How do I get my medical records?

Under HIPAA, you have a right to your records within 30 days of a written request. Most providers will respond to a signed authorization. Request the complete record — physician notes, nursing notes, imaging, lab results, medication records, and the audit trail showing who accessed the chart and when. The audit trail is often overlooked but valuable evidence.

Should I confront the provider directly?

Usually no, beyond a brief request for records. Providers are trained to document interactions defensively. Recorded statements to the provider's risk-management team can be used against you. Get records first, then have a med-mal lawyer review before any substantive communication.

What if the provider apologized?

About 35 states have apology statutes that exclude or limit the use of provider apologies as evidence of liability. Even where the apology cannot come into evidence, the underlying admission of fact often can. Write down what was said as soon as possible after it happens.

Guide

What to do if you suspect medical malpractice.

Med-mal cases live or die on records. Here is how to get them, what to preserve, and who to involve — without tipping off the provider's risk-management team prematurely.

Get your records first

Under HIPAA, you have a right to a copy of your records within 30 days of a written request (45 C.F.R. § 164.524). Request everything: physician progress notes, nursing notes, imaging studies on disc (not just reports), pathology slides if cancer-related, medication administration record (MAR), and the EHR audit trail. The audit trail shows who accessed the chart and when — often revealing late edits or after-the-fact additions.

Document contemporaneously

Symptoms by date and time.
Every conversation with providers — who said what, when.
Family members who witnessed conversations or care.
Photos of visible injuries (surgical sites, bedsores, IV infiltrates).
Receipts for out-of-pocket expenses and mileage to follow-up appointments.

Get a second opinion

Before consulting a lawyer, get a fresh treating-physician evaluation from an unrelated provider. The second-opinion note is medical evidence; it has independent value beyond what an expert later opines. Do not tell the second-opinion provider you are considering litigation; you want their clinical assessment, not their cautious-of-suit version.

Consult a med-mal lawyer before risk management

Hospital risk-management teams contact patients early to gather information that is admissible against them later. Decline recorded statements. Direct all communication to your lawyer once retained. Most med-mal lawyers screen cases on contingency at no upfront cost.

Mind the deadlines

The statute of limitations can be as short as 1 year (Louisiana, Kentucky). The statute of repose can bar claims even within the limitations window. See the dedicated med-mal statute of limitations guide for your state.

What not to do

Do not give a recorded statement to risk management.
Do not sign a release or write off a bill.
Do not post about the care on social media.
Do not assume an apology means you have a case — or that no apology means you don't.

Check your claim

Free, confidential, no obligation.

Start case review

Frequently asked questions

Sources

[1]HIPAA Privacy Rule — Right of Access to Medical Records — U.S. Department of Health and Human Services
[2]Apology Statutes — state survey — National Conference of State Legislatures
[3]Patient Safety and Quality Improvement — Agency for Healthcare Research and Quality