Illustration of ambulance outside an emergency room.

Eighty percent of people who view their medical records consider the information useful, according to the Department of Health and Human Services. But a new study published in the journal JAMA Network Open suggests that consumers often face troubling barriers to obtaining them, at least in hospitals. 

Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), you have the right to see your health records and get copies. Most health insurance plans and healthcare providers, including clinics, hospitals, physicians, labs, and nursing homes, must follow this law.

But in the new study, involving 83 hospitals in the U.S., Yale researchers found that hospital and call-center employees often gave people incorrect or confusing information during phone requests for medical records. The study also determined that hospitals weren't always complying with the law.

More on Your Health Data

“We found that many hospitals weren’t following federal laws regarding medical records releases—for example, telling us that it would take more than 30 days to release them, or charging hundreds of dollars for copies of records,” says the study's lead author, Carolyn Lye, a third-year law and medical student at Yale University.

Such missteps are disturbing because they can make it difficult for consumers to get their medical records in a timely and cost-effective manner, which is their legal right, says a co-author of the study, Harlan Krumholz, M.D., a cardiologist and healthcare researcher at Yale-New Haven Hospital. 

“If obtaining medical records was so difficult for our researchers, who are well-versed in what their rights are and are tech-savvy, it seems that it would be impossible for most Americans,” Krumholz says. “Some of this is medical-records staff not truly seeming to understand how HIPAA works and consumers’ rights. But I’ve also had chairs of hospitals tell me they don’t want to make it easy for consumers to access their medical records because they don’t want them to leave their healthcare system.”

So how can you get access to your medical records if you need them? Here’s more on what the study found and the steps you can take.

Summing Up the Study's Findings

The Yale researchers obtained medical-record release forms from 83 hospitals in 29 states, all highly ranked in the 2016-2017 U.S. News & World Report Best Hospitals ranking. (Typically, consumers need to fill out such forms to get their records from medical providers.)

Then the researchers called medical-records departments or outsourced call centers to ask questions about obtaining medical records, such as the cost and what formats—paper, email, or CD—were available.

The researchers also asked what kind of information was available upon consumer request, including entire medical records, lab test and physical exam results, and discharge summaries.

They unearthed discrepancies and noncompliance with the law in several areas. For instance, the researchers found that consumers may have a hard time getting records in the format of their choice, even though this is the law.

Only two-thirds of the facilities said they would put records on CDs and less than half—47 percent—indicated they could email them. 

“Some hospitals told us that they wouldn’t email medical records because it wasn’t a secure form of communication, but ultimately that shouldn’t be their decision—it should be the patient’s,” says Lye.

The prices quoted also varied widely from hospital to hospital, and some were significantly above the federal recommendation of $6.50 for a record. For instance, in telephone calls, the costs for providing a 200-page medical record ranged from zero to $541.50.

“Forty percent of Americans don’t have $400 on hand to pay for an emergency expense. How are they going to afford a medical record that’s over $500?” says Krumholz.

In addition, the researchers compared what they were told over the phone with each facility's medical-records request forms to pinpoint  differences. And they found them. 

During the calls, for example, representatives of all 83 hospitals said they could provide entire medical records. But only 53 percent of the hospitals had this as an option on their medical-records request form. And only 35 percent of the facilities clearly spelled out costs on their forms.

“The process right now is very convoluted and confusing,” says Lye.

How to Get What You Need

Although HIPAA has been around for more than two decades, consumers still run into trouble obtaining medical records, whether from a hospital or a local health provider, says Dena Mendelsohn, J.D., M.P.H., senior attorney at Consumers Union, the advocacy division of Consumer Reports. 

“Unfortunately, many providers and their medical-records departments don’t seem to be fully aware of all of HIPAA’s rules, which are designed to protect the consumer,” she says. Here are seven steps to take:

Use the right channels for your request. Your first step should be a visit to your healthcare provider’s online patient portal, a secure website where you can make appointments and possibly view some of your health information, such as lab results or immunization records. If the information you need isn't there—or your provider has no patient portal—check the Contact Us section of its website. This may have instructions on how to request your health record or direct you to a phone number or a form. You can also phone your provider to ask for the staff member in charge of releasing health records.

Be clear about what you’re requesting. Health records can be hundreds of pages long, so it’s a good idea to determine ahead of time what you really need. If you’re switching primary care doctors, for example, you’ll want to get a copy of your entire record to give to the new doctor. But if you simply want to share a specific piece of information with a healthcare provider—for example, recent test results for a specialist—you can just request that.

And if you’re requesting an entire medical record, ask whether any information will be withheld. “Two hospitals we surveyed said they wouldn’t release nursing notes, for example, unless they were specifically requested. But most consumers wouldn’t know to ask about them,” Lye says.

Get the format you want, but be flexible. According to federal law, your provider must give you your choice of a paper or an electronic copy of your health record, says Mendelsohn. If your records aren't available in an electronic format, the provider is required to give you this as long as the office can do so easily (for example, scan a paper record).

But keep in mind that the findings of some tests, such as X-rays and MRI scans, may not be available electronically, so you may have to work with the formats your healthcare provider can offer. 

Challenge excessive costs. Legally, a provider can charge you for the labor, supplies, and postage involved in making a paper or electronic copy of your health record and mailing it to you. It's fair to question anything more than $6.50—the federal recommendation—for your records. But be aware that this is not the maximum amount a provider is allowed to charge. And note that your doctor’s office must provide you with your health records even if you have a current unpaid bill.

Know when you should receive your records. The law says your provider can take up to 30 days to deliver your health records to you. Records can sometimes be thousands of pages long, so sorting through them to find the requested information can take time, and your provider may have a high volume of requests. If your provider needs more than 30 days, the office must give you a reason for the delay and a new delivery date within the next 30 days.

Always follow up. Contact your provider a few days after making your request to make sure it's been received. After that, if you requested a specific delivery date and your records haven't arrived or it’s been more than 30 days, call again. If you feel as if you’re not getting what you need, ask to speak to the practice’s designated HIPAA privacy officer. (All providers, even small practices, are required to have one to ensure that the office is complying with HIPAA.) Contact information is often found in the Contact Us or Privacy sections of your provider’s website.

Go up the chain of command if necessary. If you’re experiencing delays in getting medical records or think the cost is prohibitive, you have the right to file a complaint with the Office of Civil Rights.