In almost all situations, doctors cannot hide medical information from patients. Federal law gives you an enforceable right to see your health records, and the ethics of informed consent require your physician to explain your diagnosis, the proposed treatment, the risks, and the alternatives before you agree to anything. A short list of narrow exceptions exists, but most doctors will never legitimately invoke them.
What Your Doctor Has to Tell You Before Treatment
Before performing any treatment, your doctor has both an ethical and legal obligation to explain what is happening and let you decide how to proceed. This principle, called informed consent, requires your provider to describe your diagnosis, the proposed treatment, the risks and potential benefits, and any reasonable alternatives, including doing nothing. These duties come from decades of common law and are written into medical practice acts across the country.
Informed consent is not about getting your signature on a form. It protects your autonomy so you can weigh the tradeoffs yourself. A doctor who performs a procedure without adequately informing you can face liability for battery or negligence, depending on how the situation unfolds. The legal standard is not “did the doctor mention something” but rather whether a reasonable patient would have wanted to know the information before deciding.
Therapeutic Privilege: The One Narrow Clinical Exception
The one established exception that lets a physician withhold clinical information from a competent patient is called therapeutic privilege. Under this doctrine, a doctor may hold back information if disclosing it would cause serious, immediate psychological harm so severe that it becomes medically dangerous, such as triggering a psychiatric crisis or causing the patient’s physical condition to deteriorate significantly.
In practice, therapeutic privilege is almost never legitimately invoked. The American Medical Association’s Code of Ethics is clear that a doctor cannot use it simply because they think the patient might refuse treatment if fully informed. Competent patients keep the right to refuse treatment, and withholding information to steer that decision is paternalism, not privilege. A physician who invokes therapeutic privilege carries a heavy burden to justify why disclosure itself posed a concrete medical threat, not just discomfort or emotional distress.
When a Provider Can Legally Deny You Access to Records
Federal regulations spell out a short list of situations where a provider may deny you access to your own health information. Some denials are final; others give you the right to have the decision reviewed by a different professional.
Denials you cannot appeal include:
- Ongoing research, where you agreed at enrollment that access to certain information would be suspended until the study concluded.
- Correctional settings, where a facility may deny an inmate’s request if providing copies would jeopardize health, safety, or security.
- Confidential source situations, where a provider received information from someone other than a healthcare provider under a promise of confidentiality, and release would reveal the source.
Denials you can challenge involve a licensed healthcare professional’s determination that giving you access is reasonably likely to endanger your life or physical safety, or that of another person, or that providing a personal representative with access would cause substantial harm.1eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information When a provider denies access on one of these reviewable grounds, you have the right to ask that a different licensed professional, one uninvolved in the original decision, review it.
Psychotherapy Notes Sit Outside the Standard Access Right
One category of health information has its own rules: psychotherapy notes. These are the personal notes a mental health professional writes during or after a private counseling session, documenting or analyzing the conversation, and they must be kept separate from the rest of your medical record to qualify for the extra protections.
A provider generally needs your written authorization before disclosing psychotherapy notes to anyone, including other providers treating you.2eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required Psychotherapy notes are also excluded from the standard HIPAA right of access, so your provider is not required to give you copies when you request your records.3HHS.gov. Does HIPAA Provide Extra Protections for Mental Health Information Compared With Other Health Information Many therapists share them voluntarily, but the law does not compel it the way it does for the rest of your chart. Psychotherapy notes do not include medication records, session start and stop times, treatment plans, diagnoses, or progress summaries; those are part of your regular medical record and you have full access rights to them.
Your Right to See and Copy Your Records
Outside those narrow exceptions, the law is firmly on your side. HIPAA gives you an enforceable right to inspect and obtain copies of the protected health information in your medical and billing records.4U.S. Department of Health & Human Services (HHS). Individuals’ Right under HIPAA to Access their Health Information 45 CFR 164.524 That covers records held by healthcare providers and health plans, including clinical notes, lab results, imaging reports, and billing records.
Once you submit a written request, the provider must respond within 30 calendar days. If the records are not readily accessible, such as when they are stored offsite, the provider can take an additional 30 days but must notify you in writing, explain the delay, and say when to expect the records.
Format and Delivery
You have the right to receive your records in the format you request, as long as the provider’s system can readily produce it. If you ask for a PDF and the provider’s system supports PDFs, they must provide a PDF. If they cannot produce your exact request, they must offer an alternative electronic format. A provider can only hand you paper as a last resort, after you have declined every electronic format available on their systems.
Fees
Providers may charge a reasonable, cost-based fee for copying your records, but the fee can only cover the actual labor of creating the copy, supplies like paper or a USB drive, and postage if you want the records mailed. They cannot charge for searching, retrieval, or system maintenance, even if state law would otherwise allow those charges. For electronic copies of records maintained electronically, HHS guidance allows a flat fee of no more than $6.50 per request as a simpler alternative to calculating actual costs.5HHS.gov. Is $6.50 the Maximum Amount That Can Be Charged If a provider quotes you a dramatically higher number, they are likely applying an outdated schedule or one built for third-party requests like attorney subpoenas, not patient access.
Information Blocking and Electronic Access
HIPAA created a right to request your records. The 21st Century Cures Act, which took full effect in 2022, went further by making it illegal for healthcare providers and health IT companies to unreasonably interfere with your access to electronic health information. Federal law defines information blocking as any practice a provider knows is unreasonable and is likely to interfere with, prevent, or materially discourage access to or exchange of electronic health information.6eCFR. 45 CFR Part 171 – Information Blocking
In practical terms, your test results, clinical notes, and other finalized health data should be available to you electronically without unnecessary delays. If a provider’s office tells you to wait weeks for results that were finalized days ago, or refuses to release information through a patient portal, that may qualify as information blocking.
Nine recognized exceptions apply. A provider will not violate the rule if they withhold electronic health information to prevent harm to a patient or another person, provided a licensed professional makes that call based on individualized clinical judgment and the restriction is no broader than necessary.7eCFR. 45 CFR 171.201 – Preventing Harm Exception Other exceptions cover privacy protections, security concerns, technical infeasibility, and situations where the provider needs a reasonable amount of time to fulfill the request. Psychotherapy notes are excluded from the information blocking rules entirely.
Minors, Parents, and Deceased Patients
When Parents Can and Cannot See a Minor’s Records
Parents generally act as the personal representative of their minor children and can access their health records. But federal law recognizes three situations where the minor controls the information and the parent does not automatically get access: when the minor lawfully consented to their own care (common for reproductive health and substance abuse treatment in many states), when the minor obtained care they are legally entitled to receive without parental consent, or when the provider and minor agreed to confidentiality with the parent’s assent.8eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information General Rules
A provider may also refuse to treat a parent as a personal representative if there is a reasonable belief the parent has subjected or may subject the minor to abuse or neglect, or that access would endanger the minor. State law plays a large role: if your state prohibits disclosing a minor’s treatment records for a specific service without the minor’s consent, HIPAA follows state law and the provider must keep that information from the parent.
Records After a Patient Dies
HIPAA protections continue for 50 years after a patient’s death. During that time, the personal representative of the deceased, typically the executor or administrator of the estate, can exercise the patient’s access rights and obtain copies of medical records. Family members or others involved in the patient’s care may also receive relevant information, unless the deceased previously expressed a preference against that disclosure.9HHS.gov. Health Information of Deceased Individuals
What to Do If You Think Information Is Being Withheld
Start with a direct conversation. Tell your doctor exactly what you want to know and why you believe you have not received it. Much of the time, what feels like withholding is an oversight, a miscommunication, or a delay, and pointed questions clear it up on the spot.
If that does not work, submit a formal written request for your medical records or the specific information you want. Putting it in writing creates a paper trail and triggers the provider’s legal obligation to respond within 30 days. Many healthcare organizations also have patient advocates or internal grievance processes that can escalate your request without involving outside agencies.
Filing a Federal Complaint
When a provider ignores your written request or refuses to provide records without a legitimate reason, you can file a complaint with the HHS Office for Civil Rights, which enforces HIPAA. You must file in writing within 180 days of when you learned about the violation, though OCR can extend the deadline for good cause. Complaints can be submitted online through the OCR Complaint Portal or by mail.10HHS.gov. How to File a Health Information Privacy or Security Complaint Your complaint has to identify the provider and describe what happened. Federal law prohibits retaliation against you for filing.
Filing a State Board Complaint
You can also file with the state medical board that licenses your physician. Medical boards oversee professional conduct and can investigate whether a physician’s behavior violates the state’s medical practice act. This route is particularly useful when the concern goes beyond records access, for example, if a doctor made treatment decisions based on information they withheld from you. The Federation of State Medical Boards maintains a directory of state boards on its website.