How to Find Old Medical Records Online

Medical records are a core part of managing your healthcare, from tracking past diagnoses to giving a new provider the full picture before treatment. Under the HIPAA Privacy Rule, you have a federal right to access and get copies of your own medical records. That right of access is separate from how long a provider has to keep those records in the first place, which is set mainly by state law and varies widely.

Healthcare providers and insurance companies can also share information from your records without a separate authorization from you when it's necessary for treatment, payment, or certain healthcare operations.

This guide covers how to track down medical records that are years or decades old, what to do if a provider denies your request or no longer exists, how to request the records of a relative who has died, and what information can be shared about you without your consent.

First Steps to Finding Old Medical Records

Physicians and other healthcare providers must keep a patient's medical and clinical records for a set period, but HIPAA is not what sets it. HIPAA governs your right to access and obtain your records, not how long a provider has to hold onto them; the retention period comes mostly from state law and ranges from a few years to multiple decades depending on the state and the type of record. For a full breakdown, see our Medical Records Retention Laws by State guide.

Federal law is not silent everywhere, though. A hospital operating under the Medicare hospital conditions of participation must retain medical records in their original or legally reproduced form for at least five years under 42 CFR 482.24(b)(1), a floor that applies on top of whatever the state requires. Critical access hospitals, a separate Medicare provider category concentrated in rural areas, sit under a different rule and must keep records for at least six years from the date of the last entry under 42 CFR 485.638(c). Those floors cover hospitals in the Medicare and Medicaid programs, not every clinic or solo practice, so for most providers the state period is still the one to check first. Our medical records retention hub covers how that federal minimum sits alongside the state rules.

Because medical records are sensitive, both retention and access are subject to legal protections, including rules about who is allowed to see a record and how a patient can request a copy. Locating records from a decade or more ago can still be difficult even where the law entitles you to them. The facility may have closed, or the treating doctor may have retired. The steps below can help.

Review Your Personal Documents

Start with what you already have. Before contacting anyone else, check your own files for prescriptions, discharge paperwork, test results, or old insurance statements. Patients often have more documentation on hand than they remember.

Contact the Hospital or Clinic

If your own files don't have what you need, request the records directly from the hospital or clinic where you were treated. Most healthcare facilities have a formal process, usually through a medical records or health information management department, for releasing records to the patient they belong to.

If there's no clear process in place, send a written request with your full name, current address, date of birth, phone number, and the approximate year and nature of treatment. Be specific about which records you need and why. A narrower request is easier for staff to fill quickly.

Reach Out to Insurance Companies and Other Providers

If the original hospital or clinic can't produce the records, for example because it has closed, try the doctor's other offices or your health insurance company. Insurers typically keep their own claims and billing records tied to the treatment and are far less likely than a small practice to have gone out of business. Send the same written request you sent the provider.

Expect to wait. Under HIPAA's right of access, a covered provider generally has 30 calendar days to respond to a records request, with one 30-day extension allowed if it gives you written notice explaining the delay, so a response can take up to 60 days in total. Keep a copy of your original request.

A provider cannot deny you access to your own records because of an unpaid bill. Nonpayment does not appear among the grounds for denying access listed in 45 CFR 164.524(a)(2) and (a)(3). A provider may charge a reasonable, cost-based fee for copying labor, supplies, and postage under 45 CFR 164.524(c)(4), but that provision does not permit a charge for the time spent searching for or retrieving the records.

If a Request Is Denied, Ignored, or the Provider No Longer Exists

A provider that refuses a valid records request, or never responds at all, is not necessarily the end of the road.

• File a complaint. You can file a complaint with the HHS Office for Civil Rights if a covered provider denies your right of access or fails to respond within the required timeframe. OCR investigates HIPAA right-of-access complaints and has taken enforcement action against providers that withhold records.
• Check with your state health department. When a hospital or practice closes, state law typically requires it to name a records custodian and notify the state health department where the records will be stored. The department can often point you to the successor practice, storage vendor, or state agency that now holds the file.
• Ask the state medical board. For a solo practitioner who retired, died, or lost a license, the state medical board may know who took custody of patient records.
• Confirm the retention period hasn't simply expired. If the applicable period has passed and the provider properly destroyed the records, there may be nothing left to produce. A provider is not required to reconstruct records it was legally allowed to destroy.

Finding Old Medical Records Online

Records from a decade or more ago were often never digitized, so they usually won't show up in an online patient portal even when the underlying paper file still exists. If you specifically need a digital copy and the original provider can't produce one, third-party records-retrieval services exist that request records from providers on behalf of a patient or an authorized representative, though most of these companies now sell to hospitals, insurers, and law firms rather than to individual patients.

These services still depend on the records existing somewhere. If a provider has already destroyed your records because the applicable retention period expired, no retrieval service can recover what no longer exists.

Confirm what any retrieval service can actually do for an individual patient before you rely on it: whether it accepts requests from individuals at all, what it charges, and how it handles the signed authorization it needs from you. Every retrieval service depends on the provider at the other end responding, so which of your past providers it can reach is not guaranteed, and no service can compel a provider to move faster than the 30-day deadline in 45 CFR 164.524.

Because a retrieval service acts as your authorized representative, a provider may contact you directly to confirm your identity and consent before releasing anything. A call or message verifying such a request is a normal part of the process, not a sign of a scam.

Who Can Access Your Medical Records

The right to access your medical records belongs to you or the personal representative you designate.

Providers and health plans may share your records with another provider or plan for treatment or payment purposes, or when you give explicit authorization, without that counting as a HIPAA violation. Outside of treatment, payment, certain healthcare operations, and a short list of situations such as public health reporting, the Privacy Rule generally does not permit a provider to disclose your records to another provider or plan without your authorization.

Getting the Records of a Relative Who Has Died

People often go looking for old medical records while settling an estate or trying to understand a relative's cause of death. The Privacy Rule addresses that situation directly.

Under 45 CFR 164.502(g)(4), if an executor, administrator, or other person has authority under applicable law to act on behalf of a deceased individual or that individual's estate, a covered entity must treat that person as the deceased patient's personal representative, with respect to protected health information relevant to that representation.

Two limits in that sentence do most of the work. The authority comes from applicable law, meaning your state's rules on who may act for an estate, so being the closest surviving relative is not by itself the qualification. And the access runs to the information relevant to the personal representation, not automatically to the entire file for any purpose.

In practice, the records department will ask you to document that authority before it releases anything. What it accepts varies, so ask the provider's health information management department which documents it requires, and confirm the appointment requirements with the probate court handling the estate.

If you're wondering whether a specific type of result becomes part of your permanent file, see our guide on whether a failed drug test shows up on your medical record. For a state-by-state breakdown of how long a provider has to keep your records in the first place, see Medical Records Retention Laws by State, and for hospital-specific rules, see How Long Do Hospitals Keep Medical Records?

Consult a licensed attorney or your state's health department for advice specific to your situation, especially if a provider has denied a valid records request.