How to Seal Medical Records: HIPAA Restrictions and Court Orders

Sealing medical records is not one process but two, and picking the right one depends entirely on where the records live. If you want to limit how your doctor, hospital, or health plan uses and shares your file, you make a written restriction request under HIPAA directly to the provider. If your records have been filed in a lawsuit or other court proceeding and you want them out of the public record, you file a motion asking the judge to seal them. The tools do different jobs, follow different rules, and produce different outcomes.

Restricting Records Held by Your Provider

The HIPAA Privacy Rule requires every covered entity, meaning hospitals, clinics, health plans, and clearinghouses, to let you ask that they limit how they use or share your protected health information. You can ask them to restrict disclosures made for treatment, payment, or routine healthcare operations, and disclosures to people involved in your care such as family members.¹

Here is what most people miss: your provider does not have to agree. HIPAA gives you the right to ask, not the right to receive. A provider can review your request and simply decline, and that decision is not a HIPAA violation.¹ If the provider does agree, the agreement becomes binding and they must flag your record and comply.

The One Restriction Providers Must Honor

There is a single situation where the answer is not up to the provider. If you pay for a healthcare service or item out of pocket and in full, you can require the provider to withhold information about that specific service from your health plan. The provider must agree, so long as the disclosure would have been for payment or healthcare operations and is not otherwise required by law.²

This is the most reliable way to keep a particular visit, test, or procedure off your insurer’s file. The trade-off is that you absorb the full cost permanently. Your insurer never learns about the service, so you cannot go back later and file a claim for reimbursement. A provider also cannot unilaterally undo this specific restriction the way they can end other restrictions on a going-forward basis.²

How to Submit a Restriction Request

Start by contacting your provider’s Privacy Officer or Health Information Management department. Many offices have a “Request for Restriction” form. If they don’t, a letter works.

Your request should include:

Your full legal name, date of birth, and any patient ID or medical record number, so the request gets attached to the right file.
The specific information you want restricted. Name the diagnosis, visit date, treatment, or test result. Broad requests like “all my records” give the provider an easy reason to decline.
Who or what you want the information restricted from: a specific family member, another provider, your health plan, or a particular type of disclosure.
How long the restriction should last, either a set time period or indefinitely.

Submit in writing. Handing the form in personally and keeping a stamped copy, or sending it by certified mail, creates a paper trail that matters if the restriction is later ignored. Some providers accept submissions through a patient portal, but confirm the portal actually routes to the privacy office rather than a general inbox.

What Still Gets Disclosed Even With a Restriction

Even after a provider agrees to a restriction, federal law carves out situations where they can, or must, disclose your information anyway. A restriction does not block disclosures that are required by law or permitted under specific regulatory exceptions.

Public health reporting: providers must report certain communicable diseases, injuries, births, and deaths to public health authorities regardless of any restriction.
Court orders and subpoenas: a court can order disclosure. A subpoena without a court order can also compel disclosure if the requesting party made reasonable efforts to notify you or secured a protective order.
Law enforcement requests: providers can disclose limited information in response to lawful requests, including to identify suspects, locate fugitives, or report certain wounds and injuries.
Emergency treatment: if you need emergency care and the restricted information is necessary to treat you, the provider can use or disclose it. The provider must ask the emergency treating provider not to share it further.

These exceptions live at 45 CFR 164.512 and apply whether or not you have a restriction agreement in place.³

Sealing Records That Are Already in a Court Case

Sealing is a fundamentally different process. It applies when medical records have entered a court proceeding, attached to a lawsuit, introduced as evidence, or filed with the court, and you want to keep them out of the publicly accessible court file. This is not about what your doctor shares with your insurer. It is about closing off public inspection of documents inside a case.

The situations where people typically move to seal medical records include personal injury litigation where detailed treatment records are part of the file, family court disputes involving custody or mental health evaluations, proceedings involving child victims, and cases involving mental health commitments or competency evaluations.

What a Judge Needs to See

Courts start from a presumption of public access. The First Amendment and common law both give the public a right to inspect court records, and judges take that seriously. To overcome the presumption, you have to show an overriding interest that outweighs public access, and the sealing has to be narrowly tailored, meaning no broader than necessary to protect that interest.

In practice, most courts apply a version of a four-factor test. You must show an overriding interest likely to be harmed by disclosure, that the proposed seal is no broader than necessary, that the court considered less restrictive alternatives like redaction, and that the court makes specific findings supporting its decision. Judges often prefer redacting identifying details from medical records instead of sealing entire documents, because redaction protects privacy while preserving as much public access as possible.

The mechanics involve drafting a motion that identifies the specific records, explains the privacy interest at stake, and argues why alternatives like redaction are insufficient. You file the motion with the court handling the case, and other parties get a chance to object. If the judge agrees, they issue an order specifying exactly what gets sealed and for how long. Filing fees for motions vary by jurisdiction but generally fall in the range of $45 to $60 in state courts, with federal court fees potentially higher.

How Long a Sealing Order Lasts

Sealing orders are not automatically permanent. When you file the motion you have to state how long you want the seal to remain in place and justify that duration. Some courts default to temporary sealing. Certain federal district courts, for example, automatically unseal documents 90 days after the case concludes unless someone files a motion to continue the seal.⁴

If you ask for indefinite sealing, expect the court to scrutinize the request more carefully. Judges do grant indefinite seals, particularly for records involving minors or especially sensitive conditions, but you have to explain why a time-limited seal will not suffice. Either party can later move to modify or lift the order if circumstances change.

Stronger Protections That May Already Apply

Before you commit to a restriction request or a sealing motion, check whether your records already sit under stricter rules.

Records from substance use disorder treatment carry an extra layer of federal protection under 42 CFR Part 2. These rules are significantly stricter than standard HIPAA. Part 2 records generally cannot be used or disclosed without your written consent, and they cannot be used to initiate or substantiate criminal charges against you or introduced as evidence in legal proceedings without either your consent or a specific court order. Those protections apply regardless of whether the requester is a law enforcement officer, a government official, or someone holding a subpoena.⁵

State law can also go further than HIPAA. HIPAA sets a federal floor, not a ceiling. Many states impose stricter privacy rules for specific categories, including mental health records, HIV status, genetic testing results, and reproductive health information. Some states require explicit written consent before disclosing mental health records to anyone, including other treating providers. Others prohibit disclosing HIV test results without a separate, specific authorization. Where state law is more protective than federal law, providers must follow the stricter standard.

Ending or Modifying an Agreed Restriction

An agreed-upon HIPAA restriction does not have to last forever. You can ask the provider to terminate it at any time, in writing or verbally, and the provider must document an oral agreement. The provider can also end a restriction on its own, but only prospectively: the termination applies to information created or received after they notify you, not to records already protected under the restriction.² The out-of-pocket payment restriction is the exception; the provider cannot unilaterally undo that one.

If a Provider Ignores a Restriction You Have in Place

If a provider agrees to a restriction and then breaks it, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. The complaint must be in writing, submitted by mail, fax, email, or through the OCR Complaint Portal, within 180 days of when you discovered the violation. OCR may extend that deadline if you can show good cause.⁶

Your complaint has to name the provider, describe what happened, and explain how the restriction was violated. Include your contact information, because OCR will not investigate anonymous complaints. You can submit online or mail a completed HIPAA Privacy and Security Complaint Form to HHS at 200 Independence Avenue, S.W., Room 509F, Washington, D.C. 20201.⁶

Civil penalties for HIPAA violations are tiered by the provider’s level of culpability. Willful neglect that goes uncorrected carries penalties of about $73,000 per violation and an annual cap exceeding $2.1 million. Criminal violations, meaning knowingly obtaining or disclosing health information, can carry fines up to $250,000 and up to 10 years in prison when the disclosure was made for personal gain or malicious purposes.⁷ Penalties generally do not apply if the provider corrects the violation within 30 days of discovering it, unless the violation was due to willful neglect. That means prevention, getting the restriction documented and flagged in your record before anything goes wrong, matters far more than chasing enforcement after the disclosure has already happened.

1
Health Information Privacy (HHS.gov). Right to Request a Restriction
2
GovInfo. 45 CFR 164.522 – Rights to Request Privacy Protection for Protected Health Information
3
eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required
4
U.S. District Court for the Eastern District of Missouri. Rule 13.05 Sealing of Materials Filed in Civil and Criminal Cases
5
eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
6
HHS.gov. How to File a Health Information Privacy or Security Complaint
7
Federal Register. Annual Civil Monetary Penalties Inflation Adjustment