The previous chapter walked through the process. This chapter gives you the letters.
Each of the six templates below is a complete, ready-to-use request. The federal law (HIPAA's Right of Access at 45 CFR § 164.524 and the 21st Century Cures Act at 45 CFR Part 171) is cited inside the letter itself. The format you can request, the 30-day deadline, the limits on what providers can charge — all spelled out. The only thing you need to add is your information.
You can download each template individually in either Microsoft Word or PDF, or grab the full bundle above. The Word version is easiest if you want to type your information directly into the document. The PDF version is easiest if you want to print it and fill in by hand.
The templates are written for the most common cases. If your situation is unusual — a closed practice, a deceased provider, records from another country, military or VA records — Chapter 6 will cover the special-case adjustments. For now, pick the template that matches your situation, fill it in, and send it.
01
TEMPLATE 01
Doctor / Clinic / Specialist
WHEN TO USE
Requesting your complete records from any individual doctor, clinic, or specialist's office where you've been seen. This is the most common request — the one to start with for your primary care doctor or any specialist whose records you need.
PREVIEW
[Your Full Legal Name]
[Your Street Address]
[City, State ZIP]
[Phone] · [Email]
[Today's Date]
[Doctor or Clinic Name]
Attn: Medical Records Coordinator / HIPAA Privacy Officer
[Clinic Address]
[City, State ZIP]
Re: Request for Access to Protected Health Information
Patient: [Your Full Legal Name]
Date of Birth: [Your DOB]
To Whom It May Concern,
Pursuant to my right of access under HIPAA (45 CFR § 164.524) and the 21st Century Cures Act information blocking rule (45 CFR Part 171), I am requesting a complete copy of all my Protected Health Information (PHI) maintained by your practice, including but not limited to:
• All clinical notes, progress notes, and consultation notes
• All laboratory results and pathology reports
• All imaging studies and radiology reports (reports AND image files in DICOM format)
• All medication and prescription records
• All referral letters and correspondence with other providers
• All billing and claims records
• All electronic health information (EHI) as defined under the Cures Act
Please provide these records in electronic format (PDF or via secure patient portal). I understand the following:
• Records must be provided within 30 days of this request (45 CFR § 164.524(b)(2)), and my state may require a shorter timeframe.
• You may charge only a reasonable, cost-based fee per HHS guidance. You may not charge for retrieval time or standard search. Records delivered through the View, Download, and Transmit function of a Certified EHR must be provided at no cost.
• Under the Cures Act, you may not deny, delay, or materially interfere with my access to EHI.
[Letter continues — download the full file above.]
Sincerely,
_______________________________
[Your Signature]
[Your Printed Name]
[Date]
02
TEMPLATE 02
Hospital (Full Record Set)
WHEN TO USE
Requesting records from a hospital. Hospital records are held by the Health Information Management (HIM) Department and span multiple categories — inpatient admissions, emergency department visits, imaging, lab work, billing. This template lists every category by name so nothing gets left out.
PREVIEW
[Your Full Legal Name]
[Your Address]
[Phone] · [Email]
[Today's Date]
[Hospital Name]
Health Information Management Department
[Hospital Address]
Re: Request for Complete Hospital Record Set
Patient: [Your Full Legal Name]
Date of Birth: [Your DOB]
Medical Record Number (if known): [MRN]
Dates of Service: [date range or "all encounters"]
Under my right of access in HIPAA (45 CFR § 164.524) and the 21st Century Cures Act (45 CFR Part 171), I am requesting a complete copy of all my Protected Health Information held by [Hospital Name], including all departments and care settings.
Please include, at minimum, the following categories. I am requesting ALL of the following, not a summary of any of them:
INPATIENT / ADMISSION RECORDS
• All admission notes, history & physicals (H&P)
• All daily progress notes and consultation notes
• All discharge summaries
• All operative reports and procedure notes
• All nursing notes and care plans
EMERGENCY DEPARTMENT RECORDS
• All ED physician notes and triage notes
• All ED orders and results
• All discharge instructions
DIAGNOSTIC RECORDS
• All laboratory results (with actual values, not summaries)
• All pathology reports
• All imaging reports AND the imaging studies in DICOM format
[Letter continues with medication, billing, and behavioral health sections — download the full file above.]
03
TEMPLATE 03
Insurance Company / Health Plan
WHEN TO USE
Requesting your records from an insurance company or health plan. Insurance claims data often provides the most complete reconstruction of where you've received care over time — even when you can no longer remember every provider's name.
PREVIEW
[Your Full Legal Name]
[Your Address] · [Phone] · [Email]
[Today's Date]
[Insurance Company Name]
Attn: Member Records / HIPAA Privacy Officer
Re: Request for Complete Member Records and Claims Data
Member: [Your Full Legal Name]
Date of Birth: [Your DOB]
Member ID Number: [your member/policy number]
Under my right of access in HIPAA (45 CFR § 164.524), which applies to health plans as well as healthcare providers, I am requesting a complete copy of all Protected Health Information your organization maintains about me, including:
• All claims data (paid, denied, pending) with dates of service, provider names, CPT/HCPCS codes, ICD diagnosis codes, and amounts paid
• All prior authorization requests and decisions
• All correspondence with me and with providers
• All explanations of benefits (EOBs)
• All medical review notes and determinations
• All appeals and grievance records
• Any case management or care coordination records
• All eligibility and enrollment records
[Letter continues — download the full file above.]
04
TEMPLATE 04
Pharmacy (Medication Fill History)
WHEN TO USE
Requesting your complete medication fill history. Pharmacy records are usually the most accurate record of what medications you have actually taken — more complete than what's in any single doctor's office. Especially useful if you've used the same pharmacy chain across multiple locations.
PREVIEW
[Your Full Legal Name]
[Your Address] · [Phone] · [Email]
[Today's Date]
[Pharmacy Name and Chain]
Attn: Pharmacy Manager / HIPAA Privacy Officer
Re: Request for Complete Prescription Fill History
Patient: [Your Full Legal Name]
Date of Birth: [Your DOB]
Under my right of access in HIPAA (45 CFR § 164.524), I am requesting a complete copy of my prescription fill history from your pharmacy, including:
• All prescriptions filled, with dates, drug names, strengths, dosage forms, quantities, days' supply, and prescribers
• All refill records
• All immunizations administered at the pharmacy
• All medication therapy management (MTM) records
• All counseling notes and pharmacist consultations
• All insurance claims submitted on my behalf
If your records system can produce a printout covering ALL of my fills from your chain (not just this single location), please do so.
[Letter continues — download the full file above.]
05
TEMPLATE 05
Personal Representative (Family Member)
WHEN TO USE
Requesting records on behalf of a family member. A parent for a minor child. An adult child for an aging parent (with written authorization). A spouse for a spouse. A court-appointed guardian. An executor for a deceased family member's estate. HIPAA gives "personal representatives" the same access rights as the patient.
You will need proof of your authority — birth certificate, healthcare power of attorney, court order, letters testamentary, or a signed HIPAA authorization. The template has check-boxes to indicate which.
PREVIEW
You will need proof of your authority — birth certificate, healthcare power of attorney, court order, letters testamentary, or a signed HIPAA authorization. The template has check-boxes to indicate which.
[Your Full Legal Name (Personal Representative)]
[Your Address] · [Phone] · [Email]
[Today's Date]
[Provider, Hospital, Insurer, or Pharmacy Name]
Attn: Medical Records / HIPAA Privacy Officer
Re: Personal Representative Request for Access to Protected Health Information
Patient: [Patient's Full Legal Name]
Patient's Date of Birth: [Patient's DOB]
Personal Representative: [Your Full Legal Name]
Relationship to Patient: [parent / spouse / adult child / guardian / executor]
I am the legally authorized personal representative of [Patient's Full Legal Name], and I am requesting access to the patient's Protected Health Information (PHI) under my right of access in HIPAA (45 CFR § 164.502(g) and 45 CFR § 164.524) and the 21st Century Cures Act (45 CFR Part 171).
Attached to this request is documentation establishing my authority as personal representative:
☐ Birth certificate (parent of minor)
☐ Healthcare power of attorney
☐ Court-appointed guardianship order
☐ Letters testamentary (executor of estate)
☐ HIPAA authorization signed by patient
☐ Other: [describe]
[Letter continues — download the full file above.]
06
TEMPLATE 06
Follow-Up (Deadline Missed)
WHEN TO USE
When more than 30 days have passed since your original request and you haven't received your records — or you got only partial records, or you were quoted unreasonable fees, or you were denied without a written explanation.
This letter alone often resolves the issue. Most provider compliance offices know what comes next (an OCR complaint and possible six-figure penalty), and they fix the problem to avoid it.
PREVIEW
This letter alone often resolves the issue. Most provider compliance offices know what comes next (an OCR complaint and possible six-figure penalty), and they fix the problem to avoid it.
[Your Full Legal Name]
[Your Address] · [Phone] · [Email]
[Today's Date]
[Provider, Hospital, Insurer, or Pharmacy Name]
Attn: HIPAA Privacy Officer / Compliance Officer
Re: SECOND NOTICE — Failure to Respond to Access Request
Original Request Date: [date you sent the first letter]
Patient: [Your Full Legal Name]
Date of Birth: [Your DOB]
On [original request date], I submitted a written request for access to my Protected Health Information under HIPAA's Right of Access (45 CFR § 164.524) and the 21st Century Cures Act (45 CFR Part 171). A copy of that original request is attached.
As of today's date, [today's date], more than 30 days have passed and:
☐ I have received no response at all.
☐ I have received only partial records.
☐ I have been quoted unreasonable fees that violate HHS guidance.
☐ I have been required to use a process that creates unreasonable barriers to my access.
☐ I have been denied access without a written explanation citing a specific HIPAA exception.
This response is not compliant with federal law. OCR has announced 54 enforcement actions under its Right of Access Initiative since 2019, with penalties from $16,500 to over $200,000.
I am giving you 14 days from the date of this letter to comply, or I will file complaints with the HHS Office for Civil Rights, the HHS Office of the National Coordinator, and my state attorney general.
[Letter continues with full complaint URLs and timeline — download the full file above.]
A few notes on using these
The templates are written in formal language because that's what the federal regulations use. Don't worry — you don't need to sound like a lawyer when you sign one. Just fill in the bracketed fields, sign at the bottom, attach a photocopy of your ID, and send it. The legal heavy lifting is already done.
Always keep a copy of every letter you send. Email is easiest because the email itself is the record. If you mail, send certified with return receipt. If you hand-deliver, ask for a stamped copy back. Whatever channel you use, the goal is the same: a paper trail with a date on it, so you can prove when the 30-day clock started.
If you need to send a template to multiple providers at once — common when reconstructing a long medical history — the cleanest way is to download the Word file, fill in your information once, then save a copy for each provider with their specific information filled in.
The next chapter is about what to do when a provider pushes back: ignores the deadline, quotes you fees they're not allowed to charge, or denies your request without a valid reason. The federal complaint process works. People win these complaints. The templates above plus the escalation steps in Chapter 5 are how every successful records request happens.
You don't have to be a lawyer to use the law. The law was written for you.