Your medical file belongs to you in every meaningful legal sense — providers just hold onto the physical or digital copy.
No, not really — your access to your own medical records is protected by law on both sides of the Atlantic. In the US, HIPAA's Right of Access requires providers to give you copies within 30 days of your request, generally for a reasonable, cost-based fee that can't include a profit margin or a flat "retrieval" charge. In the UK, requesting your health records is a Subject Access Request under GDPR, and it has to be fulfilled within one month — almost always free of charge. Providers can push back on the format, the scope, or ask you to verify your identity, but an outright refusal to provide the records at all isn't something either system allows for.
The mechanics differ, but the underlying principle is identical: the information in your file is fundamentally yours, and the provider's role is closer to custodian than owner.
| United States | United Kingdom | |
|---|---|---|
| Legal basis | HIPAA Privacy Rule — the "Right of Access" | UK GDPR and the Data Protection Act 2018 — a Subject Access Request (SAR) |
| Response deadline | 30 calendar days from the request | One calendar month, extendable by up to two further months for complex or high-volume requests, with the patient notified within the first month if so |
| Cost | A reasonable, cost-based fee covering labor, supplies, and postage — no profit margin or flat retrieval fee allowed; many states cap this even lower | Free in almost all cases; a reasonable fee only applies if the request is manifestly unfounded, excessive, or repetitive |
| What's covered | Medical and billing records, test results, imaging, clinical notes in the "designated record set" — psychotherapy notes and litigation materials are excluded | The full health record held by that specific practice — GP, hospital, dentist, and optician records are typically held separately, so multiple requests may be needed |
| Do you need a reason? | No — the right applies regardless of why you're requesting the records | No — you're not required to explain why you want to see your records |
One practical detail worth knowing in the UK: because GP, hospital, dental, and optician records are usually kept as separate systems, a single request to your GP surgery won't automatically pull your hospital records too — you may need to submit a SAR to each provider you've seen.
Outright refusal is rare and clearly against the rules on both sides — what happens far more often is delay, an inflated fee, or records being handed over incomplete.
If 30 days (US) or a month (UK) pass with no records and no explanation, that's already a violation worth escalating, not something to keep waiting on politely.
A US provider quoting a flat $50-100 "records fee" regardless of how many pages are involved is a common overreach — the fee is supposed to be tied to the actual, reasonable cost of copying and providing the records, not a deterrent.
If what you receive looks incomplete compared to what you know exists — a test result you remember, a specialist referral — ask specifically for the missing item by name and date, rather than assuming it doesn't exist.
A written request creates a clear paper trail and starts the legal clock. In the US:
"I'm requesting a copy of my complete medical record under my HIPAA Right of Access, including [specific items if known — test results, imaging, clinical notes] from [date range]. Please confirm the fee before processing, and provide the records within the 30-day window required by law."
In the UK:
"I'm submitting a Subject Access Request under UK GDPR for a copy of my complete health record held by this practice, covering [date range]. I understand this should be provided within one month at no charge."
Use Kibbo's Healthcare & Medical tools to put your request in writing, citing the exact right and deadline your provider is required to follow.
Explore Healthcare & Medical tools →