On this page
Under HIPAA, patients have a right to see and get copies of their health records, and a practice must act on a request no later than 30 calendar days after receiving it. A request form makes that easy to document, and it is a different document from a release, which a practice uses when records go to someone else for another purpose. Curve Compliance helps practices keep the pages that handle these requests free of ad pixels, and strips PHI before data reaches an ad platform.
Book a call. Not sure what your patient pages send to Meta or Google? Curve Compliance replaces browser ad pixels with server-side tracking that strips PHI before data reaches an ad platform, and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.
The right of access, in plain terms
HHS tells patients: “The Privacy Rule gives you, with few exceptions, the right to inspect, review, and receive a copy of your medical records and billing records that are held by health plans and health care providers covered by the Privacy Rule” (HHS). HHS adds: “Only you or your personal representative has the right to access your records.”
Two kinds of information sit outside the right. HHS lists psychotherapy notes, meaning “the personal notes of a mental health care provider documenting or analyzing the contents of a counseling session, that are maintained separate from the rest of the patient's medical record,” and “Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding” (HHS). Everything else in the patient's record and billing file is in scope. HHS also notes that its access guidance “remains in effect only to the extent that it is consistent with the court's order in Ciox Health, LLC v. Azar,” a 2020 decision (HHS).
The 30-day clock
The rule says “the covered entity must act on a request for access no later than 30 days after receipt of the request” (45 CFR 164.524). HHS phrases it as “no later than 30 calendar days from receiving the individual's request,” and adds: “The 30 calendar days is an outer limit and covered entities are encouraged to respond as soon as possible” (HHS).
If the records are hard to reach, such as archived offsite, a practice “may extend the time by no more than an additional 30 days.” To do it, the practice “must, within the initial 30 days, inform the individual in writing of the reasons for the delay and the date by which the covered entity will provide access,” and “Only one extension is permitted per access request” (HHS). Date-stamp every request when it arrives, because the clock starts then, not when someone opens the envelope or the inbox.
Medical records request form template
A practice “may require individuals to request access in writing, provided the covered entity informs individuals of this requirement,” and “may require individuals to use the entity's own supplied form, provided use of the form does not create a barrier to or unreasonably delay the individual from obtaining access” (HHS). Keep the form short. These fields cover most requests:
| Section | Fields | Why it is there |
|---|---|---|
| Patient | Full name, any former names, date of birth | To find the right record |
| Contact | Phone, email and mailing address | To reach the patient about the request |
| Requester | The patient, or a personal representative (name and relationship) | Representatives can exercise the patient's rights |
| Records wanted | All records, or a date range, or specific types (visit notes, lab results, imaging reports, billing records) | A narrow request is faster to fill |
| Format | Paper copy, electronic copy, or inspection in person | HHS requires the form and format requested if readily producible |
| Delivery | Pick up, mail, email or portal, or send to another person | The manner of delivery the patient chooses |
| Another person | Name and where to send the copy | A directive to a third party must be in writing, signed and specific |
| Verification | What the practice needs to confirm identity | Required, without creating barriers |
| Date | Date of the request | Starts the 30-day clock |
Two rows need care. On format, HHS says a practice must provide access “in the form and format requested, if readily producible in that form and format” (HHS). On sending a copy to someone else, the rule says “The individual's request must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy of protected health information” (45 CFR 164.524). Since a January 23, 2020 court order, HHS applies that third-party directive only to requests for “a copy of an electronic health record” in an electronic format (HHS).
Request vs release
A records request is the patient using their own right: they ask for their records, or direct the practice to send a copy to a person they name. A release, often called a HIPAA authorization, is the patient's permission for a use or disclosure that the Privacy Rule would not otherwise allow, and it has a checklist of its own: “A valid authorization under this section must contain at least the following elements” (45 CFR 164.508). For the authorization side, see the HIPAA release form guide.
How practices should respond
Verify identity, but don't turn verification into a wall. HHS gives examples of what a doctor may not require: that a patient who wants records mailed “physically come to the doctor's office to request access and provide proof of identity in person”; that a patient “use a web portal for requesting access, as not all individuals will have ready access to the portal”; or that a patient “mail an access request, as this would unreasonably delay the covered entity's receipt of the request” (HHS). Offer several ways to ask.
On fees, “The Privacy Rule permits a covered entity to impose a reasonable, cost-based fee if the individual requests a copy of the PHI,” and HHS says the fee may include only certain costs, such as labor for copying, supplies and postage (HHS). If you deny any part of a request, the rule sets out which denials the patient can have reviewed; denials are where practices most need advice, so talk to your counsel before you refuse. For how long to keep request logs, see HIPAA document retention.
Keep records request pages free of ad pixels
A records request page collects a name, a date of birth and often the type of care the patient received. HHS says regulated entities “are not permitted to use tracking technologies in a manner that would result in impermissible disclosures” of PHI to tracking vendors (HHS). If the page that hosts your request form also loads a Meta or Google pixel, session recording or a chat widget from a vendor without a BAA, what the patient types can travel with it. The same goes for your patient portal login page and your registration forms; see the new patient form and medical history form guides.
The check takes a minute: open the page in the free website scan and see which pixels and trackers it loads. Then remove them from that page, or replace browser pixels site-wide with server-side tracking that strips PHI before data reaches an ad platform.
How Curve Compliance helps
Curve Compliance replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and strips PHI before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted.
Curve's team reviews what your site sends to Meta, Google and TikTok with you and shows what's likely triggering a flag, including on pages like records requests, portal logins and patient forms, while your marketing pages keep measuring bookings. Curve is SOC 2 Type II, signs a BAA on every plan, and its team does the setup, typically live in about a week. Book a call to review what your patient pages send today. Therapy practices have one extra rule to know; see SimplePractice vs TherapyNotes for psychotherapy notes and the client portal.
Sources, checked November 9, 2026: HHS, Individuals' Right under HIPAA to Access their Health Information; HHS, Your Medical Records; 45 CFR 164.524; 45 CFR 164.508; HHS, Use of Online Tracking Technologies; HHS, Important Notice Regarding Individuals' Right of Access.
Frequently Asked Questions
How do I request my medical records?
Ask the practice in writing, on its own form if it has one, saying which records you want, in what format and how to deliver them. The practice must act within 30 days of receiving the request (45 CFR 164.524).
How long does a practice have to respond?
No later than 30 calendar days after it receives the request, with one extension of up to 30 more days if it tells you in writing why and when (HHS).
Can a practice charge for records?
Yes, within limits: HHS says “The Privacy Rule permits a covered entity to impose a reasonable, cost-based fee” for a copy, covering only certain labor, supply and postage costs (HHS).
Can I request records by email?
Often, yes. HHS says practices “may offer individuals the option of using electronic means (e.g., e-mail, secure web portal) to make requests for access” (HHS).
Can a practice make me use its own form?
Yes, as long as the form does not create a barrier to or unreasonably delay access (HHS).
Can I have my records sent to another doctor or a lawyer?
Yes, for an electronic copy of records kept in an electronic health record. Put the request in writing, sign it, and name the person and where to send the copy (45 CFR 164.524; HHS).
Are psychotherapy notes part of a records request?
No. HHS excludes psychotherapy notes kept separate from the rest of the record from the right of access (HHS).
Talk to Curve Compliance
Book a call. Want your patient pages kept out of your ad data, while your marketing still measures bookings? Curve Compliance sends conversions server-side, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.