Enter the password to open this PDF file:
Medical Records Collection, Retention, and Access
Medical records are those records kept on individual patients by providers that include health history, diagnostic information, and provider notes, among other pieces of data. Medical records can be kept on paper or electronically. This topic covers records maintenance as a condition of provider licensure, recordkeeping requirements for a variety of facilities, and laws governing record retention and ownership, access to records, data collection, and storage and destruction.

Click on a state to see more information on Medical Records Collection, Retention, and Access in that state
- Provides a right of action
- Does not provide a right of action
- Provides a right of action applicable only to non-covered entities
Hide All
State | State Right of Action Compared to HIPAA | Details |
---|---|---|
Alabama | Does not provide a right of action | |
Alaska | Does not provide a right of action | |
Arizona | Does not provide a right of action | |
Arkansas | Does not provide a right of action | |
California | Provides a right of action | Health & Safety Code §123120: Allows a patient to bring a private right of action against a health care provider who fails to allow the patient to inspect or recieve a copy of his or her medical records pursuant to Health & Safety Code §123110. |
Colorado | Does not provide a right of action | |
Connecticut | Does not provide a right of action | |
Delaware | Provides a right of action | 24 Del. C. § 1761: Allows any aggrieved patient to bring a civil lawsuit for damages or a suit for injunctive relief against a provider who fails to provide access to a patient's medical record. |
District of Columbia | Does not provide a right of action | |
Florida | Does not provide a right of action | |
Georgia | Does not provide a right of action | |
Hawaii | Does not provide a right of action | |
Idaho | Does not provide a right of action | |
Illinois | Provides a right of action | 735 ILCS 5/8-2001: Allows patients to bring a court action to enforce the access and time requirements for patient access to medical records, and allows the patient to recover and expenses and attorney's fees from the denying party. |
Indiana | Does not provide a right of action | |
Iowa | Does not provide a right of action | |
Kansas | Does not provide a right of action | |
Kentucky | Does not provide a right of action | |
Louisiana | Provides a right of action | LSA –R.S. 40:1299.96: Allows a patient to obtain a court order if access to a patient's medical record is not provided within 15 days from receipt of a patient's request, the patient submitted notice to the provider that access has not been provided according to the law, and the provider fails to furnish the medical records within 5 days of receiving the notice. The court may also order that the provider pay the patient's reasonable attorney's fees and costs. |
Maine | Does not provide a right of action | |
Maryland | Provides a right of action | MD Code, Health-General § 4-309: Allows a health care provider who fails to provide a patient his or her medical record upon written request after 21 working days from the request to be liable for actual damages. |
Massachusetts | Provides a right of action | M.G.L.A. 111 §70E: Allows a patient of a health care facility (which includes: health care facilities, which include, hospitals, clinics, convalescent or nursing homes, rest homes for the aged licensed or regulated by the Department of Public Health, any private, county or municipal ward licensed or regulated by the Department of Mental Health or by the Department of Developmental Services) to bring a civil lawsuit against the facility if their rights under the law have been violated due to noncompliance with this section. This section includes as a patient's right, the right to inspect and copy one's medical records. |
Michigan | Does not provide a right of action | |
Minnesota | Does not provide a right of action | |
Mississippi | Does not provide a right of action | |
Missouri | Does not provide a right of action | |
Montana | Provides a right of action applicable only to non-covered entities | Mont. Code Ann. § 50-16-553: An individual may bring an action for relief against a non-covered health care provider within 3 years of a violation of the individual's right to access his or her medical records. The court may order the provider to grant access, and the individual bringing the suit may recover monetary damages.
|
Nebraska | Does not provide a right of action | |
Nevada | Does not provide a right of action | |
New Hampshire | Provides a right of action | N.H. Rev. Stat. Ann. § 151:30: If a health care facility violates an individual's right to access his or her medical records, the individual may seek equitable relief; the facility will be liable for monetary damages. |
New Jersey | Does not provide a right of action | |
New Mexico | Does not provide a right of action | |
New York | Provides a right of action | N.Y. Pub. Health Law § 18: If a provider denies a patient access to his or her medical records, the patient may seek review of the denial. A court may order a provider to grant the patient access to the record. |
North Carolina | Does not provide a right of action | |
North Dakota | Does not provide a right of action | |
Ohio | Does not provide a right of action | |
Oklahoma | Does not provide a right of action | |
Oregon | Does not provide a right of action | |
Pennsylvania | Does not provide a right of action | |
Rhode Island | Does not provide a right of action | |
South Carolina | Does not provide a right of action | |
South Dakota | Does not provide a right of action | |
Tennessee | Provides a right of action | Tenn. Code Ann. § 68-11-311: If a hospital or its personnel willfully, recklessly, or wantonly violate an individual's right to access his or her medical records, the hospital will be liable for actual damages in a civil action. |
Texas | Does not provide a right of action | |
Utah | Does not provide a right of action | |
Vermont | Does not provide a right of action | |
Virginia | Does not provide a right of action | |
Washington | Provides a right of action | Wash. Rev. Code § 70.02.170: An individual may bring an action against a health care provider who has not complied with the access requirements within two years from the individual discovering that his or her rights were violated; the court may order the provider to grant the individual access, and may award monetary damages. |
West Virginia | Provides a right of action | W. Va. Code § 16-29-1: A patient may bring an action to enforce his or her right to access, and a health care provider who has violated this right must pay for the cost of the enforcement action. |
Wisconsin | Provides a right of action | Wis. Stat. § 146.84: Any person who negligently violates a patient's right to access his or her medical records will be liable to the patient for monetary damages of up to $1,000. Any person who knowingly or willfully violates a patient's right to access such records will be liable to the patient for up to $25,000. A patient who's access right has been violated may also bring an action to enforce his or her rights. |
Wyoming | Provides a right of action | Wyo. Stat. Ann. § 35-2-616: Any patient whose right to access his or her medical records has been violated may bring an action for relief within two years after the violation occurs. The court may order the entity to grant the patient access, and may grant the patient monetary damages. |

Click on a state to see more information on Medical Records Collection, Retention, and Access in that state
- Stronger than HIPAA
- Same as HIPAA
- Preempted by HIPAA
- No law specifically granting individual access right; HIPAA applies
- HIPAA applies to covered entities, and state has additional requirements for entities not covered by HIPAA
Hide All
State | State Medical Record Access Requirements Compared to HIPAA | Details |
---|---|---|
Alabama | Preempted by HIPAA | Ala. Admin. Code r. 420-5-7.05: Hospitals must provide patients access to their clinical records within a "reasonable time," but does not specify a specific time limit. |
Alaska | Preempted by HIPAA | AS § 18.23.005: Patients are entitled to inspect and recieve copies of their medical records, but the law does not specify a time period. |
Arizona | Preempted by HIPAA | A.R.S. § 32-3211: A health professional must establish procedures for providing a patient their medical record in a "timely" manner, but a specific time period is not provided under the law. |
Arkansas | Preempted by HIPAA | A.C.A. § 16-46-106: Physicians and hospitals must provide access to patient medical records, but the law does not specify a time period in which access must be given after a request has been made. |
California | Stronger than HIPAA | CA Health & Safety Code §123110: Physicians and hospitals must permit inspection of a medical record within 5 working days from the request. Providers must ensure that a copy of medical record is transmitted to the patient within 15 days from when the request was made. |
Colorado | Stronger than HIPAA | 6 Colo. Code Regs. 1011-1:II-5.2 : Hospitals must provide discharged patients copies of their medical records within 10 days from the request. However, inpatients in a hospital must be provided the opportunity to inspect their records within 24 hours from the request based on the regulation. C.R.S.A. § 25-1-802: Physicians must provide copies of patient medical records to patients within a reasonable time or 30 days (as further defined by the CO Board of Medical Examiners). |
Connecticut | Same as HIPAA | C.G.S.A. § 20-7c: Health care providers must furnish a copy of the medical record within 30 days from a patient's request. |
Delaware | Preempted by HIPAA | 24 Del. C. § 1761: Physicians have 45 days to fulfill a patient's request for copies of his or her medical records. 10 Del. C. § 3926: Physicians and hospitals have 45 days to provide a patient a copy of his or her medical record unless prepayment of the copies was made, in which case the provider has 14 days from the request. If a patient prepays, the provider has the later of the 14 day or 45 day time periods from the patient's request to furnish the medical record copies. |
District of Columbia | Same as HIPAA | DC ST § 3-1210.11: Health care providers must provide a patient with his or her medical record within a "reasonable time" from the request, which has been further defined by 17 DCMR § 4612 to mean within 30 days of the request. |
Florida | Preempted by HIPAA | F.S.A. § 395.3025: Hospitals must provide access to patient medical records within a "timely manner." Under F.S.A. § 456.057 health care practitioners must provide access to patient medical records in a "timely manner." |
Georgia | Same as HIPAA | Ga. Code Ann. § 31-33-2: Physicians and hospitals must provide patients access to their medical records within 30 days of the request. |
Hawaii | Stronger than HIPAA | HRS § 622-57: A provider must furnish a copy of a patient's medical record upon request. However, a provider who fails to give a patient access must turn over a copy of the medical record, upon a patient's written authorization that the provider furnish the patient's attorney with the medical record copy, within 10 days from the authorization. |
Idaho | No law specifically granting individual access right; HIPAA applies | |
Illinois | Same as HIPAA | 735 ILCS 5/8-2001: Both physicians and hospitals must give a patient access to his or her medical record within 30 days from such a request, or if more time is needed the provider must give the patient an explanation within 30 days, but must provide the record within 60 days of the request. |
Indiana | Preempted by HIPAA | Ind. Code § 16-39-1-1: A health care provider must furnish a patient access to his or her medical record upon "reasonable notice," which is not further defined by the law. |
Iowa | Preempted by HIPAA | Iowa Admin. Code 653-13.7: Physicians must give patients access to their medical records in a "timely manner," but a specific time period is not provided in the law. |
Kansas | No law specifically granting individual access right; HIPAA applies | |
Kentucky | No law specifically granting individual access right; HIPAA applies | |
Louisiana | Stronger than HIPAA | LSA –R.S. 40:1299.96: A health care provider must furnish a copy of a medical record within 15 days from a patient's request. LSA –R.S. 40:2144: Hospitals must provide medical record access "as soon as practicable" and upon payment of reasonable copying fees. "As soon as practicable" as defined by La. Admin. Code tit. 48, pt. I, § 9387 as within 15 days from the patient's request and payment of copying fees. |
Maine | Preempted by HIPAA | ME. REV. STAT. tit. 22, § 1711 and ME. REV. STAT. tit. 22, § 1711-B: Hospitals and health care practitioners respectively, must provide patients access to their medical records within a "reasonable time" from the request.
|
Maryland | Stronger than HIPAA | MD Code, Health-General § 4-309: A health care provider or hospital must provide a patient access to his or her medical records within 21 days from the request. |
Massachusetts | Preempted by HIPAA | M.G.L.A. 111 §70E: Hospitals and other health care facilities must provide access to a patient's medical record within a "reasonable time" from the patient's request. 243 MA ADC 2.07: A physician must furnish a copy of a medical record to the patient in a "timely manner." There are no time periods specified under Massachusetts law. |
Michigan | Same as HIPAA | M.C.L.A. § 333.26265: Physicians and hospitals must furnish the medical record to a patient within 30 days of a request for access. |
Minnesota | Preempted by HIPAA | M.S.A. §144.292: Hospitals and physician providers must "promptly furnish" copies of a patient's medical record upon written request, but no time period is defined under the law. |
Mississippi | Preempted by HIPAA | Miss. Admin. Code 30-17-2635:10.4: A physician must provide a patient copies of his or her medical record "within a reasonable amount of time" from the patient's request, but no timer period is specified. |
Missouri | Preempted by HIPAA | V.A.M.S. 191.227: All health care providers must furnish a copy of a patient's medical record to the patient within a "reasonable amount of time" from the patient's request and payment of reasonable copying fees. The law does not define a specific time period. |
Montana | HIPAA applies to covered entities, and state has additional requirements for entities not covered by HIPAA | Mont. Code Ann.§ 50-16-541: Non-covered health care providers must give an individual access to his or her medical records within 10 days of receiving a written request. |
Nebraska | Stronger than HIPAA | Neb. Rev. Stat.§ 71-8403: Health care providers must allow an individual to examine his or her medical records within 10 days of receiving a written request, and must provide a copy such records within 30 days of receiving a written request. |
Nevada | Stronger than HIPAA | Nev. Rev. Stat. § 629.061: Health care providers must permit a patient to examine his or her health care records within 5 working days of receiving a request, unless the records are located outside Nevada, in which case within 10 working days of receiving a request. Copies of such records must be made available upon request. |
New Hampshire | Preempted by HIPAA | N.H. Rev. Stat. Ann. § 151:21: A patient has a right to receive a copy of his or her medical records from a health care facility upon request (see also N.H. Code R. He-P 802.14). N.H. Rev. Stat. Ann. § 332-I:1: A patient has a right to receive a copy of his or her medical records from a health care practitioner upon request (see also N.H. Code R. Med 501.02). The laws do not specify a time period for access. |
New Jersey | Same as HIPAA | N.J. Admin. Code § 8.43G-4.1: Every hospital patient has a right to "promptly access" information in his or her medical record, and has the right to obtain a copy of such record within 30 days of a written request (see also N.J. Admin. Code § 8:43G-15.3 and N.J. Rev. Stat. § 26:2H-12.8).N.J. Admin. Code § 13:35-6.5: A health care practitioner must provide a copy or a summary of a patient's treatment or billing records within 30 days of receiving a request. |
New Mexico | Preempted by HIPAA | N.M. Code R. § 7.7.2.19: Every hospital must have a policy providing that patients may access their own medical records. N.M. Admin. Code 16.10.17.8: Physicians must release medical records to patients upon a "legal request" for such record. The laws do not specify a time period for access. |
New York | Stronger than HIPAA | N.Y. Pub. Health Law § 18: Health care providers must provide an individual with the opportunity to inspect his or her patient information within 10 days of a written request; a copy of such information must be provided within a "reasonable" time of a request. |
North Carolina | No law specifically granting individual access right; HIPAA applies | N.C. Gen. Stat. § 90-411: A health care provider is permitted to charge a reasonable fee for providing copies of a patient's medical records when the patient requests a copy for use in a personal injury claim or a claim for social security disability. The law does not provide an affirmative access right for individuals, and identifies no time period for access. |
North Dakota | Preempted by HIPAA | N.D. Cent. Code § 23-12-14: A health care provider must give patients a copy of his or her medical record and/or bills once a patient submits a signed authorization making such request. The law does not specify a time period for access. |
Ohio | HIPAA applies to covered entities, and state has additional requirements for entities not covered by HIPAA | Ohio Rev. Code § 3798.03: Covered entities must grant individual's access to his or her protected health information consistent with HIPAA's requirements. Ohio Rev. Code § 3701.74: A healthcare provider (including a non-covered entity) must permit a patient to examine or obtain a copy of all or part of the patient's medical record within a "reasonable time" after receiving a written request (see also Ohio Admin. Code 3701-83-07 and Ohio Admin. Code 3701-84-07). The law does not specify a time period for access to records maintained by non-covered providers. |
Oklahoma | Preempted by HIPAA | Okla. Stat. tit. 76, § 19: A physician or health care facility must give a patient access to the information in his or her medical record upon request. The law does not specify a time period for access. |
Oregon | Same as HIPAA | Or. Rev. Stat. § 192.553: Individuals in Oregon have the right to access and review their own protected health information. Or. Admin. R. 847-012-0000: A physician must permit a patient to inspect, or must provide a copy or summary of the patient's medical record within 30 days after receiving a request. |
Pennsylvania | Preempted by HIPAA | 28 Pa. Code § 115.29: Hospitals must give a patient access to and/or provide a copy of his or her medical records upon request (see also 28 Pa. Code § 103.22). 49 Pa. Code § 16.61: A health care practitioner's failure to provide access to or a copy of a patient's medical record upon the patient's written request is considered unprofessional conduct, subject to disciplinary action. 49 Pa. Code § 25.213: Osteopathic physicians must provide a patient with a complete copy of his or her medical records within a "reasonable time" of a request. The laws do not specify a time period for access. |
Rhode Island | Same as HIPAA | 31-4-18 R.I. Code R. § 27: Hospitals must provide a patient with a requested record within 30 days of receiving the request. 31-5-41 R.I. Code R. § 11: A physician must provide a patient's medical records within 30 days of receiving a written request (see also R.I. Gen. Laws § 5-37-22). |
South Carolina | Preempted by HIPAA | S.C. Code Ann. § 44-7-325: Health care providers must provide a copy of a patient's medical record within 45 days of receiving a request, or within 45 days after the patient is discharged, whichever is later (see also S.C. Code Ann. § 44-115-30 and S.C. Code Ann. § 44-115-60). |
South Dakota | Preempted by HIPAA | S.D. Codified Laws § 36-2-16: A health care practitioner must provide copies of all available medical records to a patient upon receipt of a written request. The law does not specify a time period for access. |
Tennessee | Stronger than HIPAA | Tenn. Code Ann. § 63-2-101: Health care practitioners must provide a copy or summary of a patient's medical record within 10 working days of receiving a request for access. Tenn. Code Ann. § 68-11-304: Hospitals must provide medical records to a patient upon written request "without unreasonable delay." The law does not specify a time period for access to hospital records. |
Texas | Stronger than HIPAA | Tex. Health & Safety Code Ann. § 241.154: A hospital must make a patient's recorded health care information available to the patient no later than 15 business days after receiving a written authorization (see also 25 Tex. Admin. Code § 133.42). 22 Tex. Admin. Code § 165.2: A physician must provide a copy or a summary of a patient's medical and/or billing records within 15 business days after receiving a written release for the information (see also Tex. Occ. Code Ann. § 159.006). Tex. Health & Safety Code Ann. § 181.102: A provider using an electronic health records system must provide a person's record in electronic form, if the system is capable of doing so, within 15 business days after receiving a written request, unless the person agrees to accept the record in a different form. |
Utah | HIPAA applies to covered entities, and state has additional requirements for entities not covered by HIPAA | Utah Code Ann. § 78B-5-618: Non-covered health care providers must permit a patient to inspect or obtain a copy of his or her records unless access is restricted by law or judicial order. Providers must comply with HIPAA deadlines when providing a copy of a patient's records. |
Vermont | No law specifically granting individual access right; HIPAA applies | Vt. Stat. Ann. tit. 26 § 1354: A physician's failure to make a copy of a patient's records available "promptly" to a patient when given proper written request is considered unprofessional conduct. The statute does not identify an affirmative right to access, and does not specify a time period for access. |
Virginia | Stronger than HIPAA | Va. Code Ann. § 32.1-127.1:03: Health care entities must disclose a patient's health care records to a patient in accordance with a written request for disclosure. Health care entities must furnish copies of or allow access to a patient's health care records in an electronic format within 15 days of receiving a written request for access to such records. Va. Code Ann. § 54.1-2403.3: Health care practitioners must release copies of a patient's medical records in compliance with requirements applicable to health care entities (see also 18 Va. Admin. Code § 85-20-26). The laws do not specify a time period for access to records in a hard copy (e.g., paper) format. |
Washington | Stronger than HIPAA | Wash. Rev. Code § 70.02.080: Health care providers must permit a patient to examine or copy his or her recorded health care information no later than 15 days after receiving a written request. |
West Virginia | Preempted by HIPAA | W. Va. Code § 16-29-1: Health care providers must furnish a copy of a patient's record within a "reasonable time" after receiving a written request. The law does not specify a time period for access. |
Wisconsin | Preempted by HIPAA | Wis. Stat. § 146.83: Health care providers must permit a patient to inspect his or her records once the patient submits a statement of informed consent; providers must furnish a copy of such records after receiving the patient's informed consent and payment of the applicable fee. The statute does not specify a time period for access. |
Wyoming | Stronger than HIPAA | Wyo. Stat. Ann. § 35-2-611: A hospital must make a patient's recorded health care information available for examination and/or provide a copy of such information to a patient no later than 10 days after receiving a written request. Wyo. Admin. & Info. Code R. Board of Medicine, ch. 3 § 4: A physician must make information in a patient's medical records readily available, or provide a copy or summary of such records no later than 30 days after receiving a signed, written release (see also Wyo. Stat. Ann. § 33-26-402). |
