What a hospital actually asks for
Emergency departments ask a short and predictable set of questions, and they ask them of whoever is standing there. What is he taking. What is she allergic to. Has he had surgery. Who is her cardiologist. Does he have a directive. The answers are not hard to assemble; they are hard to assemble at speed, from memory, at night.
So the work is not building a medical archive. It is holding a small amount of information in a form that arrives when your parent does. Everything else — the imaging, the discharge summaries, the specialist letters — can be requested later, and this page explains how.
The single highest-value item is the medication list, and the reason is that it is the only one nobody else has. A hospital can look up a diagnosis in its own system. It cannot know what a different doctor prescribed last month, or what your parent quietly stopped taking.
The records are a right, not a favor
Families ask for records politely and get treated as a nuisance, because nothing at the desk says there is a rule. There is. The federal privacy rule that people know as the thing stopping them being told anything is also the thing that entitles them to the file.Source 3
The right belongs to the patient. It reaches you when you hold authority to make health care decisions for them: a covered entity must treat a personal representative as the individual, and who qualifies is decided by state law rather than by the regulation, which in practice means the health care power of attorney or health care proxy your parent signed. The scope of the authority is the scope of that document.Source 3
This is the practical reason the health care agency document matters more than its name suggests. Without it you are asking for a favor and a receptionist may refuse. With it you are the patient for this purpose, and a refusal is a compliance problem rather than a decision.
It is a different document from a HIPAA authorization, and the two do different jobs. An authorization is permission to disclose, usually narrow and often expiring. Health care agency makes you the person the rule is about.
Not sure which of these is yours?
Prefer a guided path?
Answer a few questions and build a personalized Handbook around your situation.
Sahvelo gives information drawn from statutes, agency guidance and official forms. It is not legal advice for your particular situation. Terms & disclaimer.
Thirty days, and a closed list of charges
A provider must act on the request within 30 days of receiving it. It may take one further 30 days, and only by writing to you before that first window is up to say why it is late and when it will be done. There is no second extension.Source 1
That makes silence legible. A request that has simply gone quiet past 30 days, with no written extension, is out of time — not still in progress. It is worth putting the date of the request in writing for exactly this reason.Source 1
The fee is capped by what it may consist of rather than by an amount: copying labor, the supplies for a paper copy or portable media, postage if you asked for it to be posted, and preparing a summary if you agreed to one. Searching for the file and retrieving it are not on that list, so a charge for locating a record has no basis in the rule.Source 2
Ask for an electronic copy where the record is held electronically. It removes the copying and postage costs the fee is built from, and it is the format that is actually useful to the next doctor.
Source 1Where it has to live to be worth anything
Two copies in two forms. One that travels with your parent — a card in the wallet, a note on the phone's lock screen, the phone's own medical ID — and one that a second person can reach without your parent's phone, because the emergency where this matters most is the one where they cannot unlock it.
Date the summary. An undated medication list is treated as unreliable by anyone reading it, and rightly: the value is entirely in whether it is current.
Do not make a safe-deposit box the only location. It is the one place nobody can open in the hours when this information is needed.
What belongs in the record
Grouped by how quickly it is needed. The critical group is the part that has to travel; the rest can be assembled over a weekend and requested from providers where it is missing.
Travels with them
-
Current medications, with doses
CriticalEvery prescription and its dose and frequency, plus the over-the-counter medicines and supplements taken regularly. Note anything recently stopped and when.
Usually kept The pharmacy can print a list of what it has dispensed, which is the fastest starting point. Repeat-prescription slips and the bottles themselves fill the gaps.
Needed for Home safety and falls
If it doesn't exist A frequent and most consequential gap. A hospital that cannot establish what someone takes has to guess, and interactions are one of the things a fall or a confusion episode is most often traced back to.
-
Allergies and bad reactions
CriticalDrug allergies especially, with what actually happened. 'Rash' and 'stopped breathing' are treated very differently and are often both recorded as allergy.
Usually kept The GP or primary care record, and your parent's own memory, which is worth writing down before it is needed.
If it doesn't exist The safe assumption is the restrictive one, which can rule out a first-choice treatment for no reason.
-
Diagnoses and major history
CriticalThe current conditions in plain terms, plus surgeries and implanted devices — a pacemaker, a stent, a replaced joint — with rough dates.
Usually kept Discharge summaries and specialist letters. Where nothing is to hand, this is what the right of access is for.
If it doesn't exist An implanted device that goes unmentioned changes what imaging is safe.
-
The advance directive and who the agent is
CriticalThe health care power of attorney or proxy, the living will if there is one, and the agent's name and number on the same page as everything else.Source 3
Usually kept With the other signed documents, and often only there — which is the problem.
Needed for Advance directives, HIPAA authorization
If it doesn't exist The document that is at home in a folder is, for the purposes of the night it is needed, a document that does not exist. It is also the thing that makes you the person entitled to the records.
Assemble over a weekend
-
The doctors, by name and specialty
ImportantPrimary care and each specialist, with the practice's phone number. Note which one is actually coordinating care, if any is.
Usually kept Appointment letters, the phone's recent calls, and the insurer's claims history, which lists everyone paid.
If it doesn't exist Nobody can be asked what the plan was, and the default becomes starting again.
-
Insurance and Medicare details
ImportantThe Medicare number, any Advantage or supplement plan, drug coverage, and any long-term care policy.
Usually kept The cards themselves, and the annual notice each plan sends.
Needed for Medicare enrollment, Long-term care insurance
If it doesn't exist Coverage questions delay discharge more often than they delay treatment, but they do delay discharge.
-
The pharmacy that holds the history
ImportantWhich pharmacy, and whether more than one is used. Two pharmacies is a common and invisible source of duplicate prescribing.
Usually kept The labels on the bottles.
If it doesn't exist The single best shortcut to a medication list is lost.
-
Portal logins, and the request you have already made
UsefulWhich patient portals exist and how they are reached, plus a note of any records request you have sent and the date you sent it.Source 1
Usually kept Email confirmations from each practice.
Needed for Account inventory
If it doesn't exist The date of the request is what makes the 30-day rule usable. Without it there is nothing to point at.
-
What normal looks like
UsefulA sentence or two on your parent's usual state — how they walk, how oriented they normally are, what they can do unaided.
Usually kept Only in the heads of the people who see them often.
If it doesn't exist Confusion is assessed against a baseline. A clinician who does not know the baseline cannot tell an emergency from a Tuesday.
Questions people ask about this
-
The practice has had my request for months. What now?
Check the dates rather than the tone of the replies. A provider must act within 30 days of receiving the request, and may take one further 30 days only if it wrote to you inside that first window to say why and by when. No written extension means the deadline has passed, and saying so — in writing, with the date you sent the original — resolves most of these without going further. Complaints go to the Office for Civil Rights at HHS, which enforces this rule.Source 1 -
They want to charge me per page. Is that allowed?
Only for some things. The fee may include copying labor, the supplies for a paper copy or portable media, postage where you asked for it to be posted, and preparing a summary if you agreed to one. Search and retrieval are not on the list. Asking for an electronic copy of a record held electronically removes most of what the fee is built from.Source 2 -
My parent still makes their own decisions. Should I be doing this at all?
Yes, and it is easier now than it will be. The right is theirs, so the simplest route is that they request their own records, or sign a HIPAA authorization naming you, or complete a health care power of attorney that takes effect if they cannot decide. Doing it while they can choose keeps the decision theirs, which is the whole point.Source 3 -
Can a provider simply refuse?
It can deny access in defined circumstances, but it must do so in writing, in plain language, and tell you how to have that decision reviewed. A refusal that arrives as a phone call or as silence is not a denial under the rule — it is a failure to act on the request. -
Is a HIPAA authorization the same as being the health care agent?
No. An authorization is permission for a provider to disclose specified information, usually narrow and often expiring. Health care agency means a provider must treat you as the patient for privacy purposes, which carries the access right itself. Families often have the first when what they need is the second.Source 3
Official links you'll need
Every link goes directly to the issuing agency or the official tool, and opens in a new tab.
Where this sits in the process
Before this
These produce something this topic needs.
- Advance directivesthe health care agency document is what turns this from asking a favor into exercising a right
This makes possible
Finishing this unblocks these.
- Emergency planningthe medication list and the one-page summary are what the emergency kit carries
Related
- HIPAA authorizationthe narrower instrument, and why it is not a substitute for agency
- Power of attorneythe financial counterpart, signed at the same time and just as often missing
- Home safety and fallsmedication review is the first item on the fall-prevention list
- Starting the conversationhow to raise this without it sounding like a takeover
- Essential documentswhere the signed documents themselves should live
Sources
The access right, its deadline and its fee limits are federal and are in the regulation itself.
-
45 CFR §164.524 (Access of individuals to protected health information) (opens in a new tab)
The 30-day deadline, and the single conditional extension.
-
45 CFR §164.524 (Access of individuals to protected health information) (opens in a new tab)
The closed list of costs a fee may consist of.
-
45 CFR §164.502(g) (Uses and disclosures: personal representatives) (opens in a new tab)
Why health care agency carries the access right, and where its scope comes from.
Sources last reviewed 2026-08-19. Where a source is marked pending re-verification, the page says so wherever the claim appears.