Asking for Your Records

A patient in the U.S. asked for their own medical records six times.

The first request went in during February. The records arrived more than a year later, on paper, after an invoice for $82.57 and a complaint to the federal government. In December 2025 the case ended in a $112,500 settlement with the Office for Civil Rights at the Department of Health and Human Services, whose director, Paula M. Stannard, said afterwards: "Individuals should not have to make multiple requests and file a complaint with OCR to gain access to their health information."

It was the 54th enforcement action under the office’s Right of Access Initiative. The existence of a running count says something on its own.

Most records requests are nowhere near that bad. Plenty are slower than they should be, though, and the difference between a request that moves quickly and one that sits in a queue can come down to how the request was written.

The rule is 45 CFR 164.524, and it is shorter and more useful than its name suggests.

Thirty days. A clinic must act on a request within 30 days. It may take one extension of up to 30 more days, and only one if it says so in writing inside the original window, giving both the reason and the date the records will actually arrive.

Electronic on request. Where a patient asks for an electronic copy, the clinic must provide it in the form requested if that is "readily producible." This matters more than it sounds. Paper arrives slower, costs more, and is far harder to forward to anyone else.

A short list of allowable fees in the U.S. The regulation names what a fee may include, and the list is closed: labor for copying, supplies for the paper copy or electronic media, postage where mailing was requested, and preparing a summary if the patient agreed to one. Time spent searching for and retrieving the file does not appear anywhere on that list. The fee also has to be reasonable and cost-based, which is a real constraint rather than a formality. It is the cost of producing the copy, not a price the clinic gets to set.

This is the part that can unexpectedly cost money, largely because the intuitive move is also the expensive one.

The instinctive move is to ask Clinic A to send the records straight over to Clinic B. It feels efficient and considerate. It is also, thanks to a U.S. federal court decision, the version where the fee protections may not apply.

In Ciox Health v. Azar (2020), a federal district court vacated the guidance that had extended the capped patient rate to requests where a patient directs their records to a third party. The practical upshot: the capped, cost-based rate applies most cleanly when the records go to the patient. Directed somewhere else, the number quoted can be larger.

So the cleaner route is to have them sent to the patient, in electronic form, and forwarded on from there. It is one extra step, it stays inside the cheapest and best-protected version of the rule, and it leaves the patient holding their own copy, which is worth having no matter how the consultation goes.

Now the more difficult question, and the reason so many second opinions underdeliver. "My records" is not a specific request, and a clinic answering it literally could simply send back a discharge summary.

No professional body publishes a records checklist for fertility patients. ASRM’s patient booklets describe the standard workup in detail, but a description of tests is not the same thing as a list of documents. So the list below is has been created by our research team: a synthesis assembled from ASRM’s description of that workup, the 2025 ESHRE and ALPHA Istanbul consensus on embryo assessment, the data categories the CDC collects from clinics under a federal reporting law passed in 1992, and the intake requirements clinics themselves publish for second-opinion consults.

There is a technical reason the embryology report matters more than its length suggests.

In 2025, ESHRE and ALPHA published an updated consensus on how eggs and embryos should be assessed. One of its recommendations is that fertilization observations be recorded and reported in hours after insemination rather than in days, because, as the document puts it, standardized timing is critical for reliable comparison of results between different laboratories.

In plain terms: a grade written down in one lab does not automatically mean the same thing in another. "Day 5, 4AA" is not a universal unit of measurement. It is a local reading, and it travels honestly only when the observations underneath it travel too. Which is why a summary saying "eight embryos, four blastocysts, two transferred" reads like a complete account and tells a new doctor almost nothing.

An escalation ladder, in order. Most requests never get past the first rung.

1.     Follow up in writing, and name the deadline. A short email noting the date of the original request and the 30-day requirement resolves a surprising number of stalled requests, because it moves the file from a general queue to a specific one.

2.    File a complaint with the Office for Civil Rights. It is free, it is filed online, and it generally needs to be within 180 days. This is the route behind all 54 enforcement actions logged under the initiative as of late 2025. It is also worth knowing that a clinic stays responsible even when it outsources records to an outside vendor. In a 2025 case ending in a $200,000 penalty, OCR said a covered entity’s responsibility to provide timely access continues even when it contracts that work out.

3.    Report it as information blocking. A separate and much less well known route, for electronic health information being withheld. Reports go through a federal portal run by the federal office that oversees health information technology, which says reports are protected from public-records disclosure. HHS announced a push on enforcement in September 2025. Where results are sitting visible in a portal and the answer is still to wait a month for a copy, this is the lever.

The right to affordably obtain a copy of one’s medical records exists in most places; however the timelines may differ. For example, in the UK, the equivalent request is normally free, and the Information Commissioner’s Office says organisations normally have one month to reply, extendable by up to two more for complex requests, but only if they say so inside the first month and explain why.

In Ontario, Canada, the Information and Privacy Commissioner gives custodians 30 to 60 days and allows them to recover reasonable costs, with an estimate provided in advance. There is also a procedural trap worth knowing: a complaint to the regulator is only possible if access was denied after a request made in writing. A verbal ask does not preserve the right to appeal.

A records request may feel like a basic admin task, but it’s important to remember that a fully comprehensive, written request is likely to yield a cleaner record hand off and ensure nothing is left out. What gets reviewed beforehand by the new physician is what decides whether the result is a second opinion or just a second impression. A partial file can only produce a partial answer, and a partial answer is less likely to provide any real value to the patient.

45 CFR 164.524. The regulation itself. Dry, short, and the thing to quote if anyone claims the rules are different.

File a health information privacy complaint, HHS Office for Civil Rights. Free, online, and the step most people do not realize exists.

Report information blocking. The separate route for electronic records being withheld.

The Istanbul consensus update, Human Reproduction, 2025. Technical, but it is the document behind why embryo grades do not travel cleanly between labs.

Subject access requests, Information Commissioner’s Office. The UK equivalent, for readers outside the US.

Path to Parenthood publishes journalism and education, not medical advice. Everything here is meant to inform the questions you bring to your own care team, not replace their guidance for your specific situation. It is not legal or financial advice either.