Am I Entitled to a Copy of My X-Rays Under HIPAA?

Yes. Under HIPAA, you are entitled to a copy of your X-rays from any healthcare provider or imaging facility that has them on file. The law treats medical images the same as any other health record, so a provider cannot refuse to release them simply because they are pictures rather than written notes. That right applies whether you want the images for a second opinion, an insurance claim, a personal injury case, or your own files.

Why X-Rays Fall Under the Access Right

HIPAA’s access rule reaches what the regulations call the “designated record set,” meaning everything a provider keeps on file to make decisions about your care. That includes written notes, lab results, billing records, and medical images such as X-rays, MRIs, and CT scans.¹ You are also entitled to the radiologist’s written interpretation, since diagnostic reports sit in the same record set.

Two narrow categories are carved out of the access right: psychotherapy notes a therapist keeps separate from your chart, and information compiled for use in legal proceedings. Neither typically touches imaging.

Your right to request X-rays lasts as long as the provider still has them. Medicare providers must retain imaging records for at least seven years from the date of service.² State retention rules vary, with some requiring as few as five years and others mandating indefinite preservation, so how far back you can reach depends partly on where you were treated.

How to Ask for Your X-Rays

A provider can require you to put the request in writing, and many hand out a standard release form for that purpose.¹ Using the facility’s form is fine, but the provider cannot force you to use it if that creates an unreasonable barrier. A plain letter identifying you, the records you want, and the format you prefer meets the legal requirement.

Include enough detail for the records department to find the right files: your full name, date of birth, the approximate date of the imaging, and the body part involved. “Chest X-ray series, March 2025” beats “all my X-rays.” If you want the records sent to another provider, an attorney, or anyone else, that instruction must be in writing with your signature and must clearly identify the recipient and where to send them.¹

You can usually submit the request in person, by mail, by fax, or through a secure patient portal if one is available. Keep a copy and note the date you sent it. The provider’s response clock starts when they receive the request.

What Format You Can Request

You have the right to ask for your X-rays in a specific electronic format, and the provider must accommodate that request if the format is readily producible. If the exact format you asked for is not possible, the provider must offer an alternative readable electronic format. Only if no electronic option is feasible can the provider fall back to a hard copy.³

Medical images are stored in a standardized format called DICOM, which preserves full diagnostic quality. When a facility gives you X-rays on a CD or USB drive, the disc usually includes a built-in viewer so you can open the images on a home computer without buying special software.⁴ If a disc arrives in a proprietary format that only works with one manufacturer’s software, the facility must replace it with a standard DICOM version at no extra charge. Many providers also offer secure download links or portal access instead of physical media.

How Long the Provider Has to Respond

HIPAA gives the facility 30 calendar days from the date it receives your request to produce the records. If the facility cannot meet that deadline, it can take one additional 30-day extension, but only if it sends you a written notice within the first 30 days explaining the delay and giving a specific date you can expect the records.⁵ In practice, many imaging departments can burn a CD or upload files within a few business days. A provider that routinely pushes the full 30-day window on straightforward requests is worth flagging in a complaint.

What It Should Cost

Providers can charge for copies, but HIPAA limits the fee to a “reasonable, cost-based” amount. The allowable charges cover only three things: labor for the actual copying, supplies like a CD or USB drive, and postage if you ask for the records to be mailed.⁶ The provider cannot bill you for time spent searching for records, maintaining its systems, or verifying your identity.

For electronic copies of records already stored electronically, the provider has a simpler option: a flat fee of no more than $6.50 covering labor, supplies, and postage combined.⁷ Since most X-rays are stored digitally, that cap applies to the majority of imaging requests. Some state laws prohibit fees entirely or set lower caps, and when a state law gives you a better deal than HIPAA, the state law controls.¹

You also have the right to inspect your records in person at no charge. If you photograph the images with your phone or take notes during that visit, no fee applies because the provider is not doing any copying.⁹

When a Provider Can Deny Access

Denials are allowed only under a narrow set of circumstances written into the HIPAA regulations. Some are final; others give you the right to a second review.

Denials That Cannot Be Appealed

A provider can refuse access without offering a review when the request involves psychotherapy notes, information compiled for litigation, records tied to a clinical trial you agreed to suspend access for, certain requests from incarcerated individuals where release would jeopardize safety, or information provided by a confidential source that would be revealed by disclosure.8HHS.gov. Individuals’ Right under HIPAA to Access their Health Information These grounds almost never apply to X-rays.

Denials You Can Challenge

Other denials trigger your right to a second review by a different licensed healthcare professional who had no role in the original decision. Those situations involve a provider determining that access could endanger you or someone else, that releasing records referencing another person could cause that person substantial harm, or that giving a personal representative access could harm the patient.¹⁰ The endangerment standard is high and is almost never applied to imaging results.

Whatever the reason, the provider must give you a written explanation for any denial.

Filing a Complaint if You Are Wrongly Denied

If a provider ignores your request, misses the deadline, charges more than the rules allow, or denies access without a valid reason, you can file a complaint with the HHS Office for Civil Rights (OCR). The fastest route is the OCR online complaint portal, though you can also file by mail, fax, or email.¹¹

Your complaint needs to identify the provider, describe what happened, and include your name and contact information. You have 180 days from when you first learned about the violation to file, though OCR can extend that deadline for good cause.¹¹ A firm follow-up letter citing HIPAA’s access right and the 30-day deadline often resolves things before you get that far. Most facilities would rather hand over a CD than deal with a federal investigation.

A separate track exists under the 21st Century Cures Act, which prohibits “information blocking” — providers who can deliver records electronically but add unnecessary hurdles instead. Complaints go to the Office of the National Coordinator for Health IT, and violations can carry penalties of up to $1 million per incident, enforced by the HHS Office of Inspector General.¹²

Requesting X-Rays for a Child or a Deceased Family Member

Parents generally have the same access rights as their minor child and can request the child’s X-rays directly. Access can be limited if state law lets the minor consent to certain care without a parent, if the child is receiving care under a court order, or if the parent agreed to a confidential relationship between the child and the provider. A provider can also withhold records from a parent if a healthcare professional reasonably believes the child has been or may be subjected to abuse.¹³

For a deceased patient, the personal representative of the estate — typically the executor or administrator — can exercise the same access rights the patient would have had. HIPAA protects a deceased person’s health information for 50 years after death, so these access rights persist for decades.¹⁴ Family members involved in the patient’s care or payment before death may also receive limited disclosures, unless the deceased previously indicated otherwise.