Is It Legal for a Doctor to Withhold Test Results?

In almost all cases, no — it is not legal for a doctor to withhold your test results. The HIPAA Privacy Rule gives you an enforceable right to inspect and receive copies of the information in your medical records, and the 21st Century Cures Act separately prohibits providers from blocking your access to your electronic health information.¹² A handful of narrow exceptions exist, and most of them still give you a right to have the denial reviewed.

The General Rule: You Are Entitled to Your Results

HIPAA’s access right covers a wide range of health information, including clinical laboratory test results, medical images, billing records, insurance information, wellness program files, and clinical case notes used to make decisions about your care. The right runs against both your doctor and the laboratory. A lab that qualifies as a HIPAA-covered entity has to give you the completed test report, the full underlying data generated by the test, and any other information in its designated record set about that test.¹ So if your doctor is slow to release results, you can go directly to the lab that ran the test.

A common misconception worth clearing up: a provider cannot refuse to release your records because you have an unpaid bill. HIPAA explicitly separates billing disputes from your access rights.¹

The Cures Act closes another gap. It prohibits “information blocking” by healthcare providers, health IT developers, and health information exchanges, meaning practices likely to interfere with your access to, exchange of, or use of your electronic health information.² In practice, that means a clinic cannot impose a blanket delay on releasing lab results through the patient portal until a physician has looked them over. Routine results like cholesterol panels or metabolic tests should hit your portal as soon as the lab finalizes them. There is a preventing-harm exception, but it is designed to cover only case-by-case decisions and cannot be broader than necessary to reduce a specific, identified risk.

Providers that violate these rules face real consequences. Hospitals that engage in information blocking can lose a significant portion of their annual Medicare payment increase, and clinicians participating in the Merit-based Incentive Payment System receive a zero score in the promoting interoperability category, which cuts their Medicare reimbursement. Health IT developers and information exchanges face civil monetary penalties of up to $1 million per violation.³

When a Provider Can Legally Withhold Results

The exceptions fall into two groups: denials you cannot appeal, and denials you can.

Denials You Cannot Appeal

A provider may deny access without offering a review process in these specific situations:

Psychotherapy notes — the personal notes a mental health professional keeps separate from your medical record about counseling sessions. This category does not include medication records, session times, treatment plans, diagnoses, or progress summaries.⁴
Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative legal proceeding.⁵
Inmate requests where providing copies would jeopardize health, safety, security, or rehabilitation at the correctional facility.⁵
Records tied to clinical research where you agreed to a temporary suspension of access as part of enrolling in a study that includes treatment. Access resumes when the study ends.⁵
Information obtained from someone other than a provider under a promise of confidentiality, where access would likely reveal the source.⁵

Denials You Can Have Reviewed

A second category of denials triggers your right to have the decision reviewed by a different licensed healthcare professional who was not involved in the original decision. A provider may deny access on reviewable grounds when a licensed professional determines that:

Access is reasonably likely to endanger your life or physical safety, or that of another person.
The information references another person (not a provider), and access would likely cause substantial harm to that person.
The request came from your personal representative, and granting access would likely cause substantial harm to you or someone else.

If a provider denies access on any of these grounds, they must let you request review by a different professional and follow that reviewer’s decision.⁵

Notice what these exceptions are not. Wanting to deliver bad news in person, being too busy, or preferring that you wait for a follow-up visit are not on the list.

How to Request Your Test Results

The fastest route is usually your provider’s online patient portal, where most health systems make lab results available electronically, often within hours of the lab finalizing them. If you do not have portal access, contact the medical records department or patient services office and ask for a copy.

You can also submit a written request, and many facilities offer a standard form. Include your full name, date of birth, and a clear description of which records you want. Be specific about the test or date range so records staff are not guessing.

Once a provider receives your request, HIPAA gives them 30 calendar days to act on it. If they cannot meet that deadline, they can take one additional 30-day extension, but they must notify you in writing before the first 30 days expire, explaining the reason for the delay and giving a specific completion date.⁶

If You Are Requesting on Behalf of Someone Else

HIPAA treats a personal representative the same as the patient for access purposes. The question is whether the person has legal authority under state or other applicable law to make healthcare decisions for the patient. For an adult, that typically means a healthcare power of attorney, a court-appointed guardianship, or a general or durable power of attorney that includes healthcare decision-making. For a deceased patient, it is the executor or administrator of the estate, or a family member authorized under applicable law.⁷ Be ready to show the paperwork.

What Fees a Provider Can Charge

Providers can charge a reasonable, cost-based fee, but only for a limited set of items: labor for the actual copying once the information is ready, supplies like paper or a USB drive, and postage if you ask for mailed copies. They cannot charge you for searching for and retrieving your records, reviewing your request, verifying your identity, maintaining their systems, or recouping technology infrastructure costs. Those exclusions apply even where state law would otherwise allow the charge.¹

For electronic copies of records maintained electronically, a provider may instead charge a flat fee of no more than $6.50, covering labor, supplies, and postage combined. And when you use a provider’s certified electronic health record portal to view, download, and transmit your records, the provider cannot charge you anything.¹

What to Do if Your Results Are Withheld

Start at the provider’s office. Ask to speak with a patient advocate or practice manager and explain that HIPAA entitles you to your records. A lot of access disputes come from staff confusion about policy rather than deliberate obstruction, and a direct conversation resolves most of them. If a denial is on reviewable grounds, ask in writing for review by a different licensed professional.

If the provider still will not release the results, file a complaint with the HHS Office for Civil Rights, which enforces the HIPAA Privacy Rule. You can file online through the OCR complaint portal.⁸ There is a hard deadline: you must file within 180 days of when you knew or should have known the violation occurred, and missing that window can end your ability to pursue the complaint.⁹

OCR investigations can lead to civil monetary penalties against the provider, scaled by how culpable they were, with per-violation amounts ranging from a few hundred dollars for unknowing violations up to more than $2 million for uncorrected willful neglect.¹⁰ Those penalties do not go to you, but they are one reason most providers start cooperating quickly once OCR is in the picture.

1
HHS.gov. Individuals’ Right under HIPAA to Access their Health Information 45 CFR 164.524
2
ASTP – Assistant Secretary for Technology Policy. Information Blocking
3
U.S. Department of Health and Human Services Office of Inspector General. Information Blocking
4
HHS.gov. Does HIPAA Provide Extra Protections for Mental Health Information Compared with Other Health Information?
5
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
6
HHS.gov. How Timely Must a Covered Entity Be in Responding to Individuals’ Requests for Access to Their PHI?
7
HHS.gov. Personal Representatives
8
US Department of Health and Human Services Office for Civil Rights. Complaint Portal
9
HHS.gov. If I Believe That My Privacy Rights Have Been Violated, When Can I Submit a Complaint?
10
Federal Register. Annual Civil Monetary Penalties Inflation Adjustment