How Long Does It Take to Get Medical Records? Legal Deadlines and How to Speed It Up

How long does it take to get medical records is usually answered with a number that describes somebody else's request. Firms track turnaround from the day their own request goes out. Counting from there is wrong, and it hides most of the delay.

Asking how fast a custodian answers is more useful. What matters is how many days pass between the client's first call and a request correct enough to be answered once.

On a matter where intake captured four providers and the client actually saw seven, the three missing requests have not been sent late. They have not been sent at all, and nobody notices until a demand package is being assembled around three months of treatment nobody has records for.

This piece covers what the deadlines actually are, which of them reach a request your firm sends, and where the recoverable days are. Very little of it sits at the custodian's end.

The deadline most firms are counting is not the one that governs them

Worth settling briefly, because it determines whether you are owed anything at all.

45 CFR 164.524 creates an individual's right of access to their own records and requires a covered entity to act no later than 30 days after receiving the request, with one 30-day extension on written notice. That is the figure every page quotes.

Plaintiff firms typically send something else entirely. Your office makes a disclosure request under a signed authorization, governed by 45 CFR 164.508, which permits the provider to release and says nothing about how quickly.

After *Ciox Health, LLC v. Azar*, 435 F. Supp. 3d 30 (D.D.C. 2020), the third-party directive was vacated from the access framework, which is why a firm-directed request now sits outside it.

Practically, a provider sitting on your authorization for six weeks has missed no federal deadline, because none was ever running. We have covered chasing that request in our piece on medical records follow-up. What follows is about the time spent before it goes out.

Two states give an attorney a faster route than the federal rule

State law is where a firm-submitted request can actually acquire a clock, and two states are worth knowing in detail because they work differently from each other.

California Evidence Code section 1158 addresses the attorney request directly. Before an action is filed or a defendant appears, an attorney or the attorney's representative presenting a written authorization signed by the patient is entitled to have the records made available promptly, and a provider who fails to make them available during business hours within five days of presentation may be liable for reasonable expenses including attorney's fees. Five days, with a cost-shifting consequence attached, running to the attorney and not the patient.

Texas Health and Safety Code section 241.154 takes the other approach. Hospitals receiving a written authorization must respond as promptly as circumstances require and no later than the fifteenth day.

Note the catch in that same subsection. Those fifteen days run from the date the request and the payment authorized under subsection (b) are both received.

An unpaid fee reads as a late response and is something else entirely. Nothing is running.

Those two provisions are worth more than the 30-day figure to a firm practicing in either state, and neither is mentioned on most of the pages answering this question.

What a study of 83 hospitals found about asking the wrong way

Independent data on this question is thin, and the best of it comes from Lye and colleagues in JAMA Network Open (2018;1(6):e183014), who reviewed the release authorization forms of 83 top-ranked US hospitals and then called each medical records department as a simulated patient.

Two findings matter for a firm planning requests.

First, hospital forms understate what is available. Only 44 of the 83 hospitals, 53 percent, gave patients the option on the form to request the entire medical record, while by telephone all 83 said they could release it.

Formats showed the same pattern. Fifty-five hospitals said by phone they could provide a CD against 35 whose forms listed it, and 39 said email against 27 on the form. Building a request from the form alone asks for less than the custodian will actually give.

Second, cost varies enormously. Phone quotes on a 200-page record ran from $0.00 to $541.50, and 48 of the 82 hospitals that disclosed a cost sat above the $6.50 federal recommendation for electronically maintained records. On processing, 17 of 71 hospitals reported mean release times under 7 days and 3 reported over 30, with paper release ranging from same-day to 60 days.

This was one simulated caller contacting a sample of top-ranked hospitals, and the authors say so. Even so, these figures are the only ones on this topic produced by a method instead of a vendor's own book of business.

Where the days actually go

Lay the elapsed time out and the shape of the problem changes.

Asked this way, how long does it take to get medical records stops being one number and becomes six, and only two of them are yours. Rows one and five are movable, and they are the same problem appearing twice. Both are caused by information the intake call did not capture.

Forty-five days from a custodian counts as slow. An intake that produced a wrong date range is worse, because the 45 days happen, the records arrive, they do not cover the treatment that matters, and the 45 days happen again.

The five answers a request cannot be built without

Requests are only as good as the five facts behind them, and a first call that gets four of them produces a request that completes and still fails.

Every facility, not every doctor: clients name physicians and forget institutions. Ambulance companies, imaging centers, hospitals that own the urgent care, and physical therapy practices billing under another entity are all separate custodians, so a client who says "I saw Dr. Reyes" has named one of them. Our breakdown of how many calls a PI case generates covers how quickly that list grows.

The treating date range, bounded on both ends: an open-ended range invites the custodian to interpret it, and a range that starts at the date of loss misses the prior treatment that the defense will find.

The patient's name as the provider has it: a maiden name, a hyphenation the client dropped, or a middle initial on the chart and not on the authorization is the most common reason a facially valid request comes back rejected.

Date of birth and the last four of the SSN: the two identifiers nearly every custodian matches on, and the two most often transcribed wrong from a phone call.

Whether treatment is ongoing: a closed range on an open course of treatment guarantees a second request, which is a second full custodian cycle.

None of these are difficult questions. They all get skipped when a caller is distressed and the person taking the call is working from a script built to capture a lead, not a records request.

How HelloCounsel captures the provider list on the first call

HelloCounsel is our product, so read this as a description of design choices and not a neutral assessment.

Our intake agent asks for facilities instead of doctors, then follows any named physician with a question about where that physician practices, because institutions hold the records. Transport and imaging are asked about separately, since callers rarely volunteer either.

Treating date ranges are captured bounded at both ends, with a separate question about treatment before the incident, so the opening date is asked for and never assumed.

Identifiers are read back to the caller for confirmation instead of transcribed once, and the name question asks specifically whether the records might be filed under a different one.

Whether treatment is ongoing is a required field, not an optional one, because it determines whether the request should be scoped open or repeated later.

All of it is written to the case management system as a structured record, so whoever drafts the request works from fields instead of reading back a call summary. Mechanics of that write-back are covered in our note on CMS write-back.

What moves a custodian when no deadline applies

If the federal clock does not reach your request, the obvious question is what does. Several things do, arranged as a ladder, and most firms only ever use its bottom rung.

The custodian call. A request that has gone quiet is usually sitting in a queue behind a correctable defect your office was never told about. Calling to ask what is blocking that specific request, by request date and patient name, resolves more of them than faxing the form again.

The records supervisor. Prioritizing a stalled request is above the pay grade of whoever answers. Their supervisor has that authority, and asking by role gets you there faster than asking by name.

Risk management. A hospital's risk office has a different relationship to an unanswered records request than its release-of-information desk does, particularly where the treatment itself is in question.

The state deadline, cited by section. Where your state gives a firm-submitted request a clock, quoting the section number changes the conversation, because the custodian's own compliance staff know what it is. In California that citation also carries a fee-shifting consequence, which is why it works.

Switching the requester. Having the client submit the same request as a right of access brings it inside the federal deadline and the fee cap. You lose some convenience and usually gain time.

The subpoena. Available once litigation is underway, under 45 CFR 164.512(e), with its own notice requirements. Think of it as the top of the ladder instead of a shortcut around it, and pre-suit it stays unavailable.

Writing the ladder down is worth doing, because the decision of which rung to use is usually made by a case manager at the moment of frustration, and without one the answer defaults to sending the same request again.

Telling whether the delay is yours or theirs

Firms measure records turnaround as one number, which is why the number never improves. Something similar happens to intake quality generally, as we covered in why PI firms lose cases before they sign them. Split it and the answer becomes actionable.

Measure intake to request sent, which is entirely yours and is usually the largest single block. Measure request sent to records received, which belongs to the custodian and is the only part the 30-day conversation is about.

Then measure requests resent after rejection as a share of all requests, the clearest signal that the problem is upstream, and providers added to a matter after the first request went out, which tells you directly how often intake produced an incomplete list.

Where the fourth number stays above zero, follow-up discipline will never fix the timeline, because the firm is chasing requests nobody has written. Our breakdown of case manager workload covers what that costs in hours.

What this means for the answer

How long does it take to get medical records, then? For a patient asking for their own, 30 days under federal law with one extension, and often considerably faster.

For a firm sending an authorization, federal law supplies no answer. State statute may set one if you practice somewhere useful, and beyond that the number comes down to the custodian's queue and how many times you have to ask.

Just the third of those belongs to you. Measuring from the day the request goes out will keep returning the conclusion that custodians are slow. Measuring from the first call instead will show that a meaningful share of the timeline was decided in the four minutes when somebody asked a distressed caller which doctors they had seen.

Frequently asked questions

1. How long does a provider have to respond to my firm's records request?

None, under federal law. That widely quoted deadline attaches to an individual asking for their own chart, and a request your firm sends under a signed authorization falls under a different provision that permits disclosure without setting any timeframe. Your state statute may supply one.

2. Can we get the 30-day clock to apply to us?

Yes, by changing who asks. If the client submits it as their own right of access instead of your office submitting an authorization, the request moves inside the access provision and picks up both the deadline and the capped fee. You lose a step and some control over the wording, which is a fair trade wherever a custodian has already gone quiet.

3. Does any state give my firm a deadline it can enforce?

Two are worth knowing. California entitles an attorney holding a signed authorization to the records inside five days and attaches a cost consequence to missing it, while Texas sets fifteen for hospitals but waits for the fee before counting.

Other states vary, and several write their deadline to run only to the patient, which leaves a firm-submitted request outside it.

4. Why do requests come back rejected?

Usually an identifier that fails to match the chart, a date range the custodian declines to interpret, or a scope the authorization leaves out. All three originate in what the intake call captured, which makes rejection rate an intake metric and not a records one.

5. What does it cost to get a copy?

Far more than firms expect, and with no useful average. In the hospital study above the same 200-page record was quoted at nothing by one custodian and at $541.50 by another. Statutory fee caps are also no help to a firm, because like the deadline they reach an individual's own request and not one your office directs.

6. Should we subpoena instead?

Only once litigation is underway, and it carries notice requirements of its own, so it is no shortcut at the pre-suit stage where most records are gathered. Place it at the top of the ladder above, used after the authorization route has been worked.