Alabama Medical Records Statute: Access, Retention, and Penalties

Alabama medical records law is a mix of state administrative rules and federal HIPAA requirements. Together they give you a right to inspect and copy your own records, cap what a provider can charge for copies under Alabama Code § 12-21-6.1, set minimum retention periods that vary by provider type, and back the whole system with professional discipline, civil fines, and criminal penalties. Where state and federal rules overlap, the stricter one controls.

Your Right To See and Copy Your Records

Your right of access comes primarily from federal law. Under HIPAA, you can request any protected health information a provider maintains about you in their designated record set.¹ Two narrow categories are excluded: psychotherapy notes kept separate from the main chart, and information compiled specifically for use in legal proceedings.

A provider has 30 days to act on your request. They can extend once, by up to 30 additional days, but only after sending you a written explanation of the delay and the new expected completion date.¹ If they deny your request in whole or in part, the denial must be in writing, state a reason, and tell you how to complain.

Some records carry extra protection. Alabama treats medical records of people with sexually transmitted diseases as confidential, bars their admission into court evidence outside commitment proceedings, and permits release only with the patient’s written consent. Violating that confidentiality is a Class C misdemeanor.²

What a Provider Can Charge for Copies

Alabama Code § 12-21-6.1 caps what a provider can charge you for copies of your own records:

First 25 pages: $1.00 per page
Pages beyond 25: $0.50 per page
Search fee: $5.00
Mailing: actual postage, if you ask for the records by mail
X-rays and special records: actual reproduction costs, charged separately

The caps apply to anyone who holds medical records, including hospitals and third-party custodians. Unless you make other arrangements, the provider can require payment before releasing the copies. Records subpoenaed by the State Board of Medical Examiners are exempt from these limits.³

One boundary worth knowing. These caps clearly govern what a provider charges you when you request your own records. A federal court ruling found that HIPAA’s cost-based fee limitations apply only when you personally request your records, not when you direct a provider to send them to a third party. In practice, when an insurance company or attorney requests your records through a signed authorization, the provider or a record retrieval company may charge that third party more than the per-page rates above.

Letting Someone Else See Your Records

No one can see your medical records without your permission unless a specific legal exception applies. To authorize a third party, you sign a written form that identifies the recipient, the information covered, the purpose, any limits, and your right to revoke. Revocation works going forward only. Once you revoke in writing, the provider cannot make any new disclosures, but anything already shared before the revocation stands.

Several situations allow access without your authorization:

A healthcare proxy named in an advance directive, or a court-appointed guardian, can access records needed to make medical decisions for an incapacitated patient.
Parents or legal guardians generally can access a child’s records, though exceptions exist for sensitive services like reproductive health.
A personal representative of the estate or an executor can request a deceased patient’s records with legal documentation of their authority.
Courts can compel disclosure through orders and subpoenas, but the requesting party must follow HIPAA’s procedural requirements, including giving you notice or obtaining a protective order.
HIPAA permits certain disclosures for disease reporting, abuse investigations, and law enforcement, subject to strict conditions.

Substance Use Disorder Records

If you received treatment at a federally assisted substance use disorder program, your records carry extra federal protections under 42 CFR Part 2, which are stricter than standard HIPAA rules. A valid Part 2 consent must include your name, a description of the information shared, the specific recipient, the purpose, your right to revoke, and an expiration date or condition.⁴ Recent federal changes allow a single consent to cover future uses for treatment, payment, and healthcare operations, but the form must state that the records may not be used against you in civil, criminal, administrative, or legislative proceedings. Providers that handle Part 2 records were required to update their HIPAA privacy notices by February 2026 to explain how substance use disorder information is handled and the additional restrictions on redisclosure. A provider that wants to use Part 2 records for fundraising must first give you a clear opportunity to opt out.

How Long Providers Must Keep Records

Retention rules vary by the type of provider and your age at the time of treatment. Electronic records must be kept for the same periods as paper records, and the provider must ensure records stay legible and retrievable throughout the retention period.

Physician Practices

Under the joint rules of the Alabama Board of Medical Examiners and the Medical Licensure Commission, a physician must retain medical records for at least seven years from the date of the last professional contact.⁵ Special categories run on different clocks:

Minors’ records: at least two years after the patient reaches the age of majority (19 in Alabama), or seven years from the last professional contact, whichever is longer.
X-rays and imaging: at least five years. If a separate written interpretation exists, the images themselves may be destroyed after five years, but mammography imaging and reports must be kept for ten years.
Immunization records: same timeline as minors’ records if not transmitted to the state immunization registry.
Disputed records: any record connected to a pending dispute cannot be destroyed until the dispute is resolved, as long as the physician received notice of the dispute before the retention period expired.⁵

Hospitals

Alabama Department of Public Health regulations require hospitals to keep medical records for at least five years in their original or legally reproduced form. For minors treated in a hospital, records must be kept for at least five years after the patient reaches the age of majority.⁶

Nursing and Long-Term Care Facilities

Nursing facilities work on a slightly longer clock: records must be preserved for at least six years after the patient’s most recent discharge, and for minors, at least six years after reaching legal age.⁷

When Your Doctor Closes, Dies, or Loses a License

One of the most common ways people lose track of their records is a physician retiring, dying, losing their license, or leaving a group practice. Alabama has notification rules for each situation.

A retiring solo practitioner or group practice must notify active patients at least 30 days before closing. The notice must explain how to get copies of your records or have them transferred to another doctor, and it must include a HIPAA-compliant authorization form.⁸ The physician must take reasonable steps to transfer records to patients, to another provider, or to a HIPAA-compliant custodian that will maintain them for the required retention period.

If a physician dies, the group practice, or for a solo practitioner the personal representative of the estate, must send notice within 30 days. The personal representative arranges custody of the records by transferring them to another physician or a compliant records custodian.⁸ License suspension or revocation triggers the same 30-day notification window, with the disciplined physician bearing the cost of notifying patients and arranging transfers. When a practice is sold, the selling physician must ensure records transfer to a provider or entity that will maintain them in compliance with retention rules.

Fixing an Error in Your Record

If you spot a mistake, you can ask the provider to amend the record. Under HIPAA, a provider must allow you to request amendments to any protected health information in your designated record set.⁹ The provider can require you to put the request in writing and to explain why the information is wrong.

The provider has 60 days to act, with one 30-day extension available on written notice. If the provider agrees, they must amend the record and notify anyone who previously received the incorrect information and who you identify as needing notification.⁹

A provider can deny an amendment in limited situations: if they did not create the record, if the information is not part of your designated record set, if it would not be available for your inspection, or if the record is already accurate and complete. A denial must be in writing and explain the basis. You can then submit a statement of disagreement, which becomes a permanent part of the record.

Penalties When the Rules Are Broken

Consequences come from two directions: state professional discipline and federal HIPAA enforcement.

State Consequences

The Alabama Board of Medical Examiners can discipline any licensee who fails to comply with record management rules, with sanctions ranging from formal reprimand to license suspension or revocation. Certain confidentiality breaches are criminal: unauthorized disclosure of STD-related records is a Class C misdemeanor.² Patients harmed by improper handling can also sue for breach of confidentiality.

Federal Civil Penalties

HIPAA civil penalties follow a four-tier structure based on the violator’s fault. The 2026 inflation-adjusted amounts are:¹⁰

No knowledge of the violation: $145 to $73,011 per violation, annual cap $2,190,294.
Reasonable cause and not willful neglect: $1,461 to $73,011 per violation, annual cap $2,190,294.
Willful neglect, corrected within 30 days: $14,602 to $73,011 per violation, annual cap $2,190,294.
Willful neglect, not corrected within 30 days: $73,011 to $2,190,294 per violation, annual cap $2,190,294.

Federal Criminal Penalties

Knowingly obtaining or disclosing protected health information in violation of HIPAA can trigger criminal prosecution:¹¹

Basic violation: up to $50,000 in fines and one year in prison.
Under false pretenses: up to $100,000 in fines and five years in prison.
Intent to sell, use for commercial advantage, or cause malicious harm: up to $250,000 in fines and ten years in prison.

Information Blocking

The 21st Century Cures Act prohibits “information blocking,” meaning practices that unreasonably interfere with your ability to access, exchange, or use your electronic health information. A provider that blocks access without meeting a recognized exception can face penalties of up to $1 million per violation.¹² Federal regulators have defined nine narrow exceptions, including preventing harm, protecting privacy, safeguarding data security, and situations that are genuinely infeasible such as a natural disaster or system outage. Each requires specific, tailored conditions; a provider cannot invoke a blanket “security concerns” reason to withhold your records. These rules work alongside HIPAA’s access rights, so a provider that ignores a request for electronic records could face consequences under both frameworks.

1
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
2
Alabama Legislature. Alabama Code 22-11A-22 – Medical Records of Persons Infected with Sexually Transmitted Diseases
3
Alabama Legislature. Alabama Code 12-21-6.1 – Reproduction and Delivery of Medical Records
4
eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
5
Legal Information Institute. Alabama Administrative Code 540-X-9-.10 – Joint Rules of the State Board of Medical Examiners and Medical Licensure Commission for Medical Records Management
6
Alabama Administrative Code. Alabama Administrative Code 420-5-7-.13 – Medical Record Services
7
Alabama Administrative Code. Alabama Administrative Code 420-5-13-.11 – Patient Records
8
Alabama Board of Medical Examiners & Medical Licensure Commission. Medical Records and Patient Notification
9
eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
10
Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
11
GovInfo. 42 USC 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
12
HHS Office of Inspector General. Information Blocking