You have a legal right to your medical records, including from a telehealth provider. Exercising it is straightforward in principle and frequently annoying in practice. Here is how to make the request in a way that gets answered.
Key Takeaways
- Under HIPAA, patients have a right of access to their records held by covered entities.
- Providers must generally respond within 30 days, with one 30-day extension permitted.
- Requesting an electronic copy is usually faster and cheaper than paper.
- Ask for specific record types by name rather than making a general request.
- Download what you need before cancelling — access after account closure is harder.
What you are entitled to
The HIPAA right of access allows individuals to obtain a copy of the protected health information held in a designated record set by a covered entity. In practice this covers clinical notes, test results, prescription records, diagnoses and billing records.
Covered entities must act on a request within 30 days, with a single 30-day extension permitted if they notify you of the reason. Fees, where charged, are limited to reasonable cost-based amounts — a provider cannot charge a punitive fee for records access.
| Record type | Why you want it | What to ask for by name |
|---|---|---|
| Clinical notes | The reasoning behind decisions made about your care | Visit notes / encounter notes / progress notes |
| Prescription history | Complete medication list with dates and doses | Medication history / prescription records |
| Lab results | Baseline and trend for the next clinician | Laboratory results, including original reports |
| Intake questionnaire | What you originally reported | Intake forms / patient-completed questionnaires |
| Billing records | Disputes, and evidence of what you paid for | Billing and payment history |
| Messages | Clinical instructions given by message | Secure message history |
How to make a request that gets answered
- Find the right channel. Look for a privacy officer contact, a records request form, or a designated email address. General support queues route poorly for this.
- Put it in writing. Written requests create a timestamp and a record. Verbal requests do not.
- Name the specific records from the table above rather than asking for "my records."
- Specify electronic format. Faster, usually free or cheaper, and easier to forward to your next provider.
- Give a delivery method — a secure download, or direct transmission to the new provider.
- Note the 30-day timeline in your request. It signals that you know the requirement.
RxSpan MD
Multi-condition portal- One login covering several treatment categories
- Reduces the number of separate portals you have to manage
- Track-specific pricing surfaces at intake
Compounded medications are not FDA-approved. The FDA does not review compounded drugs for safety, effectiveness, or quality before they are marketed. Compounded GLP-1 medications are prepared by state-licensed pharmacies and are not the same as FDA-approved brand products.
Sesame Care
Pay-per-visit marketplace- You see the price before you book — no insurance claim, no surprise bill
- Brand-name FDA-approved prescriptions only on the weight-management side
- Useful for one-off visits rather than ongoing subscriptions
Download before you cancel
This is the practical lesson worth internalizing. Once an account is closed, portal access typically goes with it. The records still exist and you retain the right to request them, but the easy self-service route is gone and you are now in the formal request process.
Before cancelling any telehealth service, spend ten minutes downloading your visit summaries, lab results, prescription history and any message threads containing clinical instructions. It is far easier than the alternative.
Found Health
Weight management + coaching- Coaching bundled with the medication track
- Billed in 4-week cycles — 13 per year
Compounded medications are not FDA-approved. The FDA does not review compounded drugs for safety, effectiveness, or quality before they are marketed. Compounded GLP-1 medications are prepared by state-licensed pharmacies and are not the same as FDA-approved brand products.
Feel30 TRT
Testosterone therapy- Lab work built into the intake pathway
- Ongoing monitoring cadence rather than a one-off prescription
TRT requires baseline and follow-up labs. Any provider that offers to prescribe without them is a provider to walk away from.
Compounded medications are not FDA-approved. The FDA does not review compounded drugs for safety, effectiveness, or quality before they are marketed. Compounded GLP-1 medications are prepared by state-licensed pharmacies and are not the same as FDA-approved brand products.
When the request goes nowhere
- Follow up in writing at the 30-day mark, referencing your original dated request.
- Escalate to the privacy officer explicitly. Covered entities are required to designate one.
- File a complaint with the HHS Office for Civil Rights, which enforces the HIPAA right of access and has an online complaint process.
- Contact your state medical board if a licensed clinician is failing to provide records.
Most requests resolve well before step three. The requests that stall tend to stall because they went into a general support queue rather than to someone whose job includes handling them.
Frequently Asked Questions
Do telehealth providers have to give me my records?
Covered entities under HIPAA must provide access to protected health information in a designated record set on request, generally within 30 days.
Can they charge me?
Fees are limited to reasonable cost-based amounts. Electronic copies are typically free or minimal, and a provider cannot charge an unreasonable fee to discourage access.
How long do they keep records after I cancel?
Retention requirements vary by state and record type. Records generally persist well past account closure, but self-service access usually does not.
Can records be sent directly to a new provider?
Yes. You can direct that a copy be transmitted to another person or entity you designate, which is often the fastest route.