How to Submit and Track a Medical Records Request

Last updated Jun 28, 2026

Getting your medical records doesn't have to be complicated. This guide walks you through every step — from filling out the right forms to following up when things take longer than expected. Whether you're requesting records for yourself, a family member, or a legal case, you'll find what you need here.

What Is a Medical Records Request?

A medical records request is a formal ask for copies of your health information held by a provider, hospital, or specialist. This can include visit notes, lab results, imaging, medication history, billing records, and more.

Under HIPAA (the Health Insurance Portability and Accountability Act), you have a legal right to access your own records. Providers are required to respond. They can charge a reasonable fee for copying and mailing, but they cannot simply refuse.

Who Can Request Medical Records?

Wondering if someone else can request your medical records for you? Here's who has the right to submit a request:

The patient themselves — always, with valid ID
A parent or legal guardian — for a minor child
An authorized personal representative — someone with written legal authority (such as a healthcare power of attorney)
A deceased patient's executor or next of kin — depending on state law
An attorney or their staff — with a signed HIPAA authorization from the patient (see the PI section below)

Can you get medical records without authorization? No. A provider cannot legally release records to a third party without a valid HIPAA authorization form signed by the patient or their legal representative. There are narrow exceptions — such as court orders or public health reporting — but for routine requests, authorization is required.

What You Need Before You Submit: HIPAA Authorization Requirements

Before you submit, gather this information. Missing or incorrect details are the most common reason a request gets rejected or delayed.

Required information for most requests:

Your full legal name (as it appears in the practice's records)
Date of birth
Last four digits of your Social Security number (some practices require it)
Contact information — address, phone, and email
The name and address of the practice you're requesting from
The date range for the records you need (e.g., January 1, 2022 – present)
The type of records you're requesting (visit notes, labs, imaging, billing, or all records)
How you want the records delivered — electronic, paper, or fax
The purpose of the request (personal use, continuing care, legal, insurance)
Your signature and the date

What makes a HIPAA authorization form invalid?

Missing signature or date
Expired authorization (most forms are valid for 90–180 days; check the expiration field)
Name or date of birth doesn't match the patient on file
The records requested are too vague ("all records" is fine; leaving the type field blank is not)
The form used was not accepted by that practice (some practices use their own forms)

Tip: Call the practice's medical records department before you submit. Ask whether they accept a standard HIPAA release form or require their own version. This one step can save you days of back-and-forth.

{{screenshot: Example HIPAA authorization form with required fields highlighted}}

How to Submit a Medical Records Request: Step-by-Step

Here's how to request medical records from your provider:

Identify the right contact. Call the practice and ask for the medical records department or health information management (HIM) team. Not the front desk — the records team handles this specifically.
Ask about their preferred submission method. Online portal, fax, email, or in-person — practices vary. Using the wrong method can cause delays.
Complete the authorization form. Use the practice's own form if they require one. Otherwise, a standard HIPAA release form works. Fill in every required field (see the list above).
Attach a copy of your ID. Most practices require a government-issued photo ID. Attach it to your submission or bring it in person.
Submit the request. Use the method the practice confirmed — portal upload, fax, email attachment, mail, or in-person drop-off.
Get a confirmation. Ask for a confirmation number, email, or timestamp. If you submit by mail, use certified mail with return receipt. This is your proof of submission.
Note the expected turnaround date. Ask the staff member when you can expect the records. Write it down.

{{screenshot: Medximity provider profile page showing contact information for a practice's records department}}

Electronic vs. Paper Submission: Which Is Faster?

Patients often ask whether an online vs. paper medical records request is faster. The short answer: electronic is almost always quicker.

Method Typical Speed Best For Watch Out For Patient portal (online) 1–5 business days Routine records, personal use Not all records are available through portals Fax 2–5 business days Legal cases, insurance, provider-to-provider Confirm the fax number is correct before sending Email (secure) 2–5 business days Practices with secure email systems Standard email is not HIPAA-compliant; confirm the practice uses secure email Mail (paper) 2–4 weeks When no electronic option is available Slowest method; use certified mail In-person Same day to 5 business days Urgent needs or complex requests Hours vary; call ahead

Looking for an electronic medical records request portal for a specific provider? Search for the practice on Medximity to find their contact information and check whether they offer a patient portal.

Realistic Timelines: How Long Does a Medical Records Request Take?

HIPAA gives providers 30 calendar days to fulfill a records request. They can extend this once by 30 additional days if they notify you in writing. That means the legal maximum is 60 days.

In practice, timelines vary:

Patient portal downloads: Often immediate or within 1–3 days
Standard electronic requests (fax or portal upload): 5–15 business days for most practices
Paper requests by mail: 3–6 weeks when accounting for mailing time both ways
Imaging records (X-rays, MRI, CT): May take longer if records must be copied to a disc or external format
Legal or insurance requests: 2–4 weeks is typical; some practices prioritize these
Large health systems or hospitals: Can take up to 30 days even for routine requests due to volume

Tip: Submit as early as possible. If you have a deadline — an attorney's court filing, an insurance review, a specialist appointment — add at least two weeks of buffer.

How to Track Your Request After Submission

Most practices don't send automatic status updates. You'll need to follow up yourself. Here's how to track the status of your medical records request:

Confirm receipt (Day 1–2). If you haven't received a confirmation within 48 hours of submitting, call or email the records department to verify they received your request.
Check your patient portal. Some practices post completed records directly to the portal. Log in and check the "Documents" or "Health Records" section.
Follow up at the midpoint. If you're expecting a 15-business-day turnaround, check in around day 8 to confirm processing is on track.
Request a status update in writing. Email creates a paper trail. Ask: "Can you confirm the status of my records request submitted on [date]?"
Document every contact. Write down the date, the name of the person you spoke with, and what they told you. This matters if you need to escalate.

What to Do If Records Are Delayed, Incomplete, or Denied

If your medical records request is taking too long, or if you received records that are incomplete or were denied outright, here's how to respond:

If records are delayed past 30 days:

Contact the records department and ask for a written status update.
Ask whether a 30-day extension was issued and whether you were notified (HIPAA requires written notice if an extension is taken).
Escalate to the practice manager or compliance officer if you receive no response.
File a complaint with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights if the provider continues to be unresponsive after the 60-day window.

If records are incomplete:

Compare what you received against what you requested. Make a specific list of missing items (e.g., "lab results from March 2023 are not included").
Contact the records department with your list. Ask them to confirm whether those records exist and why they were not included.
Submit a written amendment request if the practice claims the records are complete but you believe information is missing or incorrect.

What to do if a medical records request is denied:

Ask for the denial in writing, with the specific reason stated.
Review the reason. Common valid reasons include: the records don't exist, the request is for psychotherapy notes (which have separate rules), or the form was incomplete.
Correct and resubmit if the denial was due to a form error.
File a grievance with the practice if the denial appears unjustified.
Contact the HHS Office for Civil Rights if the denial violates your HIPAA rights.

Medical-Legal Use Cases: What Attorneys and PI Staff Need to Know

The personal injury attorney requesting medical records process follows the same HIPAA rules as any other request — but there are important differences in how requests are typically managed.

What's required for attorney-submitted requests:

A valid HIPAA authorization form signed by the client (the patient), not by the attorney
The client's name, date of birth, and the specific date range or incident date
A clear statement of purpose (e.g., "for use in personal injury litigation")
The attorney's contact information and the name of the firm requesting on behalf of the client

Letters of protection and liens:

In personal injury cases, some providers treat patients under a letter of protection (LOP), agreeing to defer payment until the case settles. When records are requested in this context, the records request itself is separate from the lien. Attorneys should request records and billing records separately, and should confirm with the practice whether a lien is on file before submitting.

Tips for PI staff managing multiple requests:

Create a tracking log for each client with the submission date, the practice name, the expected turnaround, and the follow-up schedule
Use fax with confirmation sheets for every submission — this creates an audit trail
Note whether the practice uses a third-party records fulfillment service (such as Ciox or MRO) — requests may need to be routed to them directly
Build in at least 45 days before any filing deadline to account for delays and resubmissions

If your client is navigating ongoing care related to their injury — such as chiropractic treatment or pain management — you may find Medximity's provider directory useful for locating treating providers and confirming their contact details for records requests.

What Providers Need to Have in Place to Fulfill Records Requests

If you're a chiropractic, physical therapy, or other practice receiving records requests, here's what an efficient fulfillment process looks like:

A designated records contact. Front desk staff should not be the default handler. Assign a staff member or use a third-party fulfillment service.
A standard HIPAA authorization form. Post it on your website and inside your patient portal so requesters can access it before calling.
A request log. Track every request received — date, requestor, type, status, and fulfillment date. This is essential for compliance and dispute resolution.
A clear turnaround commitment. Communicating a standard turnaround (e.g., "We fulfill records requests within 15 business days") reduces follow-up calls and sets accurate expectations.
Separate billing records workflow. Medical and billing records are often requested together in legal cases. Have a process to pull both without cross-department delays.

A well-organized records process also protects your practice's reputation. Patients dealing with injuries or ongoing conditions — including those managing issues covered in resources like our guide on right arm pain management or fibromyalgia treatment options — are often coordinating care across multiple providers. Practices that respond quickly to records requests build trust and keep referral relationships strong.

Quick Reference: Records Request Checklist

☐ Confirm the practice's preferred submission method
☐ Use the practice's HIPAA authorization form (or confirm a standard form is accepted)
☐ Complete all required fields — no blanks
☐ Attach a copy of your photo ID
☐ Specify the date range and record types you need
☐ Submit and get a confirmation
☐ Note the expected completion date
☐ Follow up at the midpoint if you haven't heard back
☐ Document all contacts and responses

Still Need Help?

If you're having trouble locating a provider's records department or finding the right contact for your request, the Medximity provider directory can help. Search by specialty and location to find verified contact information for practices near you.

Search for a provider: medximity.com
Contact Medximity support: Use the Help button at the bottom of any page

This article provides general guidance on the records request process. It is not legal advice. For questions specific to your situation, consult a healthcare attorney or your state's patient rights office.