How to Request, Organize, and Transfer Your Medical Records

When you are switching doctors, moving to a new city, managing a chronic condition, or simply trying to make sense of your own health history, your medical records become your roadmap. The good news is that in the United States, you have strong rights to access your health information. The tricky part is knowing how to ask, what to ask for, and how to keep everything secure and actually useful once you get it.

As a family nurse practitioner, I have seen how much smoother care becomes when patients arrive with the right records in hand. This guide will walk you through requesting, organizing, and transferring your medical records, with practical scripts, checklists, and safety tips you can use right away.

Your rights under HIPAA

What you can typically access

• Visit notes from primary care and specialists
• Lab results and pathology reports
• Imaging reports like X-ray, CT, MRI results, and often the images themselves
• Medication lists and allergy lists
• Immunization records
• Hospital records including discharge summaries, operative notes, and ER notes
• Billing and claim information (from the entity that maintains it, such as your clinic for clinic billing records and your health plan for claims and explanation of benefits)

What may be limited or handled differently

• Psychotherapy notes are treated differently than regular mental health records. These are a therapist’s separate, private notes documenting the contents of counseling sessions. In contrast, most general mental health records (diagnoses, medication lists, appointment dates, treatment plans) are usually accessible.
• Information involving another person’s privacy may be redacted.
• Records held by some third parties (for example, certain apps that are not HIPAA-covered) may not fall under the same rules.

When access can be denied

Denials are uncommon, but HIPAA allows limited exceptions. For example, a provider may deny access in certain circumstances related to safety, information compiled for legal proceedings, or other narrow situations. If you are denied, ask for the decision in writing and ask whether you have a right to have the denial reviewed.

Timelines and fees

Under HIPAA, providers and plans generally must respond within 30 days of your request. They can take one 30-day extension, but they should give you written notice explaining why and when you can expect the records. Some states require shorter timelines, so your local rules may be more strict than HIPAA.

They can charge a reasonable, cost-based fee for copying and delivering records. In general, that can include labor for copying, supplies (paper, CD, USB), and postage. It generally should not include “search” or retrieval fees. Many offices now provide portal access or electronic copies at low or no cost, and if an electronic copy is readily producible, you can usually request it electronically.

If an office tells you, “We cannot send records to you, only to another doctor,” pause right there. Under HIPAA, you generally have the right to receive your own records in the form and format you request if it is readily producible.

Decide what you need

Not every situation requires every page of your chart. Being specific can save you time, money, and frustration.

Common situations

• New primary care provider: problem list, medication list, allergies, immunizations, last 2 years of progress notes, recent labs, major imaging reports, hospital discharge summaries.
• New specialist: referral note, recent visit notes related to the condition, relevant labs and imaging, operative reports if applicable.
• Chronic condition management: baseline diagnostic workup, medication history, trend labs (like A1C for diabetes), specialist notes, care plans.
• Pregnancy or fertility care: OB history, ultrasound reports, prenatal labs, delivery records, complications documentation.
• Keeping a personal health file: start with the core checklist below plus anything you would want in an emergency.

Examples of being specific

• “Last cardiology visit note and most recent echocardiogram report.”
• “GI consult note, colonoscopy report, and pathology from the biopsy.”
• “Orthopedics note plus the MRI report and the MRI images.”

Core checklist

If you are building your own health file, I recommend starting with this set:

• Current medication list (dose, frequency, prescriber)
• Allergies and reactions
• Active diagnoses and past major diagnoses
• Immunization record
• Most recent preventive screenings (Pap, mammogram, colon cancer screening, etc.)
• Last year of lab results (or key trend labs for chronic conditions)
• Imaging reports for major issues (and image files if you can get them)
• Surgical history and operative reports
• Hospital discharge summaries
• Advance directive or healthcare proxy documents, if you have them

How to request records

Step 1: Find the right department

Start with the facility’s Medical Records or Health Information Management (HIM) department. For clinics, it may be the front desk or a centralized records team. Many health systems also have a records request form online.

Step 2: Choose a format

Whenever possible, request electronic delivery because it is faster and easier to store and share.

• Patient portal download: great for quick access, but may not include everything.
• Secure email or encrypted link: convenient if offered.
• USB drive or CD: common for imaging files.
• Paper copies: sometimes necessary, but bulky and harder to manage.

Step 3: Send a complete request

A strong request includes:

• Your full name and date of birth (and MRN if you know it)
• Your contact information
• What you want (be specific)
• Date range
• Preferred format and delivery method
• Where to send it (you, a caregiver, or a new provider)
• Your signature and the date (and any ID requirements)

What to say

Phone script: “Hi, I would like to request a copy of my medical records. Can you tell me the best way to submit an authorization for release of information, and whether you can send the records electronically? I would like [specific items] from [date range].”

Written request example: “Please provide me with an electronic copy of my designated record set, including visit notes, lab results, imaging reports, and discharge summaries from January 2023 to present. Please send via [secure portal download/secure email/USB].”

Step 4: Verify identity and track it

Expect to show a photo ID or answer identity verification questions. Ask for a reference number if they have one, and write down the date you submitted the request. If you have not heard back in 2 weeks, follow up.

Step 5: Request imaging the right way

If you need X-rays, CTs, or MRIs for a new specialist, ask for both:

• The radiology report (the written interpretation)
• The image files (often on a CD or via an online sharing platform)

Specialists frequently need the actual images, not just the report.

Safety note: If you receive a CD or USB, treat it like any other file from outside your computer. Many clinics prefer portal upload or official image-sharing links, and some offices cannot accept external drives.

Organize and store securely

Once records arrive, the next challenge is making them usable. You do not need a fancy system. You need a system you will actually maintain.

Simple folder structure

If you are storing records digitally, create folders like these:

• 00 Health Summary (your one-page snapshot)
• 01 Medications and Allergies
• 02 Primary Care
• 03 Specialists
• 04 Labs
• 05 Imaging
• 06 Hospital and ER
• 07 Vaccines and Preventive Care
• 08 Insurance and Billing

Make a one-page summary

This is the document I wish every patient carried. Keep it updated and bring it to appointments. Include:

• Full name, date of birth, emergency contact
• Medical conditions (active and major past)
• Surgeries and hospitalizations (with dates if possible)
• Current medications and allergies
• Key clinicians (primary care and specialists)
• Pharmacy name and phone

Pick storage that fits your comfort level

• Encrypted cloud storage can be convenient if you use a strong password and two-factor authentication.
• Local storage (password-protected computer, encrypted external drive) gives you more control, but make backups.
• Paper binder works well for some families, especially for children with complex care, but keep it in a safe, private place.

Protect your privacy

Medical records contain highly sensitive information. Practical safety steps:

• Use strong, unique passwords and turn on two-factor authentication where possible.
• Avoid sending records through regular email unless you accept the risk or the recipient provides a secure option.
• Do not store unencrypted files on shared computers.
• Shred paper copies you no longer need.

Transfer records to a new provider

There are two reliable approaches: provider-to-provider transfer and patient-carried transfer. In real life, using both often works best.

Option 1: Provider-to-provider

Your new clinic can send a request to your prior clinic, typically using a Release of Information form. This can bring over more complete documentation, but it may take time.

Tip: Ask your new provider’s office exactly what they need and where to send it. Many delays happen because records go to the wrong fax number or department.

Option 2: Patient-carried

If you have records in hand, you can upload them to a portal, bring printed summaries, or deliver a CD (especially for imaging). This is helpful when you have a tight appointment window.

What to send first

If you need to get something over quickly, send:

• Medication list and allergies
• Most recent visit note related to the issue
• Recent labs
• Imaging report and images if applicable
• Hospital discharge summary if the issue involved a hospitalization

Follow-up checklist

• Confirm the new office received the records (do not assume).
• Ask if anything is missing before your appointment.
• Bring a backup: your one-page health summary and a small set of key results.

Interoperability shortcuts

Some health systems can share records through health information exchanges or “share” features in patient portals. If both offices use compatible systems, ask whether they can pull your outside records electronically. Even then, I still recommend keeping your own copy of key documents.

Common roadblocks

“We cannot release records because you have a balance.”

Under HIPAA, a provider generally may not withhold your right of access to your designated record set because of unpaid bills. Billing disputes and records access are separate.

“It will take 6 to 8 weeks.”

Ask for clarification. HIPAA generally requires action within 30 days (with one possible extension and notice). If they are overwhelmed, request a smaller set of urgent records first, such as a recent note, medication list, and last labs.

“We only provide paper copies.”

You can request the form and format you prefer if readily producible. If they truly cannot produce an electronic copy, ask for the most organized paper version they can provide, such as a printed continuity of care summary plus key documents.

“My portal does not show everything.”

This is common. Portals often display labs and messaging but not full historical notes or outside records. Submit a formal request for the items that are missing.

“I need records from years ago.”

Facilities have record retention policies that vary by state and type of record. Ask what they still have and whether older records are archived. If you think you may need older records, request them sooner rather than later.

Fix errors in your record

If something is wrong, you can request an amendment under HIPAA. In practice, the record is often not “deleted.” Instead, the provider may add a correction or an addendum that becomes part of your chart.

• Be specific about what is incorrect and what the correct information should be.
• Include supporting documents when relevant (for example, a lab report, imaging report, or outside specialist note).
• If an amendment is denied, you can usually submit a written statement of disagreement that is attached to the record.

Special situations

Records for a child or dependent

Parents and legal guardians usually can access a minor child’s records, but rules can change for certain services (like sexual health, mental health, and substance use treatment) depending on state law and the child’s age. If you are told access is restricted, ask what documentation is needed and whether a partial release is possible.

Substance use treatment (42 CFR Part 2)

Some substance use treatment records have extra federal protections and require more specific consent to release. If this applies to you, your treatment program can explain what can be shared and how.

If you are hospitalized

Before discharge, request:

• Discharge summary
• Medication reconciliation list
• Follow-up plan and pending test results

These documents prevent a lot of “lost in transition” moments when you follow up with your primary care clinician.

When to escalate

If you believe you are being improperly denied access or facing unreasonable barriers, you can:

• Ask to speak with the facility’s Privacy Officer or HIM manager.
• Document names, dates, and what you were told.
• File a complaint with the U.S. Department of Health and Human Services Office for Civil Rights (OCR) if needed.

Escalation does not have to be confrontational. A calm, clear request and a paper trail often resolve the issue quickly.

Quick FAQ

Do I have to use the provider’s release form?

Many offices prefer it, but a written request with the required elements is often acceptable. Using their form usually speeds things up.

Can I ask them to email my records?

You can ask. If you request unencrypted email, you may be asked to acknowledge the privacy risk. Many systems now offer secure links or portal delivery, which is safer.

Should I send my entire chart to a new doctor?

Not always. For most new primary care relationships, a summary plus recent and relevant documents is more helpful than hundreds of pages. For complex cases, bigger transfers can make sense.

What is the difference between a “summary” and “full records”?

A summary might include problem lists, medications, allergies, immunizations, and recent results. Full records include detailed notes, consults, historical results, and attachments across a broader time range.

Final note

If managing your medical records feels like a part-time job, you are not imagining it. Our healthcare system can be fragmented, and the burden often falls on the patient. Start small. Get your core documents, build your one-page summary, and keep a simple folder you can update. Each step you take makes it easier to get safer, more coordinated care the next time life changes or a health issue surprises you.