Why records come first
A serious medical malpractice question cannot be answered from memory or instinct. What the chart says, what was timed and ordered, what tests came back, what was communicated, and what was never done — all of that lives in the medical record. Before a lawyer can give honest input on whether a case is worth filing, that record has to be in hand and readable.
The federal right of access exists because Congress concluded that patients should not have to go through litigation, or beg, to read their own care. The right is broad and intentional. Used carefully, it can also produce a record set that an experienced reviewer can actually use.
What about the patient portal?
Most hospitals and clinics now offer a patient portal — a website or app where patients can read recent visit notes, lab results, imaging summaries, and discharge paperwork. The portal is fast, free, and useful. It can be especially valuable when only a couple of critical files matter — a radiology report, an office note from a key visit, or a recent test result. In that kind of situation the portal is often the quickest way to get what you need.
For a serious malpractice review, though, the portal is rarely enough. What appears in the portal is usually a curated, partial view of the chart — the surface that the institution chose to share. Internal communications, alerts, “sticky notes,” prior versions of revised notes, audio files, full radiology imaging in DICOM, and many other elements that matter in a serious case typically do not appear there. A reviewer who works only from the portal is reading a summary, not the record.
The portal is a fine starting point. A short factual summary — drawn from what you remember and what the portal shows — is usually all a lawyer needs to decide whether a matter warrants deeper review. The formal HIPAA request below comes next, when a full record review is justified. The portal supports early orientation and a clear summary; the formal request produces the complete record set an experienced reviewer needs to evaluate the case.
What the federal right of access gives you
Under HIPAA and the HITECH Act, a covered hospital or provider must respond to a written request for protected health information from the patient (or the patient's personal representative) within thirty days, with one allowed thirty-day extension. See 45 CFR 164.524. The records can be requested in electronic form, in the format the patient designates, when the records are maintained electronically. The fee a hospital may charge is limited by federal law to the reasonable, cost-based labor and materials of producing the electronic copies — not a per-page schedule designed for paper.
Three things matter in practice:
- Electronic, not paper. Most hospitals now keep their records in an electronic health record system. Asking for the paper version is asking for a fraction of what is there.
- Native text, not flattened images. A “PDF” can be a file with searchable, copy-and-paste text — or it can be a flattened image of pages, with all the text data deleted. The first is workable. The second is much less so.
- Radiology in DICOM. Films and other imaging are useful only if a radiology expert can re-read them. That requires the original DICOM files, not screenshots.
What to ask for, and why the wording matters
A short request for “all my records” will usually produce some scanned PDFs and not much else. A careful request asks for:
- The full electronic chart and any electronic billing records.
- All radiology imaging in native DICOM format.
- Communications between the patient and providers, and among providers about the patient.
- Audio files, including phone calls handled through hospital systems.
- Alerts, warnings, decision-support information, and “sticky notes” produced through the EHR.
- All versions of revised notes, not just the final.
- A certification of completeness and accuracy.
The form on this page makes those requests and explains why.
Information blocking and why text data matters
A hospital that exports records as flattened-image PDFs has produced something far less useful than what it actually has. The patient ends up with pictures of words instead of words. A reviewer cannot search the file, cannot copy quoted language, and cannot easily test for inconsistencies among notes.
Federal law treats the deliberate stripping of electronic text as “information blocking.” See 45 CFR 171.204. The form on this page asks for native-text PDF and reminds the institution of that rule.
If the institution pushes back
Some institutions overcharge, delay past the statutory window, refuse to produce native-text PDFs, or treat the request as a request for paper. The right path forward depends on the case, but several standard moves exist:
- Ask the records department to escalate to the privacy officer or HIPAA compliance officer.
- Document each delay or refusal in writing.
- File a complaint with the U.S. Department of Health and Human Services Office for Civil Rights, which enforces the right of access and has issued numerous public settlements.
In a malpractice setting, the institution's response itself can be informative. A hospital that fights an ordinary records request often behaves the same way later.
Use the form
The download below is a generic letter for an individual patient asking for the patient's own records. The yellow placeholders show the spots that need to be filled in. The completed letter can be emailed to the address the hospital lists for medical-records requests, with a copy of a government photo identification attached.
It is not legal advice, and using it does not create an attorney-client relationship. It is the kind of letter an experienced lawyer uses for ordinary patient-side records requests, made available because the form is more useful than its absence.
Download the medical records request (.docx)
