminal, or administrative action. Format requested (45 C.F.R. § 164.524(c)(2)): [Choose one and delete the others.] [ ] Electronic copy delivered to: [Email or secure portal address] [ ] Electronic copy on portable media — please contact me to arrange. [ ] Paper copy mailed to the address above. [ ] In-person inspection only — please contact me to schedule. If you maintain the records electronically, please provide them in the electronic form and format requested if readily producible (45 C.F.R. § 164.524(c)(2)(ii)). Fees (45 C.F.R. § 164.524(c)(4)): Any fee charged for this request must be reasonable and cost-based, limited to (i) labor for copying, (ii) supplies, (iii) postage if mailed, and (iv) preparing an agreed summary or explanation. You may not charge retrieval, search, or handling fees, and any per-page fee must reflect actual labor and supply costs. Please provide a written, itemized estimate before processing if fees are expected to exceed [$25 / your threshold]. State law may further limit fees in [State] — for example, California Health & Safety Code § 123110 caps paper copies at $0.25 per page; New York Public Health Law § 18 caps them at $0.75 per page. Timeline (45 C.F.R. § 164.524(b)(2)): You must act on this request within 30 calendar days of receipt. One extension of up to 30 additional days is permitted only if you provide me, within the original 30 days, a written statement of the reason for delay and the expected completion date. [Include if applicable — directing records to a third party (45 C.F.R. § 164.524(c)(3)(ii)):] I am directing that copies of these records be sent to: [Third Party Name] [Third Party Address] Please honor this directive as a signed third-party access request under 45 C.F.R. § 164.524(c)(3)(ii). I understand that for non-electronic third-party transmissions, the patient-rate fee cap does not necessarily apply following Ciox Health, LLC v. Azar (D.D.C. 2020). I confirm my identity is verified by the personal information at the top of this letter and by a copy of my [driver's license / state ID / passport — first and last pages of passport only] enclosed. If you cannot fulfill this request or believe a denial applies under 45 C.F.R. § 164.524(a)(2)–(3), please send a written denial explaining (a) the specific basis for denial, (b) my right to have the denial reviewed by another licensed healthcare professional not involved in the original decision (for reviewable denials under § 164.524(a)(3)), and (c) my right to file a complaint with the HHS Office for Civil Rights. Sincerely, [Your Signature] [Your Printed Name] Enclosures: [Photocopy of government-issued ID; signed third-party directive if applicable]
This template is for informational use only. It is not legal advice and does not create an attorney-client relationship. Square-bracketed placeholders must be replaced with your specific facts. State law and procedural details vary; if your situation is urgent, complicated, or high-stakes, email info@imfrustrated.org for a free conversation with a volunteer attorney before you send it.
How to use it
A few things before you send.
- 1.Send to the provider's medical records or Health Information Management department. The provider's website usually lists the right address; if not, call the main number and ask for "medical records."
- 2.Include a photocopy of your government-issued ID. HIPAA-covered entities are allowed to require identity verification before releasing records; including ID upfront removes the most common stalling tactic.
- 3.Specify the format you want. Under 45 C.F.R. § 164.524(c)(2)(ii), if the records are maintained electronically and you ask for an electronic copy, the provider must give you one in your requested format if readily producible. Asking for electronic copy by default is usually faster and cheaper than paper.
- 4.Ask for a fee estimate before processing if you expect cost. Under § 164.524(c)(4), fees are limited to reasonable cost-based amounts. Retrieval fees, search fees, and inflated per-page fees are not allowed. State law may cap fees further (California $0.25/page; New York $0.75/page; Massachusetts $15 base + ≤$0.50/page for first 100 pages).
- 5.Note the 30-day deadline. The provider has 30 calendar days to act, with one possible 30-day extension only if they send you a written delay notice within the original 30 days (§ 164.524(b)(2)). If they miss both deadlines without sending you that written extension notice, that's an enforceable HIPAA violation.
What the law actually says
Why this letter works.
The patient right of access, codified at 45 C.F.R. § 164.524, is one of the most consumer-friendly provisions in HIPAA. Every individual has the right to inspect and obtain a copy of their own protected health information (PHI) maintained by a HIPAA-covered entity — health plans, most healthcare providers, healthcare clearinghouses — or by a business associate acting on their behalf. The right covers the entire "designated record set," defined at 45 C.F.R. § 164.501 as medical records, billing records, claims records, case-management records, and any records "used, in whole or in part, by or for the covered entity to make decisions about individuals."
Two categories of records sit outside the right of access. Under § 164.524(a)(1)(i), psychotherapy notes kept separately from the rest of the record are not subject to access. Under § 164.524(a)(1)(ii), information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding is also excluded. The pre-2014 CLIA-related lab record exception was eliminated by an HHS final rule effective October 6, 2014 — laboratory test reports are now part of the right of access on the same terms as any other record.
The procedural mechanics are precise. A covered entity may require a written request, must act within 30 calendar days of receipt, and may extend the response window by up to 30 more days only by sending a written delay notice within the original 30 days explaining the reason and giving an expected completion date (45 C.F.R. § 164.524(b)(2)). The records must be provided in the form and format requested if readily producible — including electronically when records are maintained electronically and an electronic copy is requested (§ 164.524(c)(2)). A signed, written directive to send records to a third party must be honored under § 164.524(c)(3)(ii), though the 2020 decision in Ciox Health, LLC v. Azar limited the patient-rate fee cap to electronic third-party transmissions.
The fee rules are strict. Under 45 C.F.R. § 164.524(c)(4), any fee a covered entity charges must be reasonable, cost-based, and limited to labor for copying, supplies for paper or portable electronic media, postage if mailed, and preparing an agreed summary or explanation. Retrieval fees, search fees, handling fees, and per-page fees disconnected from actual cost are prohibited. State law may further restrict fees — California's Health & Safety Code § 123110 caps paper copies at $0.25 per page, New York's Public Health Law § 18 caps them at $0.75 per page, and Texas's Health & Safety Code § 241.154 caps hospital electronic-record fees at $75 total and prohibits charging the patient anything to inspect (versus copy) their own records.
Remedies for a denied or ignored request are real but bounded. HIPAA has no private right of action — every federal Circuit Court to consider the question has held this — so a patient cannot sue the provider in federal court under HIPAA itself. The remedy is to file a complaint with the HHS Office for Civil Rights within 180 days of the violation, at HHS.gov/hipaa/filing-a-complaint. OCR can investigate, require corrective action, and impose civil monetary penalties. OCR's Right of Access Initiative, launched in September 2019, has produced more than 50 enforcement actions through 2025 — including a $112,500 settlement with Concentra in May 2025 and a $60,000 settlement with Memorial Healthcare System in January 2025, both for failing to provide timely access. State-law claims (negligence per se, breach of confidence) may also be available depending on the state.
If this doesn’t work
Your next move.
If the provider misses the 30-day deadline (without sending you a written extension), denies the request without a proper basis, or refuses to provide the records in the format you requested, file a complaint with the HHS Office for Civil Rights within 180 days at HHS.gov/hipaa/filing-a-complaint. OCR's Right of Access Initiative has produced over 50 enforcement actions since 2019 — providers know the agency follows up. If the issue involves overcharging, send a follow-up letter citing § 164.524(c)(4) and asking for a written explanation of the cost basis; many providers reduce fees once challenged in writing. For state-law fee violations (California $0.25/page, New York $0.75/page, etc.), also file with the state department of health or the relevant licensing board. Where the records are needed for an immediate purpose (a new specialist, a legal claim, a benefits application), call the records department directly and ask for an expedited path; many providers have an expedited process they don't advertise.
Questions people ask
FAQ.
Do I have to use the provider's request form?
No. A covered entity may require a written request under 45 C.F.R. § 164.524(b)(1) but cannot impose barriers like requiring notarization, in-person delivery, or use of a specific form when an equally reliable written request exists. HHS guidance is explicit on this point. Some providers prefer their form to ensure they capture identity verification — including a photocopy of government-issued ID with your written request usually addresses that need.
How long does the provider have to give me my records?
30 calendar days from receipt of the request under 45 C.F.R. § 164.524(b)(2). One extension of up to 30 additional days is permitted, but only if the provider sends you a written delay notice within the original 30 days explaining the reason and giving an expected completion date. No notice within 30 days, no extension — and missing the deadline becomes an enforceable HIPAA violation.
Can a provider charge me $1.00 per page for my records?
Generally no. Under 45 C.F.R. § 164.524(c)(4), fees must be reasonable, cost-based, and limited to labor for copying, supplies, postage, and preparing a summary. Retrieval and search fees are not allowed. Many states cap fees further — California at $0.25 per page (Health & Safety Code § 123110), New York at $0.75 per page (Public Health Law § 18), Texas at $75 total for electronic hospital records (Health & Safety Code § 241.154).
Can I have my records sent directly to my attorney or new provider?
Yes. Under 45 C.F.R. § 164.524(c)(3)(ii), a signed, written directive to send records to a third party must be honored. The 2020 decision in Ciox Health, LLC v. Azar limited the patient-rate fee cap to electronic third-party transmissions; for paper third-party transmissions, the provider may charge market rates. For your own copy, the patient-rate fee cap still applies fully.
What if the provider refuses or ignores my request?
File a complaint with the HHS Office for Civil Rights within 180 days at HHS.gov/hipaa/filing-a-complaint. OCR's Right of Access Initiative has produced over 50 enforcement actions since 2019, with recent settlements including Concentra ($112,500, May 2025) and Memorial Healthcare ($60,000, January 2025). HIPAA itself has no private right of action — every federal Circuit Court has so held — so OCR is the federal remedy. State-law claims (negligence per se, breach of confidence) may be available in some states.
Nervous about sending it yourself?
we’ll read it over with you.
Email the situation and a volunteer attorney will respond. No commitment, no invoice, no judgment — just an honest second pair of eyes from someone who actually understands the law.
info@imfrustrated.org