Special Cases

Federal law on patient access doesn't go away just because a situation is unusual. If anything, the unusual cases are where having a plan matters most, because the obvious door — call the doctor's office — isn't always there. What this chapter gives you is the alternative door for each of the most common unusual situations.

Case 01The practice has closed

Doctors close practices for many reasons — retirement, sale, relocation, financial trouble. Your records do not disappear when the doors close. Federal and state law require that medical records be retained, typically for at least six years from the last date of treatment, and often longer for minors.

The American Medical Association recommends that practices closing in an orderly way notify patients at least 60 days in advance, post a notice at the office listing where records have been transferred, and provide a forwarding address. Many practices do this. Some don't.

If your practice closed:

1. Check the old office location. If the building still exists, the door or window often has a notice listing the records custodian — usually another physician, a successor practice, or a records storage company.
2. Search the state medical board. Every state board maintains current contact information for licensed physicians. If your doctor is still in practice elsewhere, the board can confirm where. If they retired, the board often has the custodian on file.
3. Try the local medical society. County medical societies sometimes know where retired colleagues' records went.
4. Check with primary care. If you have a current doctor, ask whether records were ever forwarded to them for continuity of care. This happens more often than people realize.
5. Records storage companies. Many closed practices use companies like Iron Mountain, ChartRequest, or local equivalents. If the state board points you to one, contact them directly with the original physician's name and your treatment dates.

When you find them: the request itself uses the same federal law as before. Send Template 1 or 2 (whichever fits) from Chapter 4, addressed to the new custodian. Your HIPAA right of access transfers with the records.

Case 02The doctor has passed away

When a physician dies, their records become the responsibility of someone else. The question is who.

If another physician purchased or took over the practice before the doctor's death, that successor inherits the records along with the practice. The state medical board will know if this happened.

If no one took over, the records become part of the doctor's estate. To track them down:

1. Search the local probate court in the county where the doctor practiced. The court can identify the executor of the estate.
2. Contact the executor directly. The executor has legal authority over the records and is responsible for either continuing storage during the required retention period or arranging a custodian.
3. Look at the obituary. Obituaries often list surviving family — sometimes a spouse or adult child who knows where the records ended up.
4. State medical board. The board's records will show the doctor's last reported county of practice, which narrows the probate court search.

Be aware of timing. The longer it has been since the doctor's death, the harder this becomes. Estates eventually close. Records eventually exceed the retention period and may be destroyed. If you suspect a former physician has passed away, the time to track down the records is now, not later.

Case 03The records are in another state

This case is simpler than it looks. Federal law applies nationwide. HIPAA's Right of Access and the 21st Century Cures Act don't change based on which state you live in or which state the provider is in. Records held in Texas about care you received in California are still yours. Records held by a New York hospital about a visit during a vacation are still yours.

The request itself is identical. Use the templates from Chapter 4 and send them to the out-of-state provider. The 30-day federal deadline applies. The fee rules apply. The complaint paths in Chapter 5 apply.

The one thing to keep in mind: when the provider's state has a stronger access law than HIPAA — California's 15-day rule, New York's 10-day rule, Texas's 15-business-day rule — that stronger law applies, because the provider is bound by the laws of their own state. You don't have to know the citation. You just have to know that the deadline may be shorter than 30 days.

Case 04VA and military records

Records from the Department of Veterans Affairs and from military service are handled separately from civilian records, but the rules are clear and the records are free for veterans, next-of-kin, and authorized representatives in nearly all cases.

If you served before electronic records existed (mostly pre-1990s for most branches): expect longer wait times. The National Personnel Records Center has been working through a multi-year backlog. If the records you need are urgent — for medical treatment, a benefits claim, or a funeral — say so in your request. Urgent requests are flagged for expedited processing.

Case 05Requesting on behalf of a family member

Chapter 4's Template 5 covers the formal letter. This case covers the rules behind it.

HIPAA recognizes a category called the personal representative (45 CFR § 164.502(g)) — a person who has the legal authority to make healthcare decisions for someone else. A personal representative has the same access rights as the patient.

The most common situations:

Parents and minor children. Generally, a parent is the personal representative of their minor child and can access the child's records. There are state-specific exceptions where minors can consent to certain types of care on their own — typically mental health treatment, reproductive health services, and substance abuse treatment — and the records of that care may be protected from parental access. The age of consent for these exceptions varies by state. If you're a parent requesting your child's records and you encounter resistance, ask which specific records are being withheld and why.

Spouses, adult children of aging parents, and other family members. Family relationship alone does not create personal representative status under HIPAA. You need documented legal authority — a healthcare power of attorney, court-appointed guardianship, or a HIPAA authorization signed by the patient. Without one of these, you cannot access an adult family member's records, even if you live with them and care for them every day. This is one of the most common HIPAA frustrations, and the fix is straightforward: if you may need to act on behalf of an aging parent or spouse, get the healthcare power of attorney signed now, while they're able to sign it.

Deceased family members. When a patient dies, their HIPAA rights pass to the executor or administrator of the estate. To request records of a deceased family member, you need documentation showing your authority — most commonly "letters testamentary" or "letters of administration" issued by the probate court. State law may also recognize certain next-of-kin relationships for limited purposes.

Case 06Psychotherapy notes

HIPAA's Privacy Rule creates a special category called psychotherapy notes — the private notes a mental health professional takes during or right after a therapy session, kept separate from the rest of the medical record.

These notes have stronger protections than other records. They generally require a separate written authorization for release, even to the patient themselves, and even with a standard HIPAA Right of Access request. This is by design: the regulation is trying to protect the candor of the therapy itself, which depends on the therapist being able to write private observations that won't routinely be shared.

If you are specifically interested in the psychotherapist's private notes, you'll need to make a separate written request and the therapist must sign off. Many therapists will share notes with patients on request even though they're not required to. Some won't. If you suspect notes are being withheld and your goal is to understand or contest treatment decisions, the rest of the chart — diagnoses, treatment plans, medications, billing — typically contains everything needed.

Case 07Records from outside the United States

HIPAA does not apply outside the United States. Records of care you received in another country are governed by that country's privacy laws.

In practice, this means: write to the foreign provider in the most direct way possible, attach a copy of your government identification, and request the records you need. Most developed countries have patient-access laws of their own, often similar to HIPAA in spirit. The European Union's General Data Protection Regulation, for example, gives patients in the EU broad rights to access their personal data, including health records.

If you need certified translations of foreign records for use in the United States, that's a separate step — typically handled by a licensed translation service after the records arrive.

The principle that holds across all of it

Every special case in this chapter rests on the same foundation as the standard cases. The records are about you. The information is yours. Custodians of that information — whether they're a current doctor, a closed practice's records storage company, a deceased physician's estate, the National Archives, or a hospital across state lines — are obligated to make it accessible to you when you have the right to access it.

The next chapter is the last in this guide. It's the reference chapter — every portal URL, every form number, every phone number, every glossary term that appeared anywhere in the previous six chapters. Bookmark it.