Skip to Content

Medical Records Collection, Retention, and Access

Medical records are those records kept on individual patients by providers that include health history, diagnostic information, and provider notes, among other pieces of data. Medical records can be kept on paper or electronically. This topic covers records maintenance as a condition of provider licensure, recordkeeping requirements for a variety of facilities, and laws governing record retention and ownership, access to records, data collection, and storage and destruction. 

Patient Privacy Requirements Beyond HIPAA



Current View



Click on a state to see more information on Medical Records Collection, Retention, and Access in that state


State Right of Action Compared to HIPAA
  • Provides a right of action
  • Does not provide a right of action
  • Provides a right of action applicable only to non-covered entities



Hide All

StateState Right of Action Compared to HIPAADetails
AlabamaDoes not provide a right of action
AlaskaDoes not provide a right of action
ArizonaDoes not provide a right of action
ArkansasDoes not provide a right of action
CaliforniaProvides a right of action

Health & Safety Code §123120: Allows a patient to bring a private right of action against a health care provider who fails to allow the  patient to inspect or recieve a copy of his or her medical records pursuant to Health & Safety Code §123110

ColoradoDoes not provide a right of action
ConnecticutDoes not provide a right of action
DelawareProvides a right of action

24 Del. C. § 1761: Allows any aggrieved patient to bring a civil lawsuit for damages or a suit for injunctive relief against a provider who fails to provide access to a patient's medical record.

District of ColumbiaDoes not provide a right of action
FloridaDoes not provide a right of action
GeorgiaDoes not provide a right of action
HawaiiDoes not provide a right of action
IdahoDoes not provide a right of action
IllinoisProvides a right of action

735 ILCS 5/8-2001: Allows patients to bring a court action to enforce the access and time requirements for patient access to medical records, and allows the patient to recover and expenses and attorney's fees from the denying party. 

IndianaDoes not provide a right of action
IowaDoes not provide a right of action
KansasDoes not provide a right of action
KentuckyDoes not provide a right of action
LouisianaProvides a right of action

LSA –R.S. 40:1299.96: Allows a patient to obtain a court order if access to a patient's medical record is not provided within 15 days from receipt of a patient's request, the patient submitted notice to the provider that access has not been provided according to the law, and the provider fails to furnish the medical records within 5 days of receiving the notice.  The court may also order that the provider pay the patient's reasonable attorney's fees and costs. 

MaineDoes not provide a right of action
MarylandProvides a right of action

MD Code, Health-General § 4-309: Allows a health care provider who fails to provide a patient his or her medical record upon written request after 21 working days from the request to be liable for actual damages.

MassachusettsProvides a right of action

M.G.L.A. 111 §70E: Allows a patient of a health care facility (which includes: health care facilities, which include, hospitals, clinics, convalescent or nursing homes, rest homes for the aged licensed or regulated by the Department of Public Health, any private, county or municipal ward licensed or regulated by the Department of Mental Health or by the Department of Developmental Services) to bring a civil lawsuit against the facility if their rights under the law have been violated due to noncompliance with this section.  This section includes as a patient's right, the right to inspect and copy one's medical records.  

MichiganDoes not provide a right of action
MinnesotaDoes not provide a right of action
MississippiDoes not provide a right of action
MissouriDoes not provide a right of action
MontanaProvides a right of action applicable only to non-covered entities

Mont. Code Ann. § 50-16-553: An individual may bring an action for relief against a non-covered health care provider within 3 years of a violation of the individual's right to access his or her medical records. The court may order the provider to grant access, and the individual bringing the suit may recover monetary damages.

 

NebraskaDoes not provide a right of action
NevadaDoes not provide a right of action
New HampshireProvides a right of action

N.H. Rev. Stat. Ann. § 151:30: If a health care facility violates an individual's right to access his or her medical records, the individual may seek equitable relief; the facility will be liable for monetary damages. 

New JerseyDoes not provide a right of action
New MexicoDoes not provide a right of action
New YorkProvides a right of action

N.Y. Pub. Health Law § 18: If a provider denies a patient access to his or her medical records, the patient may seek review of the denial. A court may order a provider to grant the patient access to the record. 

North CarolinaDoes not provide a right of action
North DakotaDoes not provide a right of action
OhioDoes not provide a right of action
OklahomaDoes not provide a right of action
OregonDoes not provide a right of action
PennsylvaniaDoes not provide a right of action
Rhode IslandDoes not provide a right of action
South CarolinaDoes not provide a right of action
South DakotaDoes not provide a right of action
TennesseeProvides a right of action

Tenn. Code Ann. § 68-11-311: If a hospital or its personnel willfully, recklessly, or wantonly violate an individual's right to access his or her medical records, the hospital will be liable for actual damages in a civil action. 

TexasDoes not provide a right of action
UtahDoes not provide a right of action
VermontDoes not provide a right of action
VirginiaDoes not provide a right of action
WashingtonProvides a right of action

Wash. Rev. Code § 70.02.170: An individual may bring an action against a health care provider who has not complied with the access requirements within two years from the individual discovering that his or her rights were violated; the court may order the provider to grant the individual access, and may award monetary damages. 

West VirginiaProvides a right of action

W. Va. Code § 16-29-1: A patient may bring an action to enforce his or her right to access, and a health care provider who has violated this right must pay for the cost of the enforcement action. 

WisconsinProvides a right of action

Wis. Stat. § 146.84: Any person who negligently violates a patient's right to access his or her medical records will be liable to the patient for monetary damages of up to $1,000. Any person who knowingly or willfully violates a patient's right to access such records will be liable to the patient for up to $25,000. A patient who's access right has been violated may also bring an action to enforce his or her rights. 

WyomingProvides a right of action

Wyo. Stat. Ann. § 35-2-616: Any patient whose right to access his or her medical records has been violated may bring an action for relief within two years after the violation occurs. The court may order the entity to grant the patient access, and may grant the patient monetary damages. 



Click on a state to see more information on Medical Records Collection, Retention, and Access in that state


State Medical Record Access Requirements Compared to HIPAA
  • Stronger than HIPAA
  • Same as HIPAA
  • Preempted by HIPAA
  • No law specifically granting individual access right; HIPAA applies
  • HIPAA applies to covered entities, and state has additional requirements for entities not covered by HIPAA



Hide All

StateState Medical Record Access Requirements Compared to HIPAADetails
AlabamaPreempted by HIPAA

Ala. Admin. Code r. 420-5-7.05: Hospitals must provide patients access to their clinical records within a "reasonable time," but does not specify a specific time limit.

AlaskaPreempted by HIPAA

AS § 18.23.005: Patients are entitled to inspect and recieve copies of their medical records, but the law does not specify a time period.

ArizonaPreempted by HIPAA

A.R.S. § 32-3211: A health professional must establish procedures for providing a patient their medical record in a "timely" manner, but a specific time period is not provided under the law.

ArkansasPreempted by HIPAA

A.C.A. § 16-46-106: Physicians and hospitals must provide access to patient medical records, but the law does not specify a time period in which access must be given after a request has been made.

CaliforniaStronger than HIPAA

CA Health & Safety Code §123110: Physicians and hospitals must permit inspection of a medical record within 5 working days from the request.  Providers must ensure that a copy of medical record is transmitted to the patient within 15 days from when the request was made.

ColoradoStronger than HIPAA

6 Colo. Code Regs. 1011-1:II-5.2 : Hospitals must provide discharged patients copies of their medical records within 10 days from the request. However, inpatients in a hospital must be provided the opportunity to inspect their records within 24 hours from the request based on the regulation.  C.R.S.A. § 25-1-802: Physicians must provide copies of patient medical records to patients within a reasonable time or 30 days (as further defined by the CO Board of Medical Examiners).

ConnecticutSame as HIPAA

C.G.S.A. § 20-7c: Health care providers must furnish a copy of the medical record within 30 days from a patient's request.

DelawarePreempted by HIPAA

24 Del. C. § 1761: Physicians have 45 days to fulfill a patient's request for copies of his or her medical records.  10 Del. C. § 3926:  Physicians and hospitals have 45 days to provide a patient a copy of his or her medical record unless prepayment of the copies was made, in which case the provider has 14 days from the request.  If a patient prepays, the provider has the later of the 14 day or 45 day time periods from the patient's request to furnish the medical record copies.

District of ColumbiaSame as HIPAA

DC ST § 3-1210.11: Health care providers must provide a patient with his or her medical record within a "reasonable time" from the request, which has been further defined by 17 DCMR § 4612 to mean within 30 days of the request.

FloridaPreempted by HIPAA

F.S.A. § 395.3025: Hospitals must provide access to patient medical records within a "timely manner."  Under F.S.A. § 456.057 health care practitioners must provide access to patient medical records in a "timely manner."

GeorgiaSame as HIPAA

Ga. Code Ann. § 31-33-2: Physicians and hospitals must provide patients access to their medical records within 30 days of the request.

HawaiiStronger than HIPAA

HRS § 622-57: A provider must furnish a copy of a patient's medical record upon request.  However, a provider who fails to give a patient access must turn over a copy of the medical record, upon a patient's written authorization that the provider furnish the patient's attorney with the medical record copy, within 10 days from the authorization.

IdahoNo law specifically granting individual access right; HIPAA applies
IllinoisSame as HIPAA

735 ILCS 5/8-2001: Both physicians and hospitals must give a patient access to his or her medical record within 30 days from such a request, or if more time is needed the provider must give the patient an explanation within 30 days, but must provide the record within 60 days of the request.

IndianaPreempted by HIPAA

Ind. Code § 16-39-1-1: A health care provider must furnish a patient access to his or her medical record upon "reasonable notice," which is not further defined by the law.

IowaPreempted by HIPAA

Iowa Admin. Code 653-13.7: Physicians must give patients access to their medical records in a "timely manner," but a specific time period is not provided in the law.

KansasNo law specifically granting individual access right; HIPAA applies
KentuckyNo law specifically granting individual access right; HIPAA applies
LouisianaStronger than HIPAA

LSA –R.S. 40:1299.96: A health care provider must furnish a copy of a medical record within 15 days from a patient's request.  LSA –R.S. 40:2144: Hospitals must provide medical record access "as soon as practicable" and upon payment of reasonable copying fees.  "As soon as practicable" as defined by La. Admin. Code tit. 48, pt. I, § 9387 as within 15 days from the patient's request and payment of copying fees. 

MainePreempted by HIPAA

ME. REV. STAT. tit. 22, § 1711 and ME. REV. STAT. tit. 22, § 1711-B: Hospitals and health care practitioners respectively, must provide patients access to their medical records within a "reasonable time" from the request.

 

MarylandStronger than HIPAA

MD Code, Health-General § 4-309: A health care provider or hospital must provide a patient access to his or her medical records within 21 days from the request.

MassachusettsPreempted by HIPAA

M.G.L.A. 111 §70E: Hospitals and other health care facilities must provide access to a patient's medical record within a "reasonable time" from the patient's request.  243 MA ADC 2.07: A physician must furnish a copy of a medical record to the patient in a "timely manner."  There are no time periods specified under Massachusetts law.

MichiganSame as HIPAA

M.C.L.A. § 333.26265: Physicians and hospitals must furnish the medical record to a patient within 30 days of a request for access. 

MinnesotaPreempted by HIPAA

M.S.A. §144.292: Hospitals and physician providers must "promptly furnish" copies of a patient's medical record upon written request, but no time period is defined under the law.

MississippiPreempted by HIPAA

Miss. Admin. Code 30-17-2635:10.4: A physician must provide a patient copies of his or her medical record "within a reasonable amount of time" from the patient's request, but no timer period is specified. 

MissouriPreempted by HIPAA

V.A.M.S. 191.227: All health care providers must furnish a copy of a patient's medical record to the patient within a "reasonable amount of time" from the patient's request and payment of reasonable copying fees.  The law does not define a specific time period. 

MontanaHIPAA applies to covered entities, and state has additional requirements for entities not covered by HIPAA

Mont. Code Ann.§ 50-16-541Non-covered health care providers must give an individual access to his or her medical records within 10 days of receiving a written request.

NebraskaStronger than HIPAA

Neb. Rev. Stat.§ 71-8403: Health care providers must allow an individual to examine his or her medical records within 10 days of receiving a written request, and must provide a copy such records within 30 days of receiving a written request.

NevadaStronger than HIPAA

Nev. Rev. Stat. § 629.061: Health care providers must permit a patient to examine his or her health care records within 5 working days of receiving a request, unless the records are located outside Nevada, in which case within 10 working days of receiving a request. Copies of such records must be made available upon request.

New HampshirePreempted by HIPAA

N.H. Rev. Stat. Ann. § 151:21: A patient has a right to receive a copy of his or her medical records from a health care facility upon request (see also N.H. Code R. He-P 802.14). N.H. Rev. Stat. Ann. § 332-I:1A patient has a right to receive a copy of his or her medical records from a health care practitioner upon request (see also N.H. Code R. Med 501.02).  The laws do not specify a time period for access. 

New JerseySame as HIPAA

N.J. Admin. Code § 8.43G-4.1: Every hospital patient has a right to "promptly access" information in his or her medical record, and has the right to obtain a copy of such record within 30 days of a written request (see also N.J. Admin. Code § 8:43G-15.3 and N.J. Rev. Stat. § 26:2H-12.8).N.J. Admin. Code § 13:35-6.5: A health care practitioner must provide a copy or a summary of a patient's treatment or billing records within 30 days of receiving a request.  

New MexicoPreempted by HIPAA

N.M. Code R. § 7.7.2.19: Every hospital must have a policy providing that patients may access their own medical records. N.M. Admin. Code 16.10.17.8: Physicians must release medical records to patients upon a "legal request" for such record. The laws do not specify a time period for access. 

New YorkStronger than HIPAA

N.Y. Pub. Health Law § 18: Health care providers must provide an individual with the opportunity to inspect his or her patient information within 10 days of a written request; a copy of such information must be provided within a "reasonable" time of a request.

North CarolinaNo law specifically granting individual access right; HIPAA applies

N.C. Gen. Stat. § 90-411: A health care provider is permitted to charge a reasonable fee for providing copies of a patient's medical records when the patient requests a copy for use in a personal injury claim or a claim for social security disability. The law does not provide an affirmative access right for individuals, and identifies no time period for access. 

North DakotaPreempted by HIPAA

N.D. Cent. Code § 23-12-14: A health care provider must give patients a copy of his or her medical record and/or bills once a patient submits a signed authorization making such request. The law does not specify a time period for access. 

OhioHIPAA applies to covered entities, and state has additional requirements for entities not covered by HIPAA

Ohio Rev. Code § 3798.03: Covered entities must grant individual's access to his or her protected health information consistent with HIPAA's requirements. Ohio Rev. Code § 3701.74: A healthcare provider (including a non-covered entity) must permit a patient to examine or obtain a copy of all or part of the patient's medical record within a "reasonable time" after receiving a written request (see also Ohio Admin. Code 3701-83-07 and Ohio Admin. Code 3701-84-07). The law does not specify a time period for access to records maintained by non-covered providers. 

OklahomaPreempted by HIPAA

Okla. Stat. tit. 76, § 19: A physician or health care facility must give a patient access to the information in his or her medical record upon request. The law does not specify a time period for access. 

OregonSame as HIPAA

Or. Rev. Stat. § 192.553Individuals in Oregon have the right to access and review their own protected health information. Or. Admin. R. 847-012-0000: A physician must permit a patient to inspect, or must provide a copy or summary of the patient's medical record within 30 days after receiving a request. 

PennsylvaniaPreempted by HIPAA

28 Pa. Code § 115.29: Hospitals must give a patient access to and/or provide a copy of his or her medical records upon request (see also 28 Pa. Code § 103.22). 49 Pa. Code § 16.61: A health care practitioner's failure to provide access to or a copy of a patient's medical record upon the patient's written request is considered unprofessional conduct, subject to disciplinary action. 49 Pa. Code § 25.213: Osteopathic physicians must provide a patient with a complete copy of his or her medical records within a "reasonable time" of a request. The laws do not specify a time period for access. 

Rhode IslandSame as HIPAA

31-4-18 R.I. Code R. § 27: Hospitals must provide a patient with a requested record within 30 days of receiving the request. 31-5-41 R.I. Code R. § 11: A physician must provide a patient's medical records within 30 days of receiving a written request (see also R.I. Gen. Laws § 5-37-22).

South CarolinaPreempted by HIPAA

S.C. Code Ann. § 44-7-325Health care providers must provide a copy of a patient's medical record within 45 days of receiving a request, or within 45 days after the patient is discharged, whichever is later (see also S.C. Code Ann. § 44-115-30 and S.C. Code Ann. § 44-115-60).

South DakotaPreempted by HIPAA

S.D. Codified Laws § 36-2-16: A health care practitioner must provide copies of all available medical records to a patient upon receipt of a written request. The law does not specify a time period for access. 

TennesseeStronger than HIPAA

Tenn. Code Ann. § 63-2-101: Health care practitioners must provide a copy or summary of a patient's medical record within 10 working days of receiving a request for access. Tenn. Code Ann. § 68-11-304: Hospitals must provide medical records to a patient upon written request "without unreasonable delay." The law does not specify a time period for access to hospital records. 

TexasStronger than HIPAA

Tex. Health & Safety Code Ann. § 241.154: A hospital must make a patient's recorded health care information available to the patient no later than 15 business days after receiving a written authorization (see also 25 Tex. Admin. Code § 133.42). 22 Tex. Admin. Code § 165.2: A physician must provide a copy or a summary of a patient's medical and/or billing records within 15 business days after receiving a written release for the information (see also Tex. Occ. Code Ann. § 159.006). Tex. Health & Safety Code Ann. § 181.102: A provider using an electronic health records system must provide a person's record in electronic form, if the system is capable of doing so, within 15 business days after receiving a written request, unless the person agrees to accept the record in a different form.

UtahHIPAA applies to covered entities, and state has additional requirements for entities not covered by HIPAA

Utah Code Ann. § 78B-5-618: Non-covered health care providers must permit a patient to inspect or obtain a copy of his or her records unless access is restricted by law or judicial order. Providers must comply with HIPAA deadlines when providing a copy of a patient's records. 

VermontNo law specifically granting individual access right; HIPAA applies

Vt. Stat. Ann. tit. 26 § 1354: A physician's failure to make a copy of a patient's records available "promptly" to a patient when given proper written request is considered unprofessional conduct. The statute does not identify an affirmative right to access, and does not specify a time period for access. 

VirginiaStronger than HIPAA

Va. Code Ann. § 32.1-127.1:03: Health care entities must disclose a patient's health care records to a patient in accordance with a written request for disclosure. Health care entities must furnish copies of or allow access to a patient's health care records in an electronic format within 15 days of receiving a written request for access to such records. Va. Code Ann. § 54.1-2403.3: Health care practitioners must release copies of a patient's medical records in compliance with requirements applicable to health care entities (see also 18 Va. Admin. Code § 85-20-26). The laws do not specify a time period for access to records in a hard copy (e.g., paper) format. 

WashingtonStronger than HIPAA

Wash. Rev. Code § 70.02.080: Health care providers must permit a patient to examine or copy his or her recorded health care information no later than 15 days after receiving a written request. 

West VirginiaPreempted by HIPAA

W. Va. Code § 16-29-1: Health care providers must furnish a copy of a patient's record within a "reasonable time" after receiving a written request. The law does not specify a time period for access. 

WisconsinPreempted by HIPAA

Wis. Stat. § 146.83: Health care providers must permit a patient to inspect his or her records once the patient submits a statement of informed consent; providers must furnish a copy of such records after receiving the patient's informed consent and payment of the applicable fee. The statute does not specify a time period for access. 

WyomingStronger than HIPAA

Wyo. Stat. Ann. § 35-2-611: A hospital must make a patient's recorded health care information available for examination and/or provide a copy of such information to a patient no later than 10 days after receiving a written request. Wyo. Admin. & Info. Code R. Board of Medicine, ch. 3 § 4: A physician must make information in a patient's medical records readily available, or provide a copy or summary of such records no later than 30 days after receiving a signed, written release (see also Wyo. Stat. Ann. § 33-26-402).

Syndicate content