BLOCKED
What to Do If Your Doctor or Insurer Blocks Your Records
Information blocking is illegal. Full stop.
4 min read
·
May 7, 2026
If a provider, hospital, or insurer refuses to give you your medical records (or charges you for them, or delays beyond the legal window), that's a federal violation. Here's what you're up against and how to handle it.
What blocking looks like
Some doctors will tell you that you don't need your old records. Some will say their system can't accept external files. Some will charge a retrieval fee. None of that is legal. The 21st Century Cures Act and the HIPAA Privacy Rule are crystal clear: you own your records, you get them electronically, and it's free.
Step 1: Document everything
When someone blocks you, write it down. Date, who you talked to, what they said, what you asked for. Save voicemails. Keep emails. This documentation is what you'll attach to your federal complaint.
Step 2: Escalate inside the organization
Ask to speak with the medical records supervisor or compliance officer. Be direct: "Federal law requires you to provide my records within thirty days at no charge. I need that confirmed in writing." Most places will comply once they realize you know the law.
Step 3: File with ONC
If they still refuse, file a complaint with the Office of the National Coordinator for Health IT. They investigate information blocking violations. Penalties are real: financial fines and loss of certain certifications.
File a complaint at healthit.gov/topic/information-blocking.
Step 4: For insurer blocking, file with HHS Office for Civil Rights
If your insurer is the one blocking access, file a HIPAA complaint with the HHS Office for Civil Rights. Insurers have specific deadlines under HIPAA and the Patient Access API rules. Missing them is a federal violation.
File a HIPAA complaint at hhs.gov/hipaa/filing-a-complaint.
Step 5: Loop in state authorities
Contact your state's health department, medical board, and insurance commissioner. They have enforcement authority too, and parallel pressure speeds things up.
You have leverage
Providers and insurers know the penalties are real. Most will comply once you reference the law by name. You're not being difficult. You're enforcing your rights.
FREQUENTLY ASKED QUESTIONS
Common questions
What counts as information blocking?
Under 45 CFR Part 171, information blocking includes any practice by a healthcare provider, EHR vendor, or health information exchange that interferes with, prevents, or materially discourages access to, exchange, or use of electronic health information. Common examples: refusing to release records, charging unreasonable fees, requiring you to come in person to sign a form, releasing only summaries when full records were requested, or delaying without a valid reason.
Where do I file a HIPAA complaint?
File with the HHS Office for Civil Rights (OCR) at hhs.gov/ocr/complaints. OCR is the federal agency that enforces HIPAA's right of access. Provide the provider name, dates of your records request, how the provider responded, copies of correspondence, and any fees they charged. OCR investigates and may impose corrective action plans or civil monetary penalties.
Where do I file a Cures Act information blocking complaint?
File with the HHS Office of the National Coordinator for Health IT (ONC) at healthit.gov/feedback. ONC investigates information blocking complaints and refers credible violations to the HHS Office of Inspector General (OIG) for enforcement. OIG can impose civil monetary penalties up to $1 million per violation against EHR vendors and health information exchanges.
How long does an OCR or ONC complaint take?
OCR complaints are typically acknowledged within a few weeks; full investigations can take months. Many right-of-access cases close in 60 to 90 days with the provider releasing the records under threat of penalty. Cures Act complaints to ONC may take longer because the enforcement framework is newer.
Has OCR actually fined providers for refusing to release records?
Yes, dozens of times. OCR's Right of Access Initiative has produced enforcement actions ranging from $3,500 to over $4.3 million in single cases. Providers fined for right-of-access violations include both small practices and large health systems.
What if my state has stricter record laws than HIPAA?
The stricter law applies. HIPAA is a federal floor; state laws can provide more rights. Some states have shorter response deadlines, lower fee caps, or broader access rights than HIPAA. If your state has stronger protections, you can use them in addition to HIPAA. State health departments and medical boards can also enforce.
What evidence should I keep when records are blocked?
Copies of every written request you sent (date-stamped), every reply you received, any fees they charged, the names and titles of people you spoke with, dates of phone calls and what was said, and any company policy documents they cited. This documentation is essential if you file a complaint.
Can I sue the provider directly?
HIPAA does not provide a private right of action (you cannot sue under HIPAA itself). However, some states have private rights of action for medical records violations under state law. Plaintiffs have also pursued breach of contract, negligence, or state consumer protection claims. Consult an attorney; legal aid organizations and your state medical board can also help.
