How to Get a Loved One's Medical Information Legally
You are the one coordinating care, tracking changes, and attending appointments — but hospitals and physicians often treat your requests for information like a privacy violation. This guide explains exactly what you are entitled to access, how to request it, and what to do when access is denied.
Patients have the right to access their own medical records in both the US and Canada. As a caregiver, your right to access those records depends on whether your loved one has given consent, whether they have lost capacity, and what documentation you have in place. This guide covers every scenario — from routine information requests to emergency situations where no documentation exists.
Your Loved One's Records vs Your Own Access — Understanding the Difference
Before requesting anything, it helps to understand exactly what type of access you are requesting and which legal framework applies to your situation.
| Situation | What you need | Difficulty |
|---|---|---|
| Your loved one has capacity and is present | Their verbal consent at the appointment — or a signed authorization on file | Straightforward |
| Your loved one has capacity but is not present | A signed HIPAA authorization (US) or written consent-to-disclose form (Canada) naming you specifically | Manageable |
| Your loved one has lost capacity — you have legal documentation | Healthcare proxy, durable POA for healthcare, or substitute decision-maker designation — on file with the provider | Requires paperwork |
| Your loved one has lost capacity — no documentation exists | Default substitute decision-maker hierarchy (varies by state/province) — may require court involvement for formal access | Complex — act now |
| Requesting historical records after a loved one has passed | Executor of estate or legal next of kin documentation — process varies by institution | Institution-specific |
What You Are Legally Entitled to — US and Canada
The legal framework differs between the two countries — but in both cases, properly authorized caregivers have meaningful rights to access medical information. Here is exactly what those rights are.
Your rights under HIPAA as a caregiver
The Health Insurance Portability and Accountability Act (HIPAA) is the federal law governing patient privacy in the US. Under HIPAA, patients have the right to access their own records — and can authorize others to access those records on their behalf. As a caregiver with proper authorization, you have the following rights:
- Right to access records: With a signed HIPAA Authorization Form, you can request a complete copy of your loved one's medical records — including clinical notes, test results, imaging, discharge summaries, and medication lists
- 30-day response requirement: Covered entities (hospitals, physicians, insurers) must respond to records requests within 30 days. They may request a 30-day extension but must notify you in writing
- Electronic access: If records are maintained electronically (as most now are), you can request them in electronic format — such as a secure patient portal or a CD/USB drive
- Right to amend: If you believe a record contains an error, you can request an amendment — the provider must respond within 60 days
- Right to an accounting of disclosures: You can request a record of who has received your loved one's health information over the past 6 years
- Fees: Providers may charge a reasonable cost-based fee for copies — but cannot charge for electronic access to records held in a patient portal
HIPAA does not cover all health information in all settings. It applies to "covered entities" — healthcare providers, health plans, and healthcare clearinghouses. It does not apply to life insurance companies, employers, or most schools and school districts. If your loved one's records are held by a non-covered entity, other state laws may apply.
Your rights under Canadian privacy law as a caregiver
In Canada, health information privacy is governed provincially — not federally. Each province has its own health information legislation, but all share common principles under the broader framework of the Personal Information Protection and Electronic Documents Act (PIPEDA) and the Privacy Act. As an authorized caregiver, your rights include:
- Right of access through consent: With a signed consent-to-disclose form from your loved one, you can request access to their health records and receive information directly from their providers
- Right as substitute decision-maker: If your loved one has lost capacity and you are the legally designated substitute, you have the same access rights as the patient themselves
- Response timelines: Most provincial legislation requires providers to respond to records requests within 30 days. Ontario's PHIPA allows up to 30 days; BC's PIPA allows 30 days with a possible 30-day extension
- Right to correct records: You can request corrections to inaccurate or incomplete health information — the provider must respond and note any disagreement in the record
- Fees: Providers may charge reasonable fees for copies of records — but cannot charge for simply viewing records in person in many provinces
In Quebec, access to health records is governed by the LSSSS and the Act respecting Access to documents held by public bodies. With a signed consent from your loved one, you can request their dossier médical from any RAMQ-covered facility. Requests must be made in writing to the medical records department (archives médicales). The facility must respond within 20 days. If access is denied, you can appeal to the Commission d'accès à l'information du Québec (CAI).
How to Request Medical Records — Step by Step
The process is similar in both countries — the forms and timelines differ slightly. Follow these steps for any records request.
Confirm your authorization is in place before making any request
Before contacting any provider to request records, confirm that the appropriate authorization is on file. In the US this means a signed HIPAA Authorization Form. In Canada it means a signed consent-to-disclose form, healthcare proxy designation, or enduring power of attorney. If you do not have authorization in place, the request will be denied regardless of your relationship to the patient.
Contact the medical records department — not the physician directly
Records requests are handled by the medical records or health information management department — not by the physician's office or nursing staff. Call the facility and ask specifically for the medical records or health information department. At smaller practices this may be the front desk, but at hospitals it is a dedicated department.
Submit your request in writing — be specific about what you need
Most facilities require a written records request — either on their own form or in a letter. Be specific: vague requests ("all records") can result in delays or partial responses. List exactly what you need: clinical notes from a specific date range, all imaging and radiology reports, discharge summaries, medication lists, lab results, or specialist consultation reports.
Follow up if you do not receive a response within the legal timeframe
In the US, providers have 30 days to respond under HIPAA (extendable to 60 days with written notice). In Canada, most provinces require a response within 30 days. If you do not receive a response — or receive an unexplained denial — follow up in writing and reference the legal timeline. Keep copies of everything.
If denied — understand the reason and escalate appropriately
A denial must be provided in writing with a specific reason. Not all denials are final — some can be challenged. If your request is denied, request the written reason, consult a patient advocate or lawyer if needed, and escalate to the relevant oversight body. See the denial scenarios below for specific scripts and escalation paths.
What to Do When a Provider Refuses to Release Records
Not every refusal is legally valid. Here are the most common denial scenarios and exactly what to do in each.
This is the most common refusal — and often the result of a staff member who does not know the authorization is on file, or does not understand how the authorization works. Before escalating, confirm your authorization is current and on file with that specific facility.
If the denial persists despite valid HIPAA authorization, file a complaint with the HHS Office for Civil Rights (OCR) at hhs.gov/ocr. HIPAA complaints must be filed within 180 days of the violation. You can also contact your state's health department or a patient advocate.
In Canada, escalate to the provincial Privacy Commissioner or Information and Privacy Commissioner office. In Quebec, file a complaint with the Commission d'accès à l'information (CAI). Most provinces have a patient ombudsman or advocate office that can also assist.
If your loved one has lost capacity and you do not yet have formal substitute decision-maker documentation, this is a genuinely difficult situation. The solution depends on urgency.
For immediate medical decisions in an emergency — identify yourself by relationship (spouse, adult child) and invoke the default substitute decision-maker hierarchy under your state or provincial law. For non-urgent records access without documentation — contact a lawyer immediately about emergency guardianship or powers of attorney.
Some facilities have policies that records must be picked up or sent directly to the patient — not to a third party. This is a facility policy, not a legal requirement, when valid authorization exists. Politely challenge it.
Which Records to Request — and Why Each One Matters
Not all records are equally useful. Here is what each type of record contains and when to request it.
The 6 most important records for caregivers to have on hand
- Discharge summaries — the most comprehensive single document after any hospital stay. Contains diagnosis, procedures performed, medications at discharge, follow-up instructions, and pending results. Request one after every hospitalization.
- Medication reconciliation list — a complete, current list of all medications including dose, frequency, and prescribing physician. Essential for preventing dangerous drug interactions when multiple specialists are involved.
- Most recent specialist consultation notes — what the specialist found, what they recommended, and what follow-up they ordered. Often contains information not communicated to the GP or to you at the appointment.
- Lab and imaging results — blood work, X-rays, MRI and CT reports. Ask for both the raw results and the radiologist's interpretation report. These are useful when getting a second opinion.
- Problem list / active diagnosis list — a summary of all active diagnoses on file. Helps you track what conditions are being managed and by whom.
- Advanced directives / care plan — any documented wishes about treatment preferences, resuscitation, and end-of-life care. Essential to have on hand and to ensure all treating physicians have a copy.
✓ Medical information access checklist — do these now
The Caregiver Handbook
This guide covers medical information access — the full Handbook covers every stage of caregiving: hospital stays, home care, legal rights, government benefits, and burnout prevention. For patients and caregivers in the US and Canada.
Get the handbook — $27 →Instant PDF download · 60-day money-back guarantee
Free Caregiver Starter Kit
Get the caregiver hospital visit checklist, the first-30-days action plan, a medication tracker template, and the federal benefit eligibility summary — free, by email.
- Hospital visit checklist — what to bring, ask, and document
- First-30-days caregiver action plan
- Medication and appointment tracker
- Federal caregiver benefit eligibility summary
No spam. Free kit. Unsubscribe anytime.