Individual Access to Medical Records: 50 State Comparison

This comparative map shows the medical record access requirements for all 50 states plus the District of Columbia. Specifically, this map shows the time period within which a state requires a medical record to be provided to a patient once requested compared to the 30-day time period in the Heath Insurance Portability and Accountability Act (HIPAA). The map shows if a particular state's requirement is stronger than HIPAA (meaning that the time a provider has to furnish the medical record once requested by the patient is shorter than HIPAA's 30-day period) or the same as HIPAA (meaning that the state's law is that a provider has 30 days from receipt of a patient's request to access medical records to provide the medical records to the patient). The map contains a third category for state laws that are preempted by HIPAA. For the most part, these laws give general time frames (e.g., "within a reasonable time") for providing access to medical records rather than a specific time period, so in these circumstances, HIPAA's 30-day time period applies. A fourth category shows states with a law or regulation that governs only non-covered entities (covered entities in that state would follow HIPAA). The last category for states with no specific law granting an individual a right to access his or her medical record. In that case, the provisions of HIPAA apply, requiring a provider to furnish a copy of a medical record to an individual within 30 days from the request. Details of the requirements for various types of health care providers are noted in the details below and in the summaries of individual state laws. [Last Updated: 09/24/2013]

Click on a state to see more information on Medical Records Collection, Retention, and Access in that state

State Medical Record Access Requirements Compared to HIPAA

Stronger than HIPAA
Same as HIPAA
Preempted by HIPAA
No law specifically granting individual access right; HIPAA applies
HIPAA applies to covered entities, and state has additional requirements for entities not covered by HIPAA

Hide All

State	State Medical Record Access Requirements Compared to HIPAA	Details
Alabama	Preempted by HIPAA	Ala. Admin. Code r. 420-5-7.05: Hospitals must provide patients access to their clinical records within a "reasonable time," but does not specify a specific time limit.
Alaska	Preempted by HIPAA	AS § 18.23.005: Patients are entitled to inspect and recieve copies of their medical records, but the law does not specify a time period.
Arizona	Preempted by HIPAA	A.R.S. § 32-3211: A health professional must establish procedures for providing a patient their medical record in a "timely" manner, but a specific time period is not provided under the law.
Arkansas	Preempted by HIPAA	A.C.A. § 16-46-106: Physicians and hospitals must provide access to patient medical records, but the law does not specify a time period in which access must be given after a request has been made.
California	Stronger than HIPAA	CA Health & Safety Code §123110: Physicians and hospitals must permit inspection of a medical record within 5 working days from the request. Providers must ensure that a copy of medical record is transmitted to the patient within 15 days from when the request was made.
Colorado	Stronger than HIPAA	6 Colo. Code Regs. 1011-1:II-5.2 : Hospitals must provide discharged patients copies of their medical records within 10 days from the request. However, inpatients in a hospital must be provided the opportunity to inspect their records within 24 hours from the request based on the regulation. C.R.S.A. § 25-1-802: Physicians must provide copies of patient medical records to patients within a reasonable time or 30 days (as further defined by the CO Board of Medical Examiners).
Connecticut	Same as HIPAA	C.G.S.A. § 20-7c: Health care providers must furnish a copy of the medical record within 30 days from a patient's request.
Delaware	Preempted by HIPAA	24 Del. C. § 1761: Physicians have 45 days to fulfill a patient's request for copies of his or her medical records. 10 Del. C. § 3926: Physicians and hospitals have 45 days to provide a patient a copy of his or her medical record unless prepayment of the copies was made, in which case the provider has 14 days from the request. If a patient prepays, the provider has the later of the 14 day or 45 day time periods from the patient's request to furnish the medical record copies.
District of Columbia	Same as HIPAA	DC ST § 3-1210.11: Health care providers must provide a patient with his or her medical record within a "reasonable time" from the request, which has been further defined by 17 DCMR § 4612 to mean within 30 days of the request.
Florida	Preempted by HIPAA	F.S.A. § 395.3025: Hospitals must provide access to patient medical records within a "timely manner." Under F.S.A. § 456.057 health care practitioners must provide access to patient medical records in a "timely manner."
Georgia	Same as HIPAA	Ga. Code Ann. § 31-33-2: Physicians and hospitals must provide patients access to their medical records within 30 days of the request.
Hawaii	Stronger than HIPAA	HRS § 622-57: A provider must furnish a copy of a patient's medical record upon request. However, a provider who fails to give a patient access must turn over a copy of the medical record, upon a patient's written authorization that the provider furnish the patient's attorney with the medical record copy, within 10 days from the authorization.
Idaho	No law specifically granting individual access right; HIPAA applies
Illinois	Same as HIPAA	735 ILCS 5/8-2001: Both physicians and hospitals must give a patient access to his or her medical record within 30 days from such a request, or if more time is needed the provider must give the patient an explanation within 30 days, but must provide the record within 60 days of the request.
Indiana	Preempted by HIPAA	Ind. Code § 16-39-1-1: A health care provider must furnish a patient access to his or her medical record upon "reasonable notice," which is not further defined by the law.
Iowa	Preempted by HIPAA	Iowa Admin. Code 653-13.7: Physicians must give patients access to their medical records in a "timely manner," but a specific time period is not provided in the law.
Kansas	No law specifically granting individual access right; HIPAA applies
Kentucky	No law specifically granting individual access right; HIPAA applies
Louisiana	Stronger than HIPAA	LSA –R.S. 40:1299.96: A health care provider must furnish a copy of a medical record within 15 days from a patient's request. LSA –R.S. 40:2144: Hospitals must provide medical record access "as soon as practicable" and upon payment of reasonable copying fees. "As soon as practicable" as defined by La. Admin. Code tit. 48, pt. I, § 9387 as within 15 days from the patient's request and payment of copying fees.
Maine	Preempted by HIPAA	ME. REV. STAT. tit. 22, § 1711 and ME. REV. STAT. tit. 22, § 1711-B: Hospitals and health care practitioners respectively, must provide patients access to their medical records within a "reasonable time" from the request.
Maryland	Stronger than HIPAA	MD Code, Health-General § 4-309: A health care provider or hospital must provide a patient access to his or her medical records within 21 days from the request.
Massachusetts	Preempted by HIPAA	M.G.L.A. 111 §70E: Hospitals and other health care facilities must provide access to a patient's medical record within a "reasonable time" from the patient's request. 243 MA ADC 2.07: A physician must furnish a copy of a medical record to the patient in a "timely manner." There are no time periods specified under Massachusetts law.
Michigan	Same as HIPAA	M.C.L.A. § 333.26265: Physicians and hospitals must furnish the medical record to a patient within 30 days of a request for access.
Minnesota	Preempted by HIPAA	M.S.A. §144.292: Hospitals and physician providers must "promptly furnish" copies of a patient's medical record upon written request, but no time period is defined under the law.
Mississippi	Preempted by HIPAA	Miss. Admin. Code 30-17-2635:10.4: A physician must provide a patient copies of his or her medical record "within a reasonable amount of time" from the patient's request, but no timer period is specified.
Missouri	Preempted by HIPAA	V.A.M.S. 191.227: All health care providers must furnish a copy of a patient's medical record to the patient within a "reasonable amount of time" from the patient's request and payment of reasonable copying fees. The law does not define a specific time period.
Montana	HIPAA applies to covered entities, and state has additional requirements for entities not covered by HIPAA	Mont. Code Ann.§ 50-16-541: Non-covered health care providers must give an individual access to his or her medical records within 10 days of receiving a written request.
Nebraska	Stronger than HIPAA	Neb. Rev. Stat.§ 71-8403: Health care providers must allow an individual to examine his or her medical records within 10 days of receiving a written request, and must provide a copy such records within 30 days of receiving a written request.
Nevada	Stronger than HIPAA	Nev. Rev. Stat. § 629.061: Health care providers must permit a patient to examine his or her health care records within 5 working days of receiving a request, unless the records are located outside Nevada, in which case within 10 working days of receiving a request. Copies of such records must be made available upon request.
New Hampshire	Preempted by HIPAA	N.H. Rev. Stat. Ann. § 151:21: A patient has a right to receive a copy of his or her medical records from a health care facility upon request (see also N.H. Code R. He-P 802.14). N.H. Rev. Stat. Ann. § 332-I:1: A patient has a right to receive a copy of his or her medical records from a health care practitioner upon request (see also N.H. Code R. Med 501.02). The laws do not specify a time period for access.
New Jersey	Same as HIPAA	N.J. Admin. Code § 8.43G-4.1: Every hospital patient has a right to "promptly access" information in his or her medical record, and has the right to obtain a copy of such record within 30 days of a written request (see also N.J. Admin. Code § 8:43G-15.3 and N.J. Rev. Stat. § 26:2H-12.8).N.J. Admin. Code § 13:35-6.5: A health care practitioner must provide a copy or a summary of a patient's treatment or billing records within 30 days of receiving a request.
New Mexico	Preempted by HIPAA	N.M. Code R. § 7.7.2.19: Every hospital must have a policy providing that patients may access their own medical records. N.M. Admin. Code 16.10.17.8: Physicians must release medical records to patients upon a "legal request" for such record. The laws do not specify a time period for access.
New York	Stronger than HIPAA	N.Y. Pub. Health Law § 18: Health care providers must provide an individual with the opportunity to inspect his or her patient information within 10 days of a written request; a copy of such information must be provided within a "reasonable" time of a request.
North Carolina	No law specifically granting individual access right; HIPAA applies	N.C. Gen. Stat. § 90-411: A health care provider is permitted to charge a reasonable fee for providing copies of a patient's medical records when the patient requests a copy for use in a personal injury claim or a claim for social security disability. The law does not provide an affirmative access right for individuals, and identifies no time period for access.
North Dakota	Preempted by HIPAA	N.D. Cent. Code § 23-12-14: A health care provider must give patients a copy of his or her medical record and/or bills once a patient submits a signed authorization making such request. The law does not specify a time period for access.
Ohio	HIPAA applies to covered entities, and state has additional requirements for entities not covered by HIPAA	Ohio Rev. Code § 3798.03: Covered entities must grant individual's access to his or her protected health information consistent with HIPAA's requirements. Ohio Rev. Code § 3701.74: A healthcare provider (including a non-covered entity) must permit a patient to examine or obtain a copy of all or part of the patient's medical record within a "reasonable time" after receiving a written request (see also Ohio Admin. Code 3701-83-07 and Ohio Admin. Code 3701-84-07). The law does not specify a time period for access to records maintained by non-covered providers.
Oklahoma	Preempted by HIPAA	Okla. Stat. tit. 76, § 19: A physician or health care facility must give a patient access to the information in his or her medical record upon request. The law does not specify a time period for access.
Oregon	Same as HIPAA	Or. Rev. Stat. § 192.553: Individuals in Oregon have the right to access and review their own protected health information. Or. Admin. R. 847-012-0000: A physician must permit a patient to inspect, or must provide a copy or summary of the patient's medical record within 30 days after receiving a request.
Pennsylvania	Preempted by HIPAA	28 Pa. Code § 115.29: Hospitals must give a patient access to and/or provide a copy of his or her medical records upon request (see also 28 Pa. Code § 103.22). 49 Pa. Code § 16.61: A health care practitioner's failure to provide access to or a copy of a patient's medical record upon the patient's written request is considered unprofessional conduct, subject to disciplinary action. 49 Pa. Code § 25.213: Osteopathic physicians must provide a patient with a complete copy of his or her medical records within a "reasonable time" of a request. The laws do not specify a time period for access.
Rhode Island	Same as HIPAA	31-4-18 R.I. Code R. § 27: Hospitals must provide a patient with a requested record within 30 days of receiving the request. 31-5-41 R.I. Code R. § 11: A physician must provide a patient's medical records within 30 days of receiving a written request (see also R.I. Gen. Laws § 5-37-22).
South Carolina	Preempted by HIPAA	S.C. Code Ann. § 44-7-325: Health care providers must provide a copy of a patient's medical record within 45 days of receiving a request, or within 45 days after the patient is discharged, whichever is later (see also S.C. Code Ann. § 44-115-30 and S.C. Code Ann. § 44-115-60).
South Dakota	Preempted by HIPAA	S.D. Codified Laws § 36-2-16: A health care practitioner must provide copies of all available medical records to a patient upon receipt of a written request. The law does not specify a time period for access.
Tennessee	Stronger than HIPAA	Tenn. Code Ann. § 63-2-101: Health care practitioners must provide a copy or summary of a patient's medical record within 10 working days of receiving a request for access. Tenn. Code Ann. § 68-11-304: Hospitals must provide medical records to a patient upon written request "without unreasonable delay." The law does not specify a time period for access to hospital records.
Texas	Stronger than HIPAA	Tex. Health & Safety Code Ann. § 241.154: A hospital must make a patient's recorded health care information available to the patient no later than 15 business days after receiving a written authorization (see also 25 Tex. Admin. Code § 133.42). 22 Tex. Admin. Code § 165.2: A physician must provide a copy or a summary of a patient's medical and/or billing records within 15 business days after receiving a written release for the information (see also Tex. Occ. Code Ann. § 159.006). Tex. Health & Safety Code Ann. § 181.102: A provider using an electronic health records system must provide a person's record in electronic form, if the system is capable of doing so, within 15 business days after receiving a written request, unless the person agrees to accept the record in a different form.
Utah	HIPAA applies to covered entities, and state has additional requirements for entities not covered by HIPAA	Utah Code Ann. § 78B-5-618: Non-covered health care providers must permit a patient to inspect or obtain a copy of his or her records unless access is restricted by law or judicial order. Providers must comply with HIPAA deadlines when providing a copy of a patient's records.
Vermont	No law specifically granting individual access right; HIPAA applies	Vt. Stat. Ann. tit. 26 § 1354: A physician's failure to make a copy of a patient's records available "promptly" to a patient when given proper written request is considered unprofessional conduct. The statute does not identify an affirmative right to access, and does not specify a time period for access.
Virginia	Stronger than HIPAA	Va. Code Ann. § 32.1-127.1:03: Health care entities must disclose a patient's health care records to a patient in accordance with a written request for disclosure. Health care entities must furnish copies of or allow access to a patient's health care records in an electronic format within 15 days of receiving a written request for access to such records. Va. Code Ann. § 54.1-2403.3: Health care practitioners must release copies of a patient's medical records in compliance with requirements applicable to health care entities (see also 18 Va. Admin. Code § 85-20-26). The laws do not specify a time period for access to records in a hard copy (e.g., paper) format.
Washington	Stronger than HIPAA	Wash. Rev. Code § 70.02.080: Health care providers must permit a patient to examine or copy his or her recorded health care information no later than 15 days after receiving a written request.
West Virginia	Preempted by HIPAA	W. Va. Code § 16-29-1: Health care providers must furnish a copy of a patient's record within a "reasonable time" after receiving a written request. The law does not specify a time period for access.
Wisconsin	Preempted by HIPAA	Wis. Stat. § 146.83: Health care providers must permit a patient to inspect his or her records once the patient submits a statement of informed consent; providers must furnish a copy of such records after receiving the patient's informed consent and payment of the applicable fee. The statute does not specify a time period for access.
Wyoming	Stronger than HIPAA	Wyo. Stat. Ann. § 35-2-611: A hospital must make a patient's recorded health care information available for examination and/or provide a copy of such information to a patient no later than 10 days after receiving a written request. Wyo. Admin. & Info. Code R. Board of Medicine, ch. 3 § 4: A physician must make information in a patient's medical records readily available, or provide a copy or summary of such records no later than 30 days after receiving a signed, written release (see also Wyo. Stat. Ann. § 33-26-402).

Individual Access to Medical Records: 50 State Comparison

Welcome to Health Information & the Law