How to find old medical records (yours, your parent's, or your child's)

The most counterintuitive thing about hunting old medical records is how much of the work the current provider has already done for you. When a new patient walks into a primary-care office, the practice typically asks the prior provider to forward records — not always all of them, not always promptly, but often the most important pieces. The record you're looking for may already be sitting in a chart at a doctor's office two cities away from where the original event happened. The retention-rules companion explains the legal landscape; this step is about where the records tend to actually live in practice.

Ask the current primary-care doctor for a copy of the patient's complete chart — and pay attention to the word 'complete.' Not the after-visit summary. Not the printable health summary. The full designated record set under HIPAA, including the referral letters and prior-record forwards the office holds from earlier providers. Phrase the request in writing if you can; a written request triggers HIPAA's thirty-day clock and creates a paper trail you can point to if the office tells you it'll take a few months. We come back to the right language in Step 2.

A surprising amount of history surfaces from this single ask. Specialists send consultation letters back to the referring primary-care doctor by default — that's a record of what the specialist saw, often with their plan attached. Hospitals send discharge summaries to the patient's primary-care doctor as part of the standard transitions-of-care workflow. Imaging centers send formal reports to the ordering physician. The primary-care chart is therefore a thicker historical record than most patients realize; even visits to clinicians the patient has long since stopped seeing tend to leave a trace there.

If the current practice has been the patient's home for many years, this step alone may produce most of what you need. If the patient has switched primary-care doctors recently, repeat the same ask with the previous primary-care office — they almost certainly had records that the new office never asked for. Pediatric records often work this way too: the current pediatric or family-medicine practice usually has at least a summary of immunizations and major illnesses forwarded from the previous practice.

Once the easy ask is done, go straight to the prior providers themselves. The federal mechanism for this is the HIPAA right of access, codified at §164.524 of the privacy rule, and it's the most useful regulation most patients have never heard of. The right of access obligates a covered entity — a doctor, a hospital, a lab, an imaging center, a clinic — to give a patient a copy of their own designated record set within thirty calendar days of a written request. You don't have to give a reason. The provider can't ask you to justify why you want it.

A few specifics matter. The phrase 'designated record set' is the HIPAA term of art for the full medical record, not the summary, and asking for it by name short-circuits the polite default of sending a curated after-visit summary instead. The thirty-day limit is a maximum — the provider can give you the records faster, and many will. A one-time thirty-day extension is allowed if the provider notifies you in writing within the first thirty days, but no second extension. If you're still waiting at day sixty without notice, that's a HIPAA violation, and you have grounds to file a complaint with the Office for Civil Rights at the Department of Health and Human Services.

Providers can charge a 'reasonable, cost-based fee' for paper copies, but the rule explicitly bars per-page schedules that exceed actual reproduction cost. Many states have their own statutory caps on top of HIPAA's reasonableness standard — California, for example, caps per-page fees at roughly a quarter. If a provider quotes you hundreds of dollars to copy a chart that lives in their electronic record, push back; an electronic export to a portal you already have access to is usually free or nominal.

The fastest path to the actual record is almost always to ask for an electronic export rather than a paper one. Most large systems can deliver a structured C-CDA file (the standard format for EHR exports) and a PDF bundle to a patient portal in under a week. Smaller practices may need to print and mail, or to send a CD; that's slower but still under the thirty-day rule.

What you send in writing matters less than that you send it in writing. A short letter or portal message that names the patient, the date range, the records requested ('a complete copy of my designated record set, electronic format if possible, under HIPAA §164.524'), a delivery method, and your signature is enough. Most hospital medical-records departments publish their own request form; using their form is fine, but make sure their form doesn't quietly narrow the request to just a summary.

A practice that no longer exists is the scariest case but a common one in real searches. The good news: records don't usually disappear just because the doors closed. State law almost universally requires a closing practice to arrange for the records to be transferred to a custodian, and to publish notice of who the new custodian is. Tracking down that custodian is the whole job.

For a private physician practice, the state board of medicine is the first stop. Most state boards maintain a list of where retired or closed-practice physicians' records went; some publish the list online, others keep it as a staff resource you can request by phone. A two-minute call to the state board often produces a name, an address, and a phone number for the current records custodian.

When a practice was acquired rather than closed, the acquiring practice took ownership of the records as part of the deal. The challenge is sometimes just figuring out who the acquirer was. Local news, a brief search for 'practice name acquired,' or the original practice's old website (often archived on the Wayback Machine) usually surfaces the answer.

Hospital closures are messier. The state health department is the right starting point — most maintain a public-facing 'closed-facility records' page, but the page can be buried under several layers of navigation. If the state health department doesn't have what you need, the state department of vital records and the state archives are the next two stops. Many old hospital records have been microfilmed and stored at the state archive level, sometimes in a facility separate from where they were created.

A common gotcha: 'closed' and 'rebranded' look the same from the outside. A small hospital that became a 'campus' of a larger system still has its records, but they live in the parent system's database under a different name now. If a search for the original facility returns nothing, look for the parent system's medical-records department. Expect this step to take weeks rather than days. The records are usually findable as long as the retention clock hasn't run out — that's the part the retention-rules guide is for.

Health information exchanges are the part of the answer most patients don't know exists. An HIE — sometimes called a Health Information Organization, or HIO — is a state or regional network that connects participating providers and lets them share patient records electronically across organizational boundaries. If your state has one, and the providers you've used have all joined it, the HIE may already have a substantial portion of your medical history pre-assembled.

Major HIEs include CRISP in Maryland and DC, Kansas Health Information Network, Indiana Health Information Exchange, Manifest MedEx in California, and Healthix in New York. Most are nonprofit, most participate in voluntary patient sign-up, and most allow patients to request a 'patient access report' showing every record the HIE has on file. The depth varies — some HIEs primarily exchange continuity-of-care documents (the structured summaries hospitals send each other), others handle full clinical records.

To find out whether your state has an HIE and whether the providers you're chasing are connected to it, search for the state name plus 'health information exchange' and look for a nonprofit organization, not a vendor. The state hospital association and the state department of health usually publish a one-page reference. If the HIE accepts patient sign-ups, register, request your access report, and treat it as a parallel track to the direct-provider requests in Steps 1 and 2 — neither one is a substitute for the other.

Federal-level networks are starting to fill in where state HIEs don't reach. The nationwide Trusted Exchange Framework and Common Agreement, often called TEFCA, went live in 2023 and is expanding annually. By the end of 2025 the major Qualified Health Information Networks were exchanging records across nearly every large system in the country, though smaller practices remain uneven. For most patient-driven searches, TEFCA is still mediated through providers rather than directly accessible, but the records moving on its rails make a primary-care provider request (Step 1) progressively more comprehensive.

Once a record is older than the retention clock — past the state minimum, past the hospital's internal retention policy, past whatever buffer the practice kept — the records that survive often live at the state level rather than at the original provider. Knowing where to look saves weeks.

The state department of health is the first stop for closed-hospital records, immunization records, vital records (birth and death certificates, which are themselves sometimes the missing piece in a family history search), and certain regulated record categories. Most state health departments publish a public-records request form online; some require a small fee and a copy of identification.

The state archive — usually administered by the secretary of state or a state library — holds records that have aged out of active retention. Some states maintain a custodial program for the records of closed hospitals and practices; others receive donations of records from facilities that have closed and want to preserve historical value. The state archivist's office is often the right phone call when you can't find a record any other way. Archivists are extraordinarily helpful and used to long-tail requests.

Immunization records get their own pathway. Almost every state maintains an immunization information system — a registry that providers report into, which patients (or parents of minor patients) can usually access through a state-run portal. School-age immunization records are often easier to retrieve through the state registry than through the original pediatric practice. A search for the state name plus 'immunization registry' usually turns up the right URL.

For records of military service — vaccinations during active duty, injuries during deployment, records of care at a VA facility — the National Personnel Records Center maintains the historical archive. VA records of more recent care can be accessed through the patient's MyHealtheVet account, and the VA has its own records-request process for older paper records. Genealogy-grade old records — turn-of-the-century hospital admissions, asylum records, decades-old county-hospital paperwork — sometimes live with state historical societies or university medical libraries that have collected the archives of closed institutions.

Whose records you're chasing changes the rules. The HIPAA right of access belongs to the patient, and proxy access for someone else's records requires the right legal hookup.

For a child, the parent or legal guardian is the default holder of the right of access until the child reaches the age of majority — eighteen in most states. Many state laws layer adolescent-confidentiality rules on top: providers may restrict parental access to mental-health, reproductive-health, or substance-use records once the child reaches twelve or fourteen, depending on the state. The full record still exists and the retention clock still runs; the parent just may not be able to pull it through the patient portal. A written records request through the medical-records department, signed by the parent under their legal authority over the minor, usually still works for the parts that aren't confidentiality-locked.

For a parent or another adult, you need either the patient's permission or a durable healthcare power of attorney. A signed HIPAA authorization (most providers have a one-page form) lets the parent designate you as someone who can request records; this is the easiest case and is appropriate when the patient can still make decisions. A durable healthcare power of attorney is the more robust instrument, intended for when the patient cannot make decisions, and it's the document that holds up when the parent is in a hospital bed and can't sign a one-off authorization. The form varies by state; many states publish a free template, and some require notarization.

For a deceased relative, HIPAA still applies for fifty years after the date of death. The personal representative of the estate — usually the executor, sometimes a court-appointed administrator — has the right to access the deceased's records on behalf of the estate. Providers will usually ask for a copy of the letters testamentary (the court document naming the personal representative) before releasing records. For records that touch genetic information relevant to surviving family members, the rule sometimes bends — some states have specific statutes allowing biological relatives to access certain categories of a deceased's records for their own clinical use. The state probate court and the state department of health are the places to ask.

Adoption records have their own rules and their own court process, separate from everything else here. They're typically sealed and accessible only through a court order or a state-run reunion registry, with the rules varying widely by state and by the era in which the adoption occurred. If adoption records are the goal of the search, the state's adoption-records department (often part of the department of human services) is the only practical starting point.

The common thread across all of these is paperwork. Whatever the case, expect to send a copy of the legal instrument that establishes your authority — the durable POA, the HIPAA authorization, the letters testamentary, the court order — alongside the records request itself. Sending it on the first request saves a round of letters back from the medical-records department asking for it.

Once the records start arriving — PDF exports, CDs of imaging, paper packets, occasional faxes — the next problem is what to do with them. The natural failure mode is the kitchen-counter pile: the records are technically in the house, but nobody can find anything in them, the family member coordinating care is the only person who knows the system, and a new diagnosis a year from now restarts the search from zero.

The fix is structure, not effort. Each record should have a date, a provider, and a document type attached to it, and it should live somewhere the rest of the family can read on their own phones. A folder of unnamed PDFs on a single laptop doesn't survive a hard week. A shared archive that auto-organizes new records by date and type does. The digital medical binder inside KeptWell is built for exactly this — drag in the PDF, the photo, the scanned packet, the audio recording, and the AI reads it and files it by document type, date, and provider automatically. The upload-to-understand workflow is the same for every document type, whether it's a scanned paper after-visit summary or a portal-exported PDF.

The other reason structure matters is that the records you've just spent weeks finding are exactly the records you'd otherwise spend the same weeks finding again. The investment of running this chase once should not have to be repeated by a sibling, a spouse, or an adult child in a year. A shared archive turns the work into a one-time asset for the whole family.

While the records are still being collected, keep a running list of what's still missing. Some of what you're chasing won't be found on the first pass — the imaging center where the MRI happened in 2014 doesn't return calls, the closed pediatric practice's custodian has moved twice, the deceased relative's hospital still wants a copy of the letters testamentary. A short list of 'still owed' records, kept in the same archive as the records that have arrived, is the difference between a chase that finishes and a chase that drifts. The chat helps here too — once a few records are loaded, asking the binder which encounter dates have no documents attached surfaces gaps faster than scanning every folder by hand.

Treat finding records as a project with a definite end. The archive itself is what carries the work forward after the project is closed.