How to get your medical records and scan images

What you can ask for

Most people only try to get their records when they need them for something: a second opinion, a new specialist, an insurance claim, a move to another country. Then they discover nobody explained the process.

The good news is that the right is not a favour. It is written into law, with deadlines and limits on what you can be charged.

In the United States, the HIPAA right of access (45 CFR 164.524) covers the health information a provider holds about you in what the rules call the designated record set — in practice, your medical record.

That includes X-rays and other diagnostic images. This is the part people most often assume they cannot have. You can. Radiology images are part of the record, not a separate favour the imaging department grants.

You can also ask for the form and format you want, and the provider has to honour it if they can readily produce it that way. The one practical caveat the rules acknowledge: imaging files are big, so the delivery mechanism — a disc, a portal download, a drive you supply — is something you agree with them.

How to ask

Ask the provider that holds the records. For imaging, that is the hospital or centre that did the scan, not the doctor who ordered it.

Be specific, because "send me my records" invites a partial answer:

1. Say what you want. Reports, images, lab results, discharge papers — name them, with dates or a date range.
2. Say what format. For imaging, ask for the DICOM files, not printed pictures. DICOM is the original data; anything else is a flattened copy that a doctor cannot work with properly.
3. Say how you want to receive it. Portal download, disc, or a USB drive you provide.
4. Put it in writing and keep a copy with the date. It starts the clock and it is what you will need if the deadline passes.

Many hospitals have their own request form. Use it if it exists — it goes to the right desk.

How long it takes

Under HIPAA, a provider must act on your request within 30 calendar days. They can take one extension of up to 30 more days, and only if they give you a written statement of the reason for the delay.

That is the legal ceiling, not the normal wait. Records often arrive faster, and a portal download can be immediate.

What it can cost

This is where most confusion lives, so it is worth being precise.

A provider may charge a reasonable, cost-based fee. What that fee can include is limited:

• Labour for copying — but only the work of making and delivering the copy, once the information has already been found and collected.
• Supplies (a disc, a drive) and postage, if you asked for those.

What it cannot include: the cost of searching for your records, retrieving them, or reviewing the request. That work is not billable to you.

You may have seen a figure of $6.50 quoted as the maximum. That is a misreading, and HHS has published a clarification about it. The flat $6.50 is an option a provider can choose instead of calculating actual costs for electronic copies of electronic records. It is not a cap on every request.

If they refuse or go quiet

If a provider denies access or the deadline passes with nothing:

1. Ask in writing for the reason. There are narrow legal grounds for denial, and the provider has to tell you which applies.
2. Escalate inside the organisation. Ask for the privacy officer or the health information management department by name.
3. File a complaint with the HHS Office for Civil Rights, which enforces the right of access. It is free and you do not need a lawyer.

If you are in the UK

The framework is different but the right is comparable. Under the Data Protection Act 2018 and UK GDPR you make a subject access request to whoever holds the records — your GP practice, the hospital trust, a private provider.

• The deadline is one calendar month, extendable by up to two further months if the request is complex or you have made several.
• There is no charge, except where a request is manifestly unfounded, excessive or repetitive.
• Complaints go to the Information Commissioner's Office.

What arrives, and what to do with it

Expect one of three things: a portal download, a disc, or paper. Reports come as PDFs or printouts. Images come as DICOM files — hundreds of them, often with no file extension, usually with a viewer program that does not work.

Two things worth doing the day it arrives:

• Copy it somewhere safe. Discs scratch and portals expire. The DICOM folder is the original and it is what any doctor will ask for.
• Check it opens. If the bundled viewer will not start, that is the software failing, not your images: the hospital gave you a CD and it will not open covers what to do.

Before you forward anything to a doctor elsewhere, an insurer or a forum, remember that DICOM files carry your name, date of birth and patient ID inside them. The metadata viewer shows exactly what yours say, and the anonymiser strips it.