Medical Records and Who May Release Them
Health records are among the most useful documents in almost any dispute and among the most heavily protected. The protection is not an obstacle so much as a form: an authorization that contains what the rules require is honoured, and one that does not is returned.
The rule in short
Providers release records to the patient on request, to third parties on a compliant written authorization, and to anybody under valid compulsory process with the notice the rules require. An authorization has to identify the record, the recipient and the purpose, state an expiry, and carry the patient's signature. Most refusals are refusals of the paperwork rather than of the request.
Medical records answer questions no other document reaches: what a person could do, what they reported at the time, what a clinician observed. Getting them is a matter of using the right instrument, and the instruments are prescribed closely enough that improvising one guarantees a delay.
The three ways a record leaves a provider
The patient asks. A right of access to one's own record exists in most systems, exercisable by written request, and it is the fastest and cheapest of the three by a wide margin.
A third party asks with authorization. The provider is releasing on the patient's instruction, which is why the instruction has to be in a form the provider can rely on without inquiry.
Compulsory process. A subpoena or court order, which overrides the absence of consent but generally brings its own notice requirements attached to it.
Emergency and public health exceptions. Narrow, and rarely relevant to a dispute, though they explain why a provider will sometimes release without any of the above.
Everything else is refused. A telephone request, a letter from a lawyer without authorization, or a request from a family member is declined as a matter of routine, which is discussed further in what a records request can and cannot reach.
What an authorization must contain
A description of the information. Specific enough for the provider to identify it: the period, the treating department, the type of record. "All records" is accepted by some providers and questioned by others.
The person authorized to disclose. Named, because an authorization addressed to nobody in particular cannot be relied on by anybody in particular.
The person authorized to receive. Named individually or by organization, and a change of recipient generally requires a fresh authorization rather than a note.
A purpose and an expiry. Both are required contents in most schemes, and an authorization with no end date is invalid on its face in several of them.
Signature and date. By the patient or their personal representative, with the representative's authority described, which is where authorizations most often fail.
| Requester | Instrument | Usual timescale |
|---|---|---|
| The patient | Written access request | Weeks |
| A representative with consent | Compliant authorization | Weeks |
| A party in proceedings | Subpoena with notice | Weeks to months |
| A party without consent | Court order | Months |
| A family member without authority | Nothing available | Refused |
The patient's own right of access
Broader than most people assume. It generally covers the whole designated record set, including test results, imaging reports and correspondence, rather than a summary.
Timescales are prescribed. Providers have a set period to respond, extendable once with an explanation, and the period runs from the request rather than from any later clarification.
Fees are limited. To the cost of copying and postage in most schemes, and a fee based on the value of the record rather than its production cost is not permitted.
Format can be specified. Electronic copies where the record is held electronically, which matters when the alternative is several hundred photocopied pages.
Denials must be explained. In writing, with the ground and the review route, and the grounds are narrow enough that outright denial is uncommon.
The four commonest defects are no expiry date, a recipient described by role rather than by name, a description too vague for the department to search, and a signature by somebody whose authority to sign is not evidenced. All four are curable in a single redraft.
Categories with extra protection
Psychotherapy notes. Kept separately from the main record in most systems and released only on a specific authorization that mentions them expressly.
Substance use treatment records. Subject to their own federal regime in many cases, with tighter consent rules and restrictions on redisclosure.
Genetic information. Increasingly protected by separate statutes governing both disclosure and the use to which it may be put.
Records of a minor. Access depends on the age of the patient, the treatment concerned and state law, and it is one of the areas where practice varies most.
Records concerning a third party. Where a note about one patient records information about another, the second person's material is generally redacted, as redactions and what they conceal sets out.
Using compulsory process
A subpoena is often not enough alone. Many schemes require either the patient's notice and an opportunity to object, or a protective order, before the provider may comply with a subpoena.
Providers are cautious for good reason. Wrongful disclosure carries penalties for the provider and none for the requester, so a provider in doubt will decline and wait to be ordered.
An order removes the doubt. Which is why an application, though slower, is frequently faster in practice than an argument with a records department about a subpoena.
Notice runs to the patient. Not to the provider, and evidence that notice was given is usually what the provider asks to see before producing anything.
Scope should be narrowed. A subpoena for an entire medical history invites an objection; one confined to a condition and a period is usually complied with, as reaching a non-party's records sets out.
The protective regime around health records is often experienced as obstruction, and it is more usefully understood as a formality. Providers are not exercising judgment about whether a request deserves to succeed; they are checking whether the instrument in front of them permits release.
That is why the fastest route, almost always, is through the patient. A person asking for their own record is exercising a right rather than seeking a favor, and the request is handled by a different process with shorter timescales and lower fees.
Where the patient is not cooperative, the calculation changes completely, and the realistic choice is between a subpoena with proper notice and an application for an order. Attempting to persuade a records department to accept something less is time spent for nothing.
The separately protected categories are the trap for the well-prepared. An authorization that would release an entire hospital file will not release the psychotherapy notes, and the omission is discovered only when the file arrives with a gap in it.
Medical evidence arrives constantly in immigration matters, where a waiver, a humanitarian filing or an accommodation at an interview may all turn on what a clinician recorded at the time. Where a filing depends on medical material, practitioners who handle T and U visa evidence deal with the evidentiary requirements regularly and can say what the record actually has to establish.
Throughout, specificity in describing the material shortens everything. Records departments search; they do not investigate. A request naming a department, a period and a document type is answered from a list, and one describing a dispute is answered with a query.
Points to carry away
- The patient has a right of access to their own record in most circumstances.
- A third party needs a written authorization with specified contents.
- Psychotherapy notes are treated separately and more restrictively.
- Providers may charge a reasonable, cost-based fee for copies.
- A subpoena alone is not always enough without notice or an order.
Questions readers ask
Can a provider refuse to release records because of an unpaid bill?
In most systems, no. The right of access to one's own record is generally not conditioned on payment for treatment, and a provider withholding records as leverage over an outstanding account is usually acting outside the rules. What a provider may charge for is the production itself: a reasonable, cost-based fee for copying and postage. Where a refusal on billing grounds is encountered, the practical answer is to cite the access rule in writing, which resolves it more often than not.
How long do providers keep medical records?
Retention periods are set by state law and by professional rules, and they typically run from five to ten years after the last treatment for an adult, with longer periods for records of minors, often measured from the age of majority. Some categories, particularly imaging, are kept for shorter periods than the written record. The practical consequence is that records of an episode from many years ago may genuinely no longer exist, and establishing that is a matter of writing to the provider and keeping the reply.
Does an authorization signed years ago still work?
Usually not. Authorizations are required in most schemes to carry an expiry date or an expiry event, and one that has passed its expiry is no longer effective however clearly it was worded. Even where an authorization has no stated expiry and the scheme permits that, providers frequently decline to act on an old one, on the reasonable view that the patient's position may have changed. A fresh authorization takes a few minutes and removes the argument entirely.
Sources
- 45 CFR § 164.524 — Access of Individuals to Protected Health Informationlaw.cornell.edu
- 45 CFR § 164.508 — Uses and Disclosures for Which an Authorization Is Requiredlaw.cornell.edu
- 45 CFR § 164.502 — Uses and Disclosures of Protected Health Informationlaw.cornell.edu
- Federal Rules of Civil Procedure — Rule 45, Subpoenalaw.cornell.edu
- Legal Information Institute — Privacylaw.cornell.edu
- Legal Information Institute — Physician-Patient Privilegelaw.cornell.edu
True Justice Record is a publication, not a law firm. This article states general rules and cites its sources; it is not advice about any particular case, and the law differs by state and changes over time.
More in Records Somebody Else Holds
Police Reports and Incident Records
A police report records the officer's own observations, the accounts given by others, and the officer's conclusion. Only the first of those is direct evidence. The report is frequently inadmissible for the truth of what it contains, though it remains valuable for identifying witnesses, fixing times and establishing what was said at the scene.
Redactions and What They Conceal
A redaction removes protected content while leaving the rest of the document usable. It should be visible, it should cite the ground relied on, and the remainder should be produced. Silent removal, whole-document withholding where partial production was possible, and over-broad application of an exemption are all challengeable, usually through internal review.
Records Destroyed on Schedule
Retention schedules govern how long each class of record is kept and what happens at the end. They are published by public bodies, required of regulated institutions and adopted internally by most large organizations. Reading the schedule turns an unhelpful nil return into a checkable statement, and identifies which longer-retained record may still answer the question.