Accessing Your Medical Records | MedXL

Your medical records tell the story of your health: diagnoses, test results, medications, immunizations, and the notes clinicians write about your care. In both the United States and Canada, you have a legal right to see that story. Yet many people have never requested a record, and plenty are surprised by what is involved. This guide explains your rights, the practical steps, and what to do with records once you have them.

Know your rights in plain terms

In the United States, federal privacy law (HIPAA) gives you the right to inspect and obtain copies of your medical records from doctors, hospitals, and most other providers, with narrow exceptions such as some psychotherapy process notes. Providers must respond within a legally defined time and may charge only a reasonable, cost-based fee for copies. Rules also push health systems to give patients electronic access to their information, which is why test results now often appear in your portal quickly, sometimes before your doctor has discussed them with you.

In Canada, the same basic right exists, grounded in provincial and territorial health privacy laws and long-standing court decisions: the physical record belongs to the custodian (the clinic or hospital), but the information belongs to you, and you are entitled to access it. Fees, response timelines, and procedures vary by province, so check the health privacy office or information commissioner's website for your province when you need specifics.

In both countries, access can be refused only in limited circumstances, such as serious risk of harm, or records containing another person's confidential information, and refusals can be challenged through the relevant privacy regulator.

Parents can generally access young children's records; access to adolescents' records becomes more limited as teens gain rights over their own health information, at ages and in ways that vary by jurisdiction. Caregivers of adults need consent or legal authority such as a power of attorney.

Start with the patient portal

The easiest access route is usually electronic:

Portals rarely contain everything. Older records, scanned documents, imaging, and full clinician notes may exist only in the underlying chart, which is where formal requests come in.

Make a formal request when you need the full record

For complete records, records from years past, or copies for another doctor, make a written request:

  1. Identify the custodian. The clinic, hospital health information (medical records) department, or, if a practice closed, whoever took custody of its records; the provincial college or state board can often tell you.
  2. Ask for the request procedure. Many organizations have a form. If not, a short letter or email works: your name, date of birth, contact details, what records you want and for what date range, the format you want (electronic is often cheaper and faster), and your signature.
  3. Be specific if you can. "All records" is your right, but "discharge summary, operative report, and pathology from my 2023 surgery" arrives faster and costs less.
  4. Ask about fees up front. Reasonable copying fees are permitted in both countries; ask for an estimate before large requests.
  5. Track the timeline. If the legal response window where you live passes with silence, follow up in writing, then escalate to the privacy regulator if necessary.

For imaging, request both the report and the images themselves; images are typically provided on disc or via secure electronic transfer, and specialists giving second opinions often want them.

Read your records actively

Once you have records, use them.

If you find a genuine error, both countries give you a path to request correction. Put the request in writing to the custodian, identifying the error and the fix. Factual errors (wrong medication, wrong side of the body, someone else's result filed in your chart) should be corrected. If the disagreement is about a clinician's opinion, you are generally entitled to have a statement of disagreement attached to the record even when the original text stands.

Use records to make your care better

A personal copy of your key records pays off repeatedly:

A simple system works: one folder (physical or digital) per person, with a one-page summary on top listing conditions, surgeries, medications, allergies, and clinicians' contact details. Update it after significant appointments.

Mind the privacy side

Access rights come paired with privacy rights, and a few habits protect both. Use strong, unique passwords for portals and enable any offered two-step verification, since a health portal is among the most sensitive accounts you own. Be deliberate about sharing: portals often support proxy access for family members, which is safer than sharing your login. If you download records to your own devices or forward them by email, remember that copies outside the custodian's system are yours to secure. Think twice before uploading full records to third-party apps and services; check what they do with the data before granting access. And if you believe your records were accessed inappropriately, custodians in both countries have complaint processes, with the privacy regulator behind them, and you are entitled to ask who has accessed your record in many jurisdictions.

Key takeaways

This article is general information, not medical advice. Consult a qualified clinician for guidance about your situation.

Canonical link