Patient Rights: How to Get Your Electronic Health Records

Navigating the healthcare system can feel overwhelming, especially when you need access to your own medical information. You might assume your health records are readily available, but sometimes, hospitals or other healthcare entities might make it harder than it should be. This situation, known as “information blocking,” can prevent you from getting the care you need or understanding your health fully. This guide will walk you through understanding information blocking, knowing your rights under federal law, and taking confident steps to access your electronic health information.

The federal government has taken significant steps to ensure you have access to your health data. The 21st Century Cures Act, signed into law in 2016, created a legal framework to improve the sharing of electronic health information and prohibit practices that interfere with it. Understanding these rules empowers you to assert your rights and get the information you need.

What You’ll Need

• A clear understanding of the specific health records you need.
• Identification, such as a driver’s license, for verification purposes.
• Contact information for your healthcare provider or facility.
• A method for written communication (email, mail, or fax).
• Patience, as the process can sometimes take time.

Step 1: Understand What Information Blocking Means

Information blocking refers to practices by certain entities that are likely to interfere with your ability to access, exchange, or use your electronic health information (EHI). This is true unless the practice is required by law or falls under a specific exception. The 21st Century Cures Act prohibits these practices to ensure a smoother flow of your health data.

This law applies to various “actors” in the healthcare system. These actors include healthcare providers, health information technology (IT) developers of certified health IT, and health information exchanges (HIEs) or health information networks (HINs). For healthcare providers, information blocking occurs when they know their practice is unreasonable and likely to interfere with access, exchange, or use of EHI.

Pro tip: Information blocking provisions began applying to a limited set of data. They expanded to include all electronic health information (EHI) by October 2022. This means the rules cover a wide range of your digital health records today.

Step 2: Know Your Legal Rights to Your Electronic Health Information

Federal laws, especially the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and the 21st Century Cures Act, give you significant rights over your health information. Under HIPAA, you have a legal right to inspect, review, and receive a copy of your health and billing records. These records must be maintained by health plans and healthcare providers covered by HIPAA.

Electronic Health Information (EHI) broadly includes all electronic protected health information found in a “designated record set.” This encompasses medical records, billing records, payment and claims records, and case management records. However, psychotherapy notes and information prepared specifically for litigation are generally excluded from this definition.

You also have the right to choose how you receive your records. You can ask for an electronic copy, such as through a patient portal, email, or even on a USB drive, or a paper copy. Your provider should generally fulfill your request within 30 days.

Watch out: While HIPAA allows providers to charge a reasonable, cost-based fee for making and mailing copies, getting your records electronically through a patient portal or app should often be free.

Step 3: Prepare and Submit Your Request for Records

When you need your health records, a clear and direct approach is usually best. Many healthcare providers offer patient portals, which are often the quickest way to access your records digitally. Check your provider’s website first; they often have a “Contact Us” section or a dedicated page for medical records requests.

If an online portal isn’t available or doesn’t provide all the information you need, you can submit a written request. This typically involves completing an authorization form provided by the facility. Be sure to clearly state what specific records you need, the dates of service, and how you prefer to receive them.

When submitting a written request, include your full name, date of birth, and any patient identification numbers. You may also need to provide a photo ID. If you are requesting records for someone else, like a minor child or an incapacitated adult, you will likely need to provide proof of your legal authority, such as a Medical Power of Attorney.

Pro tip: Keep a copy of your request and note the date you submitted it. This documentation can be helpful if you encounter any delays or issues.

Step 4: Recognize and Respond to Potential Information Blocking

Even with clear laws, you might still encounter practices that feel like roadblocks. It is important to recognize common forms of information blocking. For instance, charging excessive fees beyond the reasonable cost of making copies can be considered information blocking. Similarly, limiting the time you have to access your requested information, such as providing access for less than 48 hours, may also constitute information blocking.

Another common issue involves providers refusing to transfer your electronic health information to a third party you designate, such as another doctor or a health app, without a valid reason under the exceptions. Policies that require your written consent for sharing EHI with unaffiliated providers for treatment purposes, when such consent is not legally required, can also be a form of information blocking.

Even delaying the release of lab or imaging results to you, simply to allow a clinician to review them first, would likely be considered an interference for purposes of information blocking. While there are legitimate exceptions, such as preventing harm or protecting privacy and security, these must meet specific conditions. Not every practice that delays access is information blocking, but the intent to interfere, without a valid exception, is key.

Watch out: If a provider offers images on outdated media like CD-ROM or denies requests for records in a specific electronic format they are capable of providing, this could also be considered information blocking.

Step 5: File a Complaint if Your Rights are Violated

If you believe you have experienced information blocking, you have the right to report it. The Office of the National Coordinator for Health Information Technology (ONC) provides an online “Report Information Blocking Portal” on HealthIT.gov. You can submit a claim through this portal, and you have the option to remain anonymous.

When submitting a claim, you will be asked to describe the event and attach any evidence you have. The ONC reviews these claims and may share details with the HHS Office of Inspector General (OIG) for further investigation. The OIG has the authority to investigate and impose penalties.

The consequences for information blocking vary depending on the actor involved. Health IT developers, health information networks, and health information exchanges can face civil monetary penalties of up to $1 million per violation. These penalties for such entities became effective on September 1, 2023.

For healthcare providers, engaging in information blocking can lead to “appropriate disincentives” tied to Centers for Medicare & Medicaid Services (CMS) programs. For example, under the Medicare Promoting Interoperability Program, eligible hospitals could lose 75% of their annual market basket increase. MIPS-eligible clinicians may receive a zero score in the Promoting Interoperability performance category. These provider disincentives became effective on August 30, 2024.

Pro tip: The ONC encourages reporters not to send personal health information or actual medical records through the portal. Focus on describing the practice that interfered with your access.

Taking Confident Next Steps

Accessing your health data is a fundamental right that empowers you to make informed decisions about your care. By understanding what information blocking is, knowing your rights under HIPAA and the 21st Century Cures Act, and following the steps outlined in this guide, you can confidently navigate the process of obtaining your medical records. If you encounter resistance, remember that federal agencies are in place to help enforce these important patient protections. Taking action not only helps you but also contributes to a more transparent and patient-centered healthcare system for everyone.

Sources

• ONC – Office of the National Coordinator for Health Information Technology — Information Blocking
• Washington University in St. Louis — Patient Rights Over Their Health Information | HIPAA Privacy Office
• ONC – HealthIT.gov — Information Blocking Exceptions
• The HIPAA Journal — Patient Rights Under HIPAA – Updated for 2026
• American Medical Association — Patient Access Playbook: Legal requirements