Can a Doctor Withhold Medical Records Under HIPAA?

A doctor generally cannot withhold your medical records. Federal law under HIPAA gives you the right to inspect and get copies of your health information, and a provider can only refuse in a handful of narrow situations spelled out in the regulations. Refusing for reasons outside those exceptions, including unpaid bills or a decision to switch doctors, violates federal law.¹

Your access right is broad. It covers everything in what HIPAA calls the “designated record set”: clinical chart notes, lab and imaging results, billing and payment records, insurance enrollment information, consent forms, and any other information a provider or health plan used to make decisions about your care.² You also do not have to explain why you want them.³

When a Doctor Can Legally Refuse

The exceptions fall into two groups. Some denials are final. Others must be offered up for a second opinion inside the same practice or organization.

Denials That Are Final

A provider can refuse access without any right of review in these situations:

Psychotherapy notes. These are a mental health professional’s personal session notes, kept separate from the rest of your record. They do not include prescriptions, session times, treatment plans, or diagnostic summaries, all of which you can still access.⁴
Information compiled specifically for use in a civil, criminal, or administrative legal proceeding.¹
Records of an inmate, when a correctional facility or provider acting at its direction decides releasing copies would threaten health, safety, or security at the institution.¹
Records created during a research study you agreed to join. Access can be temporarily suspended until the study ends.¹
Information received from someone other than a healthcare provider under a promise of confidentiality, where releasing it would likely identify the source.¹

The Safety Exception You Can Challenge

A licensed healthcare professional can also deny access if they determine that releasing the records is reasonably likely to endanger your life or physical safety, or someone else’s. The bar is high. Discomfort, embarrassment, or a concern that you might be upset by what you read does not meet it. The denial has to rest on a specific, documented clinical judgment about a genuine safety threat.

If a provider denies access on this ground, you have the right to have a different licensed professional at the same organization review the decision. That reviewer’s determination is binding on the provider.¹

Substance Use Disorder Records

One category carries stricter rules than HIPAA. Records from federally assisted substance use disorder treatment programs are protected by 42 CFR Part 2. Those regulations prohibit the use or disclosure of treatment records in civil, criminal, administrative, or legislative proceedings unless the regulations specifically allow it. A subpoena alone does not override the protection, and no state law can authorize a disclosure that Part 2 forbids. Programs covered by Part 2 must tell patients at admission that federal law protects the confidentiality of their records.⁵ These rules restrict outside disclosure; they do not cut off the patient’s own access.

Reasons That Are Not Legal Grounds to Withhold

Providers sometimes cite reasons that sound plausible but do not hold up under the regulations. The most common one is money.

Unpaid bills. A provider cannot refuse to release your records because you owe them for services. HHS has addressed this directly: a provider may not deny access on the grounds that you have not paid your healthcare bill, and may not use the fee you pay for record copies to offset an outstanding balance.⁶ The bill and the copy fee are two separate matters.

Leaving the practice. Your records belong to your health history, not to any one office. A provider cannot hold records back to pressure you to stay, and cannot require you to state a reason for the request.³

Disagreement over what the record says. If you think something in the record is wrong, HIPAA gives you a separate right to request a correction under 45 CFR 164.526. That is a different process. A provider cannot refuse to release the records themselves because you have raised concerns about accuracy.

Deadlines and Fees

A provider must act on your access request within 30 days of receiving it. One extension of up to 30 additional days is allowed, but only if the provider tells you in writing about the delay and the reason for it. That outer 60-day limit applies even to large or complex requests.¹ Silence past that point is a violation, not a busy office.

Providers can charge a reasonable, cost-based fee for copies, but not for letting you inspect records in person.³ For electronic copies of records already stored electronically, a provider can use a flat fee of up to $6.50 per request covering all labor, supplies, and postage.⁷ Many states cap per-page fees for paper copies as well, and those limits vary. A fee that looks unreasonably high can itself be worth pushing back on.

Written requests move faster than phone calls. Include your full name, date of birth, contact information, the dates of service you want covered, the types of records (clinical notes, labs, imaging, billing), and whether you want paper or electronic copies. Offices often have their own forms, but you are not required to use them.

Electronic Records and Information Blocking

Separate from HIPAA, the 21st Century Cures Act prohibits “information blocking,” which targets practices that interfere with your ability to access, exchange, or use your electronic health information. It applies to healthcare providers, health IT developers, and health information exchanges. There are limited exceptions, such as temporary delays when providing electronic access is technically infeasible, or restrictions justified by privacy concerns.⁸⁹ The HHS Office of Inspector General investigates violations, giving you a second enforcement pathway when the barrier involves electronic access.

What to Do if You Are Refused

If the denial rests on the safety exception, ask in writing for the review by a different licensed professional at the same organization. That right is built into the rule, and the second reviewer’s decision is binding.¹

For any denial you believe violates the law, file a complaint with the HHS Office for Civil Rights, which enforces HIPAA.¹⁰ You generally have to file within 180 days of the violation.¹¹ A parallel complaint to your state medical board is also an option, since state licensing bodies investigate professional conduct on their own authority.

One limit to know: HIPAA does not let you sue your provider directly. There is no private right of action under the statute; enforcement runs through HHS and, for criminal violations, the Department of Justice.¹² Some state laws create their own access rights, and a refusal to release records may support a state-law claim. If the federal complaint route stalls, talking to an attorney about state options is a reasonable next step.

1
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
2
HHS.gov. What Personal Health Information Do Individuals Have a Right to Access
3
HHS. Individuals’ Right Under HIPAA to Access Their Health Information 45 CFR 164.524
4
HHS.gov. Does HIPAA Provide Extra Protections for Mental Health Information Compared With Other Health Information
5
eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
6
HHS.gov. May a Health Care Provider Withhold a Copy of an Individual’s PHI
7
HHS.gov. Is $6.50 the Maximum Amount That Can Be Charged to Provide Individuals With a Copy of Their PHI
8
Office of the Law Revision Counsel. 42 USC 300jj-52 – Information Blocking
9
ASTP. Information Blocking
10
U.S. Department of Health & Human Services – Office for Civil Rights. Complaint Portal
11
HHS.gov. HIPAA What to Expect
12
HHS.gov. Summary of the HIPAA Privacy Rule