How to get your parent's medical records

There are three routes: your parent asks for their own records, your parent signs a HIPAA authorization naming you, or you are their legal personal representative. Here is what each takes, and what the rules say about timing and fees.

Last checked against the sources below: October 23, 2026.

Your parent's right to see and copy their records

HIPAA's right of access lets a person inspect and get a copy of their health information held in a provider's or health plan's "designated record set" [1]. HHS says this includes medical records and billing records held by providers and plans covered by the Privacy Rule [6]. The main exceptions are psychotherapy notes and information gathered for legal proceedings [1][6].

A provider may require requests in writing if it tells patients so. If your parent asks for an electronic copy of records kept electronically, the provider must provide one, in the format requested if it is readily producible [1].

How long does a provider have to send medical records?

The rule says the provider must act on the request:

"...no later than 30 days after receipt of the request..." (45 CFR 164.524(b)(2)) [1]

If it can't, it may take up to 30 more days, but only once, and only if it gives a written statement of the reasons and the date it will finish within the first 30 days [1]. HHS notes that doctors can often provide records much sooner, and that a patient portal may let your parent view and download information at any time [7].

What can they charge for copies?

A "reasonable, cost-based fee" that covers only: labor for copying, supplies (paper, or portable media if requested), postage if mailed, and preparing a summary if your parent agreed to one [1]. HHS says a provider can't charge for searching for or retrieving records, and can't refuse a copy because a bill is unpaid [6].

One limit: HHS says the fee rules apply to a person's request for their own records, not to a request to send records to a third party [8].

Route 1: Your parent requests their own records

If your parent can manage it, this is the simplest route: your parent requests the copies and shares them with you. The request can also direct the provider to send a copy straight to you, but it must be:

"...in writing, signed by the individual, and clearly identify the designated person and where to send the copy..." (45 CFR 164.524(c)(3)(ii)) [1]

A 2020 federal court order limited this send-to-someone-else option to electronic copies of electronic health records, and the fee limit doesn't apply to it [8]. If the records office points you to its authorization form instead, that is Route 2.

Route 2: A HIPAA authorization that names you

Your parent can sign an authorization that lets a provider disclose information to you. To be valid, it must include at least [3]:

a specific description of the information;
who may disclose it (the provider);
who may receive it (you);
the purpose ("at the request of the individual" is enough when your parent starts it);
an expiration date or event;
your parent's signature and the date.

It must also tell your parent about the right to revoke it in writing [3]. Most records offices have their own form. If your parent sees several providers, ask each one which form it wants.

Route 3: You are your parent's personal representative

HIPAA requires providers to treat a "personal representative" as the patient, including for access to records [2][4]. For an adult, that is a person with authority under applicable law to make health care decisions for them [2]. HHS gives these examples [4]:

a health care power of attorney;
a court-appointed legal guardian;
a general or durable power of attorney that includes the power to make health care decisions.

The scope follows the document. If the authority covers only certain decisions, HHS says the representative is treated as the patient only for information relevant to them, and that state or other law determines the authority [4]. Send a copy of the document with your request.

Exceptions. A provider may choose not to treat someone as the personal representative if it reasonably believes that person might endanger the patient in situations of domestic violence, abuse or neglect [5].

"I'm family. Isn't that enough?"

Not for copies. HHS says the Privacy Rule doesn't require providers to share information with family unless they are personal representatives, though providers may share with family involved in your parent's care, for example when your parent doesn't object [9]. For copies, use one of the three routes.

What to put in a records request

The provider's name and its records office address, fax or portal
Your parent's full name, date of birth and any patient ID number
The date range you need
What you want: visit notes, hospital discharge summaries, test results, imaging reports, billing records
The format (electronic or paper) and where to send it
Your parent's signature and date, plus the authorization or power-of-attorney copy if you are using Route 2 or 3
The date you sent it, and the date 30 days later

Turning a pile of paperwork into one binder? Our Parent Binder puts visit notes, medication lists, Medicare statements and bills in date order, with every line cited to its page, and drafts letters for you to review and send. See how it works.

Sources

LII / Cornell Law School, "45 CFR § 164.524 - Access of individuals to protected health information" (as amended Feb. 6, 2014; read October 23, 2026).
LII / Cornell Law School, "45 CFR § 164.502 - Uses and disclosures of protected health information: General rules" (as amended Apr. 26, 2024; read October 23, 2026).
LII / Cornell Law School, "45 CFR § 164.508 - Uses and disclosures for which an authorization is required" (as amended Jan. 25, 2013; read October 23, 2026).
HHS Office for Civil Rights, "Personal Representatives" (guidance on 45 CFR 164.502(g)) (content last reviewed January 5, 2024; read October 23, 2026).
HHS Office for Civil Rights, "Personal Representatives" (for individuals) (content last reviewed November 2, 2020; read October 23, 2026).
HHS Office for Civil Rights, "Your Medical Records" (content last reviewed May 30, 2025; read October 23, 2026).
HHS Office for Civil Rights, "Get it. Check it. Use it." (right to access) (content last reviewed July 31, 2026; read October 23, 2026).
HHS Office for Civil Rights, "Important Notice Regarding Individuals' Right of Access to Health Records" (content last reviewed January 28, 2020; read October 23, 2026).
HHS Office for Civil Rights, "Family Members and Friends" (content last reviewed December 23, 2022; read October 23, 2026).

General information to help you organize, not medical, legal or financial advice. Rules change and individual situations differ: check the official source, the notice you received, or a qualified professional. Starry Night is not affiliated with or endorsed by Medicare, CMS, HHS or any health system.