FAQ: Medical or Other Vital Records
The National Library of Medicine doesn’t have or receive medical records, personal health records, or certificates (such as birth, death, marriage, and divorce).
In general, records stay where they are created unless state or federal laws or regulations require something else. If a doctor is part of a practice, the records belong to the practice according to the American Medical Association.
To find a medical record:
- If the patient had health insurance at the time of care, contact the health plan to ask about medical records.
- If you know the doctor or place where treatment was provided, but you don’t have contact information, check a physician or hospital directory at a public library or on the Web, or ask a librarian to help you find contact information.
- If you don't know a physician’s name, a patient's current physician may have copies of older medical records.
- If you know the name of the medical practice where a doctor worked, ask the practice about records.
If a hospital or medical center closed, contact the county, state or regional health department, or state hospital association to ask if the records are available. Some hospitals merge or are under new network ownership; try contacting the health care network that last owned the hospital.
Institutions may have standard forms you need to submit to get medical records. You also may need to get your identity certified to request and receive medical records. Include, if possible, in your request for medical records:
- Details about your identity, including your relationship with the patient
- Dates of service in question and place(s) of treatment
- Patient's date and place of birth
- Names of patient's parents
- Name(s) of patient's doctor(s)
In the United States, the Health Insurance Portability and Accountability Act (HIPAA) ensures that you are entitled to information in your medical record and under certain conditions, someone else's records. The actual record may belong to the health care provider or the practice, but according to Privacy and Security Rules, you have the right to inspect, review, and receive a copy of your medical records and billing records held by health plans and health care providers covered by the Privacy Rule.
According to The Electronic Code of Federal Regulations (e-CFR), with some exceptions, you may have the right to access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set. HIPAA requires medical providers to provide copies of medical records within 30 days of your request. Some states require that records be released earlier than 30 days. The medical provider must give you a reason if meeting a request takes more than 30 days. According to HIPAA, you may request:
- Your own medical records.
- Your child's medical records, with some exceptions.
- Someone else's records. If you have permission, in writing, to act as a representative in accessing records or if you are the person's legal guardian.
- Records of a deceased person if you are related to a deceased person and certain information in that person's medical file relates to your own health.
- Records of a deceased person in certain circumstances, such as if you are the personal representative of an estate designated by a will or court to settle a deceased person's affairs.
You have the right to ensure the information in your record is correct. If you find an error, you can ask a health care provider to correct the information.
If the provider denies your request for medical records, the provider usually must provide you with a denial letter. In some cases, you may be able to appeal the denial.
HIPAA allows health care providers to withhold certain types of medical records, including
- psychotherapy notes
- information a provider is gathering and compiling for lawsuits, and
- medical information the provider believes could reasonably endanger your life, your physical safety, or the safety of another person.
The HIPAA Privacy Rule does not include medical record retention requirements. State laws determine how long medical records are to be retained. However, the Federal Health Insurance Portability and Accountability Act (HIPAA) rules may override state laws if they require shorter periods. The HIPAA Privacy Rule does not include medical record retention requirements, but it does require safeguards to protect privacy of medical records and other protected health information (PHI) including through disposal. The HIPAA requirements are 45 CFR 164.316(b)(2) and the Privacy Rule is 45 CFR 164.530(c). The Centers for Medicare & Medicaid Services (CMS) have retention requirements, too.
States may have additional rules about the retention of and access to your medical records. Contact the individual state office of health, especially if the place of treatment no longer exists. The American Hospital Association offers an interactive State, Regional, and Metropolitan Hospital Associations map.
Immunization and Vaccination Records
Some areas have central immunization registries that keep electronic records of all vaccines given in that area. Check the state immunization coordinator contact information for the state(s) where you or the person(s) lived.
Birth, Death, Marriage, and Divorce Certificates
An official certificate of every birth, death, marriage, and divorce should be on file permanently in a state vital statistics office or in a city, county, or other local office of the state where the event happened. Check Where to Write for Vital Records from the CDC National Center for Health Statistics.