Quick answer
The HIPAA Privacy Rule gives individuals “a legal, enforceable right to see and receive copies upon request of the information in their medical and other health records.”[1] A provider or health plan must respond within 30 calendar days, with one extension of up to 30 more days, may charge only a “reasonable, cost-based fee,” and must send a copy to a third party the patient designates in writing.[1]
The right of access
HHS guidance on the HIPAA right of access
With limited exceptions, the HIPAA Privacy Rule (the Privacy Rule) provides individuals with a legal, enforceable right to see and receive copies upon request of the information in their medical and other health records maintained by their health care providers and health plans.
Source: [1]
HHS explains that this right applies “regardless of the date the information was created” and whether the records are on paper, electronic or archived.[1] A provider “may not require an individual to provide a reason for requesting access.”[1]
How fast providers must respond
A covered entity must provide access “no later than 30 calendar days from receiving the individual’s request.”[1] If it cannot, it may extend the time “by no more than an additional 30 days,” but must tell the individual in writing within the first 30 days why and when access will be provided, and “only one extension is permitted per access request.”[1]
Fees
HHS states that the Privacy Rule “permits a covered entity to impose a reasonable, cost-based fee” for copies.[1]
Electronic copies
If records are kept electronically and the individual asks for an electronic copy, the provider must provide it in the requested form “if it is readily producible in that form and format,” or in an agreed alternative electronic format.[1]
Sending records to someone else
Individuals have “a right to direct the covered entity to transmit the PHI about the individual directly to another person or entity designated by the individual.”[1] The request “must be in writing, signed by the individual, and clearly identify the designated person and where to send the PHI.”[1]
Records relevant to a head injury
Emergency care
EMS run reports, emergency department notes and triage records.
Imaging
CT and MRI reports, and the images themselves.
Follow-up care
Primary care, neurology, therapy and rehabilitation notes.
Testing
Neuropsychological reports and blood test results.
Prior records
Records from before the injury, which show baseline health.
Prescriptions
Pharmacy records showing medications over time.
Frequently asked questions
Do I have to say why I want my records?
No. HHS says a covered entity may not require a reason.[1]
How long can a provider take?
30 calendar days, with one extension of up to 30 more days if the provider explains the delay in writing.[1]
Can my records be sent directly to my attorney?
Yes. Individuals can direct a copy to a designated person through a signed, written request.[1]
This page provides general information from the sources listed below. It is not legal or medical advice, and reading it does not create an attorney-client or provider-patient relationship. Laws vary by state and change over time. See our legal disclaimer.
Sources
- U.S. Department of Health and Human Services. “Individuals’ Right under HIPAA to Access their Health Information.” https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html
Sources last checked: October 11, 2026
