Start with the patient portal — you may have the records already
Before submitting any formal request, log in to your provider's patient portal. The majority of large US health networks run on Epic MyChart (or a branded version of it). Once logged in, navigate to Health → Document Center or My Record and look for a Download My Record or Request Records button. Visit summaries, lab results, immunisation records, and many test reports are available for immediate download — often at no cost.
The same applies in the UK: the NHS App gives you access to GP health records, including medications, allergies, and test results, and many NHS trusts provide a portal for hospital records. Check your trust's website for the portal link.
If the portal covers everything you need, you're done. If you need clinical notes from older visits, radiology images, operative reports, or records from a small practice that doesn't use a portal, move to a formal request.
US — Your HIPAA Right of Access
Under 45 CFR 164.524 of the HIPAA Privacy Rule, you have a federal right to access your protected health information (PHI) held by any covered entity — hospitals, clinics, GP practices, labs, pharmacies. The key rules:
Timeline: The provider must act on your request within 30 calendar days of receiving it. One extension of up to 30 days is permitted, provided they notify you in writing within the first 30 days and state the reason for the delay.
Format: If you request an electronic copy and the records are maintained electronically, the provider must supply them in the electronic format you request — or, if that specific format isn't readily producible, in an alternative electronic format you agree to.
Fees: Only a reasonable, cost-based fee is allowed — specifically, the cost of labour for copying (not labour for locating or reviewing), supplies, postage, and preparation of an explanation. For records accessed through a patient portal, fees are often zero or minimal. Paper copies carry per-page charges set by state law, which vary and in some states have increased via CPI adjustments in 2026. Important 2026 change: if a third-party app (a wellness tracker, life insurance portal, etc.) requests records on your behalf rather than you requesting them directly, providers may classify this as a commercial retrieval and charge significantly higher rates — sometimes $50–$100. Always request your own records directly.
How to make the request: Contact the provider's Health Information Management (HIM) or Medical Records department. Ask for their Release of Information (ROI) form; many now accept it online via a secure portal, by fax, or in person. Your request should specify:
- Full name and date of birth
- Dates of service (or "all records")
- The specific record types (office notes, labs, imaging, discharge summary)
- Delivery method (portal download, email, fax to new provider, paper)
- Your signature
If the provider refuses, delays beyond 30 days, or charges an unreasonable fee, you can file a complaint with the HHS Office for Civil Rights at hhs.gov/hipaa/filing-a-complaint. OCR has issued civil monetary penalties against providers who improperly blocked access.
UK — GDPR Subject Access Request (SAR)
Under the UK General Data Protection Regulation (UK GDPR), you have a right of access to your personal data held by any organisation — including NHS trusts, GP practices, private hospitals, and dental surgeries. This right is exercised through a Subject Access Request (SAR).
Timeline: The organisation must respond within one calendar month of receiving your request (calculated from the day after the request arrives). In complex cases, it can be extended by a further two months, but the organisation must inform you of the extension within the first month and explain why.
Cost: The first SAR is free of charge. A fee may be charged for subsequent requests, or for requests that are "manifestly unfounded or excessive."
How to make an NHS SAR: Write to the NHS trust or GP practice (email, letter, or the provider's online SAR form all count). Include your name, date of birth, NHS number (if known), and the records or date range you want. The trust's Data Protection Officer (DPO) or Health Records department handles these. NHS England's SAR guidance lists what to include.
Transferring records to a new provider
If your goal is to move your care to a new doctor or specialist, note that under HIPAA's treatment exception (US), providers can share records directly with other treating clinicians without a signed authorisation from you — though many still request one in practice. The most reliable method is to:
- Ask your new provider's office for their preferred record transfer form and fax number or secure email.
- Submit that form to the old provider's HIM department, specifying the exact records needed.
- Include a "to be released by" date so the old provider knows the urgency.
Records sent directly from provider to provider are usually not charged to you. Only copies sent directly to the patient carry the potential per-page fees described above.
If your provider has retired or the practice has closed
Providers are required to retain records for a minimum period set by state law — typically 7–10 years for adults, and longer for minors. If a practice has closed, records are usually transferred to a successor practice, a medical records storage company, or in some states deposited with the state medical board. Contact your state medical board for guidance on locating records from practices that have closed or moved.
Browse all task guides at /guides. For the full change-of-address workflow — including updating your insurance and healthcare portal address after a move — see how to change your address (US).