How to Get a Copy of a Parent's Medical Records (and Who Can Ask)

To get a copy of a parent's medical records, the simplest route is for your parent to request them from each provider's medical records office, or through the patient portal, and share them with you. If you're their health care agent and the document is in effect, or the executor after they die, you can request the records yourself as their personal representative. Under HIPAA, the provider has 30 days to respond, can extend once by 30 more days with a written explanation, and can charge only a limited, cost-based fee.

Being allowed to talk to the doctor is a separate problem, solved by a different form. If that's where you're stuck, start with our guide to the HIPAA authorization for a parent. This article is about getting the actual pages.

Who can request the records

The right to see and copy medical records belongs to the patient, under 45 CFR 164.524. Other people get to use that right only in specific ways.

The personal representative rule is in 45 CFR 164.502(g). If state law gives someone authority to make health care decisions for an adult, the provider has to treat that person as the patient for records purposes. HHS says plainly that a person who can make health care decisions under a health care power of attorney is the patient's personal representative. A power of attorney limited to money is not enough: an HHS FAQ says one that doesn't cover health care decisions doesn't let the holder exercise the patient's HIPAA rights. Not sure which one your parent signed? Our guide to health care proxy vs. power of attorney sorts the names out.

If your parent can't decide and never named an agent, you're not their personal representative yet. The fallback runs through state surrogate laws or guardianship, covered in what to do when a parent has no power of attorney.

What "the records" actually include

HIPAA's right of access covers what the rule calls the designated record set. For a doctor or hospital, that means the medical records and billing records, plus anything else used to make decisions about your parent. For a health plan, it's enrollment, payment and claims records.

In plain terms, you can ask for office visit notes, hospital records and discharge summaries, lab and imaging results, medication lists, and the billing ledger. A few exceptions and limits:

• Psychotherapy notes. A therapist's separate session notes are excluded from the right of access, per HHS's page for patients. Your parent's ordinary mental health treatment records, such as diagnoses and medication, sit in the regular chart.
• Material prepared for a lawsuit or other legal proceeding.
• Reviewable denials. A licensed health care professional can deny access if it's reasonably likely to endanger the life or physical safety of your parent or someone else, or if the records mention another person and access is reasonably likely to cause that person substantial harm. When a personal representative asks, access can also be denied if it's reasonably likely to cause substantial harm to the patient or someone else. You can ask for any of these denials to be reviewed by a second licensed professional who wasn't part of the first decision.

One thing that isn't an exception: unpaid bills. HHS says a provider can't refuse a copy because the patient hasn't paid for the care.

Start with the portal

For recent results, notes and medication lists, the patient portal usually beats a records request by weeks. The 21st Century Cures Act prohibits information blocking, meaning practices likely to interfere with access to electronic health information. The federal health IT office's FAQ says that once a patient asks for something like test results, the provider must respond in a timely way, which can mean seeing results about when the ordering doctor does. That's why a result may show up before the doctor calls.

Portal access for you comes through proxy access, which is set up one health system at a time; the HIPAA authorization guide linked above walks through it. Two limits worth knowing: portals often show only recent years, and they rarely include outside records the office scanned in. For a full history, you still need a formal request.

How to write the request

Most medical records offices (often called Health Information Management) have their own request form; use it. Otherwise a signed letter works. Under the rule, a provider can require requests in writing as long as it tells patients so.

A good request includes:

• Your parent's full name, date of birth, and any former names
• Their medical record number, if you have it from a bill or portal
• What records, and what dates ("all office notes, labs and imaging reports, last three years")
• The format: "electronic copy by secure email" or "on a USB drive" or "paper copy by mail"
• Where to send it, with a full mailing address or email
• Your parent's signature and the date
• If you're signing as personal representative: your name, how you're related, and the document that gives you authority, attached
• A phone number for questions about the request

On format: if the records are kept electronically and your parent asks for an electronic copy, the provider must provide it in the electronic form and format requested if it's readily producible that way, or else in another readable electronic format you both agree on (164.524(c)(2)). An electronic copy is usually cheaper and searchable.

Send the request to the right place. A hospital and the doctors who saw your parent there may keep separate records, and an imaging center or outside lab may hold the originals. If an office doesn't have what you asked for but knows who does, the rule says it has to tell you where to send the request.

Keep a copy of every request and note the date you sent it. The deadline runs from the date they receive it.

Sent to your parent, or sent to you? It matters

HIPAA lets a patient direct a provider to send copies straight to another person, such as you, in a signed writing that names the person and where to send them (164.524(c)(3)(ii)).

But a 2020 federal court decision, Ciox Health v. Azar, narrowed that. According to HHS's notice on the ruling, the required third-party directive now covers only electronic copies of records kept in an electronic health record. The fee limits also apply only when patients request their own records, not when they direct them to someone else. So:

• If you're the personal representative, make the request in that role, as a request for your parent's own records, not as a directive to send them to someone else. The rule treats a personal representative as the patient (164.502(g)), so the patient fee limits should apply to you.
• If your parent is able, it's often cheaper for them to request copies for themselves and hand them to you, or give you portal proxy access.
• If they direct copies to you, the office may treat it like an ordinary release, with a different fee.

Deadlines and fees

Thirty days, plus one extension. The provider must act on a request within 30 days of receiving it. It may extend once, by up to 30 days, only if it tells your parent in writing within the first 30 why, and when it will finish (164.524(b)(2)). Where state law gives patients greater rights of access, such as a shorter deadline, the state rule generally applies instead.

You may read online that the federal deadline is 15 days. That was part of a rule HHS proposed in 2021 and has not finalized, so 30 days is still the federal limit.

Fees. The rule allows a reasonable, cost-based fee that covers only labor for copying, supplies such as paper or a USB drive, postage if mailed, and preparing a summary if your parent agreed to one in advance. HHS says providers can't charge for searching for or retrieving records.

HHS guidance lists ways to calculate the fee: actual costs, an average-cost schedule, or, for electronic copies of electronic records, a small flat fee for offices that would rather not calculate. The same guidance says per-page fees aren't reasonable for records kept electronically. HHS also clarified that the flat amount is an option, not a cap on every fee. Ask for an estimate up front; HHS expects offices to be able to tell patients the approximate fee in advance.

Medicare claims: the record you can get today

Medicare's records are claims, not chart notes, but they make a good map: every doctor, hospital, lab and pharmacy Medicare paid, with dates, which tells you where to send requests.

With a Medicare account, your parent can download their claims data to print or share with someone they trust. Medicare also offers an optional service called Blue Button that lets your parent link their data to apps they choose, and stop sharing at any time. If your parent has a Medicare Advantage Plan, Medicare says the data will include only drug claims, so ask the plan what it offers. For which Medicare cards and notices to keep on hand, see Medicare documents for a parent.

During a hospital stay, skip the formal request and ask for the medication list and discharge summary directly; see our guide to an elderly parent in the hospital.

Records after a parent dies

HIPAA keeps protecting a person's health information for 50 years after death. During that time, HHS says the personal representative, meaning the executor, administrator, or another person with authority under state law to act for the estate, can exercise the patient's rights, including access to the records.

Family members who were involved in the person's care but aren't the representative have a narrower path: providers may share information relevant to that involvement, unless it goes against wishes the person expressed. A full copy of the chart usually needs the executor.

Expect to send letters testamentary or of administration and a death certificate. If no estate was opened, ask the provider what it accepts under state law. See who to notify when a parent dies for the other offices that will want the same papers.

If the office says no, or goes quiet

A denial has to be in writing, in plain language, and say why, how to ask for review if that applies, and how to complain to the provider and to HHS, including a contact name or title and phone number (164.524(d)). The office also has to give access, to the extent possible, to the rest of the records it isn't withholding.

If a month passes with nothing:

1. Call the records office with your send date. Ask whether it arrived and whether an extension letter went out.
2. Ask for the privacy officer. Every covered provider has one, and records disputes are their job.
3. File a complaint with the HHS Office for Civil Rights (OCR). Anyone can file through OCR's complaint process. A complaint must be filed within 180 days of when you knew or should have known about the problem, unless OCR waives that for good cause (45 CFR 160.306).
4. For portal or electronic access problems, the federal health IT office takes information blocking claims through its online reporting portal.

OCR launched its Right of Access Initiative in 2019, and by July 2022 had announced 38 enforcement actions under it, according to HHS, with more announced since. In practice, a polite letter citing the rule and the date usually moves things first.

Where to keep what you get

Don't let the records become another box in the hall closet. Keep the latest medication list, discharge summary, diagnoses and allergies where you can reach them in an emergency, and the full files on a computer with a printed index of what came from whom. Our list of important documents for aging parents shows what else belongs alongside them.

Frequently asked questions

Can I get my parent's medical records without their permission?

Only as their personal representative: usually the health care agent once the document is in effect, a guardian with health care authority, or the executor after death. Otherwise your parent requests them or signs a request directing them to you.

How long does a doctor have to send medical records?

Under HIPAA, 30 days from receiving the request, with one extension of up to 30 more days if the office explains the delay in writing within the first 30. Some states set shorter deadlines.

Can a doctor charge for copies of medical records?

Yes, but only a reasonable, cost-based fee for copying labor, supplies and postage. They can't charge for searching for or retrieving the records, and can't withhold copies because of an unpaid medical bill.

Can I get my deceased parent's medical records?

The executor or administrator can, as personal representative. Other family involved in their care may get relevant information, but usually not the full chart.

Having the papers in one place

Records requests usually stall on something small: no record number, no copy of the power of attorney, nobody sure which hospital did the scan. You can fix that yourself with the request checklist above and a folder per provider. Or Emergency Binder Now can do the organizing from about 25 minutes of guided questions, producing a printable binder with your parent's doctors, medications and an Emergency Information Sheet, plus pages showing which legal documents exist and where each one is kept. You can see a sample binder first.

This article is general information, not legal or medical advice. HIPAA sets a federal minimum, and state laws on records deadlines, copy fees, surrogate decision makers and estates vary. For your parent's situation, ask the provider's privacy officer or an elder law attorney in their state.