🏥 Healthcare & Coverageinternational

Request Access to Your Medical Records

Every patient has a fundamental legal right to access their complete medical records. Under the GDPR in Europe, HIPAA in the US, and equivalent laws worldwide, healthcare providers must provide copies of your records within strict timeframes. Despite this, many patients face delays, excessive fees, incomplete records, or outright refusal. In the EU, the GDPR grants a right of access under Article 15 that applies to all health data. In the UK, the Data Protection Act 2018 and UK GDPR provide equivalent rights. In the US, HIPAA gives patients the right to access their Protected Health Information (PHI) within 30 days. In Germany, BGB Paragraph 630g specifically addresses patient access to medical records. In France, the Code de la sante publique mandates access within 8 days. In Poland, the ustawa o prawach pacjenta guarantees access without undue delay. If your healthcare provider has denied, delayed, or inadequately responded to your request, you can escalate to data protection authorities and health regulators. DocuGov.ai helps you generate a professional records access request or escalation letter.

Understanding your situation

You need to access your medical records but your healthcare provider has not responded adequately. Access to medical records is a fundamental patient right, and providers who fail to comply face regulatory sanctions. Here are the most common scenarios: - No response to records request: You submitted a written request but received no acknowledgment or response within the statutory timeframe (1 month under GDPR, 30 days under HIPAA). - Excessive fees charged: The provider is charging unreasonable fees for copies. Under GDPR, the first copy of electronic records must be provided free of charge. Under HIPAA, only reasonable cost-based fees are permitted. - Incomplete records provided: You received records but they are incomplete, missing important sections such as test results, specialist referrals, surgical notes, or mental health records. - Access denied without valid reason: The provider refused your request entirely. Valid reasons for refusal are extremely limited and typically only apply when access would cause serious harm to the patient or where records contain information about third parties. - Records claimed to be lost or destroyed: The provider claims your records have been lost, destroyed, or are no longer available. Healthcare providers have legal obligations to retain records for specific minimum periods. - Delay beyond statutory timeframe: The provider acknowledged your request but has not provided the records within the required period, offering no valid extension or explanation. - Transfer to new provider blocked: You requested that records be transferred directly to a new healthcare provider, but the original provider has not complied. - Digital access denied: You requested electronic copies of records held electronically, but the provider insists on providing only paper copies or requiring in-person access. - Third-party access (authorized representative): You are acting as an authorized representative (parent, legal guardian, power of attorney) and your request has been refused despite providing valid authorization.

What you need to prepare

  • Written record request to the healthcare provider (with date of submission)
  • Proof of identity (ID, patient number)
  • Specification of which records you need (dates, departments, types of records)
  • Any previous correspondence with the provider about access
  • Documentation of any fees charged or requested

Deadline

UK (GDPR/DPA): Provider must respond within 1 month. EU (GDPR): 1 month. US (HIPAA): 30 days, extendable to 60. Germany: without undue delay (unverzuglich). France: 8 days (or 2 months for records over 5 years old). Poland: without undue delay.

🏛️ Authority

ICO (UK), State HHS Office (US), Landesdatenschutzbeauftragter (DE), CNIL (FR), UODO (PL)

⚖️ Legal basis

EU: GDPR Article 15 (right of access). UK: UK GDPR, Data Protection Act 2018. US: HIPAA Privacy Rule. Germany: DSGVO, BGB Paragraph 630g. France: Code de la sante publique, RGPD. Poland: RODO, ustawa o prawach pacjenta.

Expert tips

  1. 1Make your request in writing (email or letter) and keep proof of delivery and the date sent. Reference the specific legal basis for your request (GDPR Article 15, HIPAA Privacy Rule, BGB 630g, etc.).
  2. 2Be specific about which records you need: specify date ranges, departments, types of records (consultation notes, test results, imaging, prescriptions), and the format you prefer (electronic or paper).
  3. 3Under GDPR, healthcare providers cannot charge for the first electronic copy of your records. If charged, cite Article 15(3) and request a fee waiver. Under HIPAA, only reasonable cost-based fees are permitted.
  4. 4If the provider does not respond within the statutory timeframe, send a formal follow-up letter noting the deadline has passed and setting a final deadline (typically 7-14 days) before escalation.
  5. 5If the provider continues to delay or refuse, file a complaint with the relevant data protection authority: ICO (UK), CNIL (FR), Landesdatenschutzbeauftragter (DE), UODO (PL), or HHS OCR (US).
  6. 6You have the right to request that records be sent directly to another healthcare provider or to a third party you designate. This is particularly useful when transferring care.
  7. 7If records are claimed to be lost or destroyed, request written confirmation of what happened, when, and whether the provider met their legal retention obligations.
  8. 8For records of deceased patients, check the applicable rules for access by next-of-kin or estate representatives. Rules vary by jurisdiction but access is often permitted.
  9. 9Consider making a Subject Access Request (SAR) under data protection law rather than (or in addition to) a medical records request under health law, as this may provide broader access.
  10. 10If all administrative routes fail, you can apply to a court for an order compelling the provider to disclose the records. This is a last resort but is available in most jurisdictions.

Document you need

📄

Generate a letter

Learn more

🏥

Administrative Appeal Letter - Challenge Any Government Decision

Generate a professional administrative appeal letter in minutes. Challenge government decisions on permits, benefits, licenses & more with AI. Free revision included.

Ready to create your document?

Generate a professional letter in minutes

Generate This Letter Now