To get your hospital discharge papers, contact the medical records department (often called Health Information Management, or HIM) at the hospital where you were treated and submit a request through their patient portal, by mail or fax, or in person. Federal law gives you the right to your records, and the hospital has up to 30 days to respond.1HHS.gov. How Timely Must a Covered Entity Be in Responding to Individuals’ Requests for Access to Their PHI The rest comes down to knowing which document you actually need, what to include in the request, and what the hospital can and cannot charge you.
Know Which Document You’re Asking For
“Discharge papers” can mean two different things, and asking for the wrong one wastes time.
The discharge instructions are the pages handed to you or a family member when you left the hospital: medications, follow-up appointments, activity restrictions, and diet. If you lost them, the hospital can reprint them.
The discharge summary is the clinical document your physician writes after your stay. The Joint Commission requires it to include the reason for hospitalization, significant findings, procedures and treatments provided, your condition at discharge, and the instructions given to you or your family.2NCBI Bookshelf. Documentation of Mandated Discharge Summary Components in Transitions from Acute to Subacute Care This is the record your primary care doctor needs to pick up where the hospital left off. It can take several days after discharge for the physician to finalize it, so a request submitted the day you leave may not be ready right away.
Most people searching for discharge papers want the discharge summary. The same request process below applies to any part of your medical record.
Your Right to a Copy
The HIPAA Privacy Rule gives you an enforceable right to see and receive copies of your medical records, including discharge summaries, billing records, and lab results.3HHS.gov. Individuals’ Right under HIPAA to Access their Health Information You do not need to explain why you want them.
You can also ask for the format you want. If the hospital keeps your records electronically and you want an emailed copy, they must provide it if they can reasonably do so. They cannot force you to accept paper, and they cannot require you to appear in person if you would rather use the mail or portal.4eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
What to Gather Before You Ask
Having these details ready cuts down on back-and-forth:
- Your full legal name as it appeared during registration
- Date of birth
- Admission and discharge dates
- Medical record number or patient ID, if you have it (check any paperwork from the stay)
The hospital will verify your identity before releasing anything. HIPAA does not spell out a specific ID requirement; it only says the hospital must take “reasonable steps” to confirm who you are.3HHS.gov. Individuals’ Right under HIPAA to Access their Health Information Most hospitals ask for a photo ID in person; for mail or portal requests, they may verify through information they already have on file.
If you’re requesting records for yourself, you do not need a signed authorization form. That form is only required when records are being sent to a third party, such as another doctor’s office, an attorney, or an insurance company.5eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
Three Ways to Submit the Request
Through the Patient Portal
The fastest route in most cases. Log in and look for a section labeled “medical records,” “health summary,” or “visit history.” Many hospitals using certified electronic health record systems are required to make clinical records viewable and downloadable through their portals.6ONC – HealthIT.gov. Your Health Information Rights If the summary you want isn’t posted, the portal usually has an electronic request form.
By Mail or Fax
Download the hospital’s medical records request form from its website, or call the HIM department and ask them to send you one. Fill it out completely, sign it, and mail or fax it to the address listed on the form. Keep a copy along with proof of mailing. Hospitals can require a written request, but they cannot use the form requirement to stall your access.3HHS.gov. Individuals’ Right under HIPAA to Access their Health Information
In Person
Visit the HIM or medical records office during business hours. Bring identification and be ready to fill out a request form on the spot. Some hospitals can print records during your visit; complex requests or older files stored off-site still take time. An in-person visit is useful when a request has stalled and you want to talk to someone directly.
Requesting Records for Someone Else
An Adult You Represent
If you have legal authority to make healthcare decisions for another adult through a healthcare power of attorney or legal guardianship, HIPAA treats you as that person for records access.7eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information, General Rules Bring the document proving your authority, such as the power of attorney or a court order.
Your Minor Child
Parents generally have the right to access a minor child’s medical records. HIPAA carves out exceptions where access can be limited, including situations where the minor lawfully consented to their own care without needing a parent’s permission or where a court or another authorized person consented on the minor’s behalf.7eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information, General Rules State law determines when minors can consent independently and varies widely. Hospitals may also refuse to treat a parent as a personal representative if they reasonably believe the minor has been or may be subjected to abuse or neglect by that parent.
A Deceased Relative
HIPAA protects a deceased person’s medical records for 50 years after death. During that period, access goes through a personal representative, typically the executor or administrator of the estate. If state law grants authority to next of kin or another family member, the hospital must recognize that authority as well.8HHS.gov. Personal Representatives Expect to provide documentation such as letters testamentary from a probate court. Specific requirements depend on your state’s estate laws.
What It Costs
Hospitals can charge for copies, but HIPAA limits the fee to the labor of actually copying the records, supplies like paper or a CD, and postage if you want them mailed. They cannot charge for the time spent searching for or retrieving your records, or for reviewing the request to decide what is covered.9HHS.gov. May a Covered Entity Charge Individuals a Fee for Providing Copies of PHI The hospital must tell you the approximate cost before producing the copies; failing to give advance notice is itself considered an unreasonable barrier to access.3HHS.gov. Individuals’ Right under HIPAA to Access their Health Information
Electronic copies are generally cheaper than paper. Many states cap per-page copying fees, and the caps range from under a dollar to several dollars per page. If you only need the discharge summary rather than your entire chart, say so in the request. It keeps the bill down.
How Long the Hospital Has
Under HIPAA, the hospital must act on your request within 30 calendar days. “Act on” means either providing the records or issuing a written denial explaining why access is being restricted.1HHS.gov. How Timely Must a Covered Entity Be in Responding to Individuals’ Requests for Access to Their PHI If it cannot meet the deadline, it can extend once by an additional 30 days, but only if it sends you a written explanation and tells you when to expect the records.4eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information Only one extension is allowed per request.
In practice, many hospitals turn simple requests around much faster, especially electronic ones. Some states impose shorter deadlines than 30 days, so your hospital may be on a tighter clock depending on where you are.
If Your Request Stalls or Gets Denied
Start by calling the medical records department for a status update. Delays are common and usually come from staffing or misrouted paperwork rather than an intentional refusal.
A formal denial must be in writing and explain the reason. HIPAA allows denial only in limited circumstances, such as when a licensed health professional determines access could endanger your life or physical safety, or when the records include information about another person who could be harmed by disclosure. Hospitals cannot deny access because a bill is unpaid or because the request is inconvenient.
If the hospital ignores your request, refuses without a valid reason, or puts unreasonable barriers in your way, you can file a complaint with the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services. Complaints can be submitted online through the OCR Complaint Portal or in writing.10HHS.gov. Filing a Health Information Privacy Complaint OCR investigates and can require corrective action. Filing is free.
If the Hospital Has Closed
Records don’t disappear when a hospital shuts down. State laws generally require closing facilities to notify patients and arrange for a custodian to hold the records. If you weren’t notified before the closure, try these approaches:
- Contact your state health department or state medical board. Closing facilities typically report to the state, which may know who took custody of the records.
- Check with your insurance company. Claims records may point you toward providers who received copies.
- Contact labs and imaging centers separately. They keep their own records and may still have your results.
- Search for a successor facility. If another hospital or health system acquired the closed one, it may have inherited the records with the assets.
For Medicare providers, federal regulations require medical records to be maintained for at least seven years from the date of service.11CMS. Medical Record Maintenance and Access Requirements State retention requirements vary, often seven to ten years, and longer for records of minors. If you exhaust these options and still cannot find your records, you can file a complaint with the Office for Civil Rights, which has authority to investigate whether HIPAA obligations were met during the closure.