Understanding your situation
What you need to prepare
- ✓Written record request to the healthcare provider (with date of submission)
- ✓Proof of identity (ID, patient number)
- ✓Specification of which records you need (dates, departments, types of records)
- ✓Any previous correspondence with the provider about access
- ✓Documentation of any fees charged or requested
⏰ Deadline
UK (GDPR/DPA): Provider must respond within 1 month. EU (GDPR): 1 month. US (HIPAA): 30 days, extendable to 60. Germany: without undue delay (unverzuglich). France: 8 days (or 2 months for records over 5 years old). Poland: without undue delay.
🏛️ Authority
ICO (UK), State HHS Office (US), Landesdatenschutzbeauftragter (DE), CNIL (FR), UODO (PL)
⚖️ Legal basis
EU: GDPR Article 15 (right of access). UK: UK GDPR, Data Protection Act 2018. US: HIPAA Privacy Rule. Germany: DSGVO, BGB Paragraph 630g. France: Code de la sante publique, RGPD. Poland: RODO, ustawa o prawach pacjenta.
Expert tips
- 1Make your request in writing (email or letter) and keep proof of delivery and the date sent. Reference the specific legal basis for your request (GDPR Article 15, HIPAA Privacy Rule, BGB 630g, etc.).
- 2Be specific about which records you need: specify date ranges, departments, types of records (consultation notes, test results, imaging, prescriptions), and the format you prefer (electronic or paper).
- 3Under GDPR, healthcare providers cannot charge for the first electronic copy of your records. If charged, cite Article 15(3) and request a fee waiver. Under HIPAA, only reasonable cost-based fees are permitted.
- 4If the provider does not respond within the statutory timeframe, send a formal follow-up letter noting the deadline has passed and setting a final deadline (typically 7-14 days) before escalation.
- 5If the provider continues to delay or refuse, file a complaint with the relevant data protection authority: ICO (UK), CNIL (FR), Landesdatenschutzbeauftragter (DE), UODO (PL), or HHS OCR (US).
- 6You have the right to request that records be sent directly to another healthcare provider or to a third party you designate. This is particularly useful when transferring care.
- 7If records are claimed to be lost or destroyed, request written confirmation of what happened, when, and whether the provider met their legal retention obligations.
- 8For records of deceased patients, check the applicable rules for access by next-of-kin or estate representatives. Rules vary by jurisdiction but access is often permitted.
- 9Consider making a Subject Access Request (SAR) under data protection law rather than (or in addition to) a medical records request under health law, as this may provide broader access.
- 10If all administrative routes fail, you can apply to a court for an order compelling the provider to disclose the records. This is a last resort but is available in most jurisdictions.
Document you need
Generate a letter
Learn more →
Administrative Appeal Letter - Challenge Any Government Decision
Generate a professional administrative appeal letter in minutes. Challenge government decisions on permits, benefits, licenses & more with AI. Free revision included.
