How to Find Old Medical Records Online
Medical records are a core part of managing your healthcare, from tracking past diagnoses to giving a new provider the full picture before treatment. Under the HIPAA Privacy Rule, you have a federal right to access and get copies of your own medical records. That right of access is separate from how long a provider has to keep those records in the first place, which is set mainly by state law and varies widely.
Healthcare providers and insurance companies can also share information from your records without a separate authorization from you when it's necessary for treatment, payment, or certain healthcare operations.
This guide covers how to track down medical records that are years or decades old, what to do if a provider denies your request or no longer exists, and what information can be shared about you without your consent.
First Steps to Finding Old Medical Records
Physicians and other healthcare providers must keep a patient's medical and clinical records for a set period, but federal law does not set that period. HIPAA governs your right to access and obtain your records, not how long a provider has to hold onto them; the actual retention period comes from state law and ranges from a few years to multiple decades depending on the state and the type of record. For a full breakdown, see our Medical Records Retention Laws by State guide.
Because medical records are sensitive, both retention and access are subject to legal protections, including rules about who is allowed to see a record and how a patient can request a copy. Locating records from a decade or more ago can still be difficult even where the law entitles you to them. The facility may have closed, or the treating doctor may have retired. The steps below can help.
Review Your Personal Documents
Start with what you already have. Before contacting anyone else, check your own files for prescriptions, discharge paperwork, test results, or old insurance statements. Patients often have more documentation on hand than they remember.
Contact the Hospital or Clinic
If your own files don't have what you need, request the records directly from the hospital or clinic where you were treated. Most healthcare facilities have a formal process, usually through a medical records or health information management department, for releasing records to the patient they belong to.
If there's no clear process in place, send a written request with your full name, current address, date of birth, phone number, and the approximate year and nature of treatment. Be specific about which records you need and why. A narrower request is easier for staff to fill quickly.
Reach Out to Insurance Companies and Other Providers
If the original hospital or clinic can't produce the records, for example because it has closed, try the doctor's other offices or your health insurance company. Insurers typically keep their own claims and billing records tied to the treatment and are far less likely than a small practice to have gone out of business. Send the same written request you sent the provider.
Expect to wait. Under HIPAA's right of access, a covered provider generally has 30 calendar days to respond to a records request, with one 30-day extension allowed if it gives you written notice explaining the delay, so a response can take up to 60 days in total. Keep a copy of your original request.
A provider cannot deny you access to your own records because of an unpaid bill. It may charge a reasonable, cost-based fee for copying and mailing the records, but federal rules bar charging a fee for the time spent searching for or retrieving them.
If a Request Is Denied, Ignored, or the Provider No Longer Exists
A provider that refuses a valid records request, or never responds at all, is not necessarily the end of the road.
- File a complaint. You can file a complaint with the HHS Office for Civil Rights if a covered provider denies your right of access or fails to respond within the required timeframe. OCR investigates HIPAA right-of-access complaints and has taken enforcement action against providers that withhold records.
- Check with your state health department. When a hospital or practice closes, state law typically requires it to name a records custodian and notify the state health department where the records will be stored. The department can often point you to the successor practice, storage vendor, or state agency that now holds the file.
- Ask the state medical board. For a solo practitioner who retired, died, or lost a license, the state medical board may know who took custody of patient records.
- Confirm the retention period hasn't simply expired. If your state's retention period has passed and the provider properly destroyed the records, there may be nothing left to produce. A provider is not required to reconstruct records it was legally allowed to destroy.
Finding Old Medical Records Online
Records from a decade or more ago were often never digitized, so they usually won't show up in an online patient portal even when the underlying paper file still exists. If you specifically need a digital copy and the original provider can't produce one, a third-party medical records retrieval service such as Medchart can request records from multiple providers on your behalf and deliver them to a single online account.
These services still depend on the records existing somewhere. If a provider has already destroyed your records because the state-mandated retention period expired, no retrieval service can recover what no longer exists.
What Is Medchart?
Medchart is a platform that requests and consolidates medical records from healthcare providers, including clinics, hospitals, and pharmacies, on behalf of a patient or an authorized representative such as a family member or attorney. You create an account, authorize Medchart to contact your providers, and review the records through a secure patient portal once they arrive.
Because Medchart is acting as your authorized representative, a provider may contact you directly to confirm your identity and consent before releasing anything. A call or message verifying a Medchart request is a normal part of the process, not a sign of a scam.
Who Can Access Your Medical Records
The right to access your medical records belongs to you or the personal representative you designate.
Providers and health plans may share your records with another provider or plan for treatment or payment purposes, or when you give explicit authorization, without that counting as a HIPAA violation. Outside of treatment, payment, certain healthcare operations, and a short list of situations such as public health reporting, the Privacy Rule generally does not permit a provider to disclose your records to another provider or plan without your authorization.
If you're wondering whether a specific type of result becomes part of your permanent file, see our guide on whether a failed drug test shows up on your medical record. For a state-by-state breakdown of how long a provider has to keep your records in the first place, see Medical Records Retention Laws by State, and for hospital-specific rules, see How Long Do Hospitals Keep Medical Records?
Consult a licensed attorney or your state's health department for advice specific to your situation, especially if a provider has denied a valid records request.
Frequently Asked Questions
How do I get medical records from a doctor's office or hospital that has closed?
Contact your state health department, which typically tracks who was appointed as records custodian when a practice or hospital closes. You can also check with any practice that may have acquired the closed facility, or your health insurer, which usually keeps its own claims and billing records for that treatment.
Can a doctor or hospital refuse to give me my medical records because I owe money?
No. Under HIPAA's right of access, a provider cannot deny you a copy of your own records because you have an unpaid bill. It can charge a reasonable, cost-based fee for copying and postage, but it cannot make payment of an outstanding balance a condition of releasing your records.
How long does a provider have to send my medical records?
Under 45 CFR 164.524, a covered provider generally must act on a records request within 30 calendar days. It may take one additional 30-day extension if it gives you written notice explaining the delay, so a response can take up to 60 days.
Can I be charged a fee for old medical records?
Yes, but the fee must be reasonable and cost-based, and it can only cover copying labor, supplies, and postage. Federal rules specifically bar charging for the time spent searching for or retrieving the records.
What if my old medical records have already been destroyed?
Providers only have to keep records for the retention period set by their state, which varies widely. If that period has passed and the records were properly destroyed, the provider is not required to reconstruct or produce them, though some states still require a destruction log or index to be kept.
What can I do if a provider ignores or wrongly denies my records request?
You can file a complaint with the HHS Office for Civil Rights, which investigates HIPAA right-of-access complaints. Your state health department or state medical board may also be able to help, especially if the original provider has closed.
Updates
Refreshed this guide: fixed several broken internal links left over from the WordPress migration, clarified that HIPAA governs your right to access records rather than how long a provider must retain them, and added guidance on what to do if a provider denies your request, doesn't respond, or has closed.
Sources and References
- 45 CFR 164.524 - Access of Individuals to Protected Health Information(ecfr.gov).gov
- HHS - Individuals' Right under HIPAA to Access their Health Information(hhs.gov).gov
- HHS - May a Covered Entity Charge Individuals a Fee for a Copy of Their PHI(hhs.gov).gov
- HHS - Filing a Health Information Privacy Complaint(hhs.gov).gov
- HHS - Your Medical Records(hhs.gov).gov
- Medchart - Automated Medical Records Retrieval(medchart.com)