Your right to a copy: getting your full medical record under HIPAA and GDPR

The first enforcement action in the US government's Right of Access Initiative, in 2019, was about a mother asking a Florida hospital for the prenatal records of her own pregnancy. She asked repeatedly, over many months. The hospital paid $85,000 to settle — not for a breach, not for a hack, but for failing to hand a patient her own chart.

Regulators created that initiative because the problem it targets is ordinary. The right to a copy of your medical record is one of the strongest rights in health law on both sides of the Atlantic, and one of the most casually obstructed. Here is what the right actually says, and how to use it.

What HIPAA actually gives you

The HIPAA Privacy Rule, at 45 CFR §164.524, gives every individual a right of access to inspect and obtain a copy of their protected health information in a "designated record set" — a deliberately broad bundle that includes medical records, billing records, lab results, and anything else used to make decisions about you. The HHS guidance on the right of access is the canonical reference, and it resolves most arguments in the patient's favor.

The mechanics worth memorizing:

• Deadline. 30 days from the request, with one 30-day extension allowed if the provider tells you in writing and gives a reason.
• Fee. A reasonable, cost-based fee only: copying labor, supplies, postage. Retrieval fees and per-page rates untethered from actual cost are not permitted for patient access requests.
• Format. The form and format you ask for, if the provider can readily produce it — and for records held electronically, an electronic copy is your right, not a courtesy.
• Third-party direction. You can have the copy sent directly to anyone you designate in a signed, written request.

The grounds for denial are narrow — psychotherapy notes, information compiled for litigation, a few safety exceptions — and "the doctor hasn't signed off," "we only release to other providers," and "use the portal or nothing" are not among them.

What GDPR gives you

In the EU, the right of access lives in Article 15 of the GDPR, and it is wider than HIPAA's in an interesting way: you get not only a copy of your personal data but an account of its use — the purposes of processing, the categories of recipients it has been disclosed to, the envisaged storage period, and the source of data not collected from you.

The first copy is free. The controller has one month to respond, extendable by two further months for complex or numerous requests, with notice. Health data's special-category status under Article 9 changes none of this — the access right applies with full force. The UK retained the same regime under UK GDPR, with the Information Commissioner's Office publishing plain-language guidance on subject access requests and handling complaints when they fail. How research use of health data interacts with these rights is its own subject, covered in GDPR and health research.

The two regimes, side by side

The differences are real but small. The shared core is the point: a fixed deadline, a copy you can keep, and a regulator behind the promise.

How to make a request that works

Put it in writing, and make four moves in the first paragraph. State that you are requesting access under HIPAA's right of access (or making a subject access request under GDPR Article 15). Ask for your complete record — under HIPAA, name the designated record set, including imaging, lab results, clinical notes, and billing records, so nobody quietly substitutes a visit summary. Specify electronic copies in machine-readable form where available; a structured export is worth far more to you than a scanned PDF, for reasons we lay out in how to download your own health data as FHIR. And date the letter, because the clock starts when the request arrives.

Then keep everything: your request, their acknowledgment, every reply. If you are managing a chronic condition, this is not bureaucratic hygiene — the file you assemble is a longitudinal dataset no single provider possesses, an idea we take further in your medical paper trail is a research asset.

When they stonewall

Silence, a demand for an in-person visit, a $200 "processing fee," a portal that contains a tenth of your chart — each has a counter, and the counter is escalation in writing. First a follow-up letter noting the statutory deadline has passed. Then the regulator.

In the US, that means the HHS Office for Civil Rights complaint process — file within 180 days of the violation. OCR's Right of Access Initiative has produced dozens of settlements since 2019, most against ordinary practices and clinics, most for exactly the conduct described above. The complaints work because they are cheap to file and expensive to receive. In the EU and UK, the equivalent complaint to a supervisory authority is likewise free, and access complaints are among the most common — and most commonly upheld — categories they handle.

One more thing the stonewalling conceals: the asymmetry. While a patient waits months for a PDF, the same institution may be provisioning research extracts and analytics feeds on schedules measured in days. The right of access exists to correct that asymmetry. Use it.

Why the copy matters beyond the copy

A complete record in your hands changes what you can do next. You can correct errors. You can carry your history to a new clinician across systems that do not talk to each other — and whoever owns the chart, the rights travel with you, a distinction we unpack in who actually owns your medical records. And you can choose to put your history to work in research.

That last possibility is what Mithras Health is built for. The platform — patient-mediated, chronic-disease focused, pre-launch — treats the patient's copy as the starting point: records live under the patient's control in structured form, and each study receives access only through a revocable, scope-limited consent the patient grants one decision at a time. The right of access is the legal door; a platform's job is to make what comes through it usable.

The Florida case is worth holding onto. The mother was not asking for anything exotic — fetal heart tracings from her own pregnancy. The law was entirely on her side, and had been for two decades. What was missing was friction in the right direction: consequences for the institution rather than the patient. The deadlines, the fee limits, and the complaint portals are that friction. They only work when patients actually pull the handle.