Massachusetts medical records law gives patients a written right to see and copy their records, caps what hospitals and clinics can charge, sets retention periods that differ by facility type, and backs privacy protections with treble damages under the state’s consumer protection statute plus federal HIPAA enforcement. The main state provisions are Chapter 111, Section 70 (hospital and clinic records), Section 70E (the Patients’ Bill of Rights), and Chapter 93H (data breach notification), all layered on top of HIPAA.
How to Request Your Records
Send the facility a written request. Section 70 lets you inspect and obtain copies of your hospital or clinic record, and it extends the same right to your attorney (with written authorization) or to the executor or administrator of a deceased patient’s estate.1General Court of Massachusetts. Massachusetts General Laws Chapter 111 – Section 70 There is no required form, but a written request gives you a paper trail if something goes wrong.
HIPAA sets the response clock. A covered provider must act on your access request within 30 days. It can take a single 30-day extension, but only after sending you a written explanation and a new response date.2eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information Massachusetts imposes its own 30-day deadline, with no fee, when records are requested to support a Social Security claim or a financial needs-based benefit program.1General Court of Massachusetts. Massachusetts General Laws Chapter 111 – Section 70
You can also direct records to a third party — another doctor, an attorney, a family member. Under HIPAA, the request must be in writing, signed by you, and identify the recipient and destination. The provider must comply within the same 30 days and cannot charge you more than it would charge for a copy sent to you.3HHS.gov. Individuals’ Right Under HIPAA to Access Their Health Information
When a Provider Can Deny Access
Two categories of material sit outside the access right. Psychotherapy notes, meaning a therapist’s personal session notes kept separate from the main chart, are categorically exempt under HIPAA, and the provider is not required to give you an appeal.2eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information Providers can also withhold information compiled in anticipation of litigation.
What Hospitals and Clinics Can Charge
Section 70 sets base maximums that adjust annually with the Consumer Protection Index. The statutory base numbers are $15 per request, $0.50 per page for the first 100 pages, and $0.25 per page after that. As of 2026 the CPI-adjusted caps run to approximately $28.69 for the base charge, $0.96 per page for the first 100 pages, and $0.49 per page beyond. Postage is charged at actual cost, and no separate search or retrieval fee is allowed on top of the base charge.1General Court of Massachusetts. Massachusetts General Laws Chapter 111 – Section 70
No fee at all applies when the records support a claim or appeal under the Social Security Act or any federal or state financial needs-based benefit program.1General Court of Massachusetts. Massachusetts General Laws Chapter 111 – Section 70 If you ask for an electronic copy and the provider maintains records electronically, HIPAA limits the fee to a reasonable, cost-based amount covering labor, supplies, and postage.3HHS.gov. Individuals’ Right Under HIPAA to Access Their Health Information
Your Privacy Rights
Section 70E, the Patients’ Bill of Rights, guarantees confidentiality of all records and communications related to your care and requires providers to answer reasonable requests promptly.4General Court of Massachusetts. Massachusetts General Laws Chapter 111 – Section 70E Beyond treatment, payment, and healthcare operations, a provider generally needs your written consent before sharing your information with a third party. Both state law and HIPAA require providers to give you a notice of privacy practices explaining how your data may be used and shared; HIPAA also requires the notice to be posted prominently, including on the provider’s website.5HHS.gov. Model Notices of Privacy Practices
Correcting an Error in Your Record
If you find a mistake, you can ask for an amendment. The request must be in writing and explain what you want changed and why. The provider does not have to agree, but if it denies your request it must explain the reason and let you file a statement of disagreement that becomes part of your record.6Mass.gov. Public Health Privacy Notices
How Long Providers Keep Records
Retention rules split by facility type. Hospitals and clinics licensed by the Massachusetts Department of Public Health must keep patient records for at least 20 years after the patient’s discharge or final treatment. After that, the facility may destroy the records, but only after notifying the Department in accordance with its regulations, and the termination policy must appear on the notice of privacy practices.1General Court of Massachusetts. Massachusetts General Laws Chapter 111 – Section 70
Private physicians have a shorter clock. Under Board of Registration in Medicine rules, physicians must keep adult patient records for at least seven years from the date of the last encounter. For pediatric patients, the record must be kept for seven years or until the patient turns 18, whichever is longer. A retiring physician (or the physician’s successor) must also keep records for seven years from the last encounter.7Mass.gov. Medical Records Obligations
When records finally come up for destruction, HIPAA requires reasonable safeguards but does not mandate a specific method. Paper can be shredded, burned, or pulped so it cannot be reconstructed; electronic media can be overwritten, degaussed, or physically destroyed.8HHS.gov. What Do the HIPAA Privacy and Security Rules Require of Covered Entities When They Dispose of Protected Health Information
Substance Use Disorder Records
Substance use disorder treatment records get an extra layer of federal protection under 42 CFR Part 2. A treatment program generally cannot disclose that a person is or was in treatment, or share anything from the treatment record, without written consent that identifies the recipient, describes the information, states the purpose, and includes an expiration date or event.9eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
Law enforcement access is especially restricted. These records cannot be used to start or support criminal charges, conduct a criminal investigation of the patient, or serve as evidence in any proceeding against the patient, including a search warrant application, without patient consent or a specific court order. Even then, the court can only authorize disclosure after finding no alternative and that the public interest outweighs the harm to the patient and the treatment relationship.10Federal Register. Confidentiality of Substance Use Disorder (SUD) Patient Records
In Massachusetts, a child aged 12 or older can independently consent to substance use disorder treatment (other than methadone maintenance). Because the minor consents to the treatment, the minor also controls disclosure of the related information.11Mass.gov. Guide on the Disclosure of Confidential Information – Health Care Information
Records for Minors and Deceased Patients
Minors
The parent or guardian usually controls access to a child’s medical records. Massachusetts carves out specific situations, though, where the minor alone holds that right, tracking the areas where the minor can consent to the underlying treatment:
- Substance use disorder treatment, for children 12 and older.
- Inpatient mental health treatment, for youth 16 and older who voluntarily commit themselves.
- Pregnancy-related care. A pregnant minor can consent to all medical and dental treatment, and only she can authorize release of the related records.
- Family planning services, where the minor consents independently and the parent cannot authorize release.
In each of these situations, the parent is not the minor’s authorized representative for that treatment information, and the provider must get the minor’s own consent before sharing those records with anyone, parent included.11Mass.gov. Guide on the Disclosure of Confidential Information – Health Care Information
Deceased Patients
HIPAA protects a deceased individual’s records for 50 years after the date of death. During that window, a personal representative (typically an executor, administrator, or someone with legal authority under state law) can exercise the same access rights the patient would have had.12HHS.gov. Health Information of Deceased Individuals Massachusetts mirrors this by letting the executor or administrator of a deceased patient’s estate (or their attorney, with written authorization) inspect and copy hospital and clinic records.1General Court of Massachusetts. Massachusetts General Laws Chapter 111 – Section 70 HIPAA also permits a provider to share relevant information with a family member or other person who was involved in the individual’s care before death, unless doing so conflicts with a preference the patient expressed while alive.
When Providers Can Disclose Without Your Consent
Certain disclosures happen without patient consent, sometimes as an option and sometimes as a legal requirement. Providers must report specified infectious diseases to the Massachusetts Department of Public Health, and laboratories must report evidence of infection within 24 hours through secure electronic reporting. The reportable list is broad, covering tuberculosis, hepatitis, novel coronaviruses, and hemorrhagic fever viruses, among others.13Legal Information Institute. 105 CMR 300.170 – Laboratory Findings Indicative of Infectious Disease Reportable Directly to the Department by Laboratories
Court orders and subpoenas both compel disclosure, but they work differently. A court order (including from an administrative tribunal) lets a provider release only the information the order specifically describes. A subpoena issued by an attorney or court clerk requires the provider to first confirm that reasonable efforts were made to notify the patient or obtain a protective order before releasing anything.14HHS.gov. Court Orders and Subpoenas In mental health contexts, providers may disclose records without consent when necessary to prevent serious harm to the patient or others, and the disclosure should be limited to what the threat requires.
Penalties and How to File a Complaint
Chapter 93H requires any entity that experiences a data breach involving personal information, medical records included, to notify the Attorney General and affected individuals as soon as practicable.15General Court of Massachusetts. Massachusetts General Laws Chapter 93H – Section 3 Enforcement runs through the Consumer Protection Act: the Attorney General can bring an action against an entity that fails to protect confidential patient information.16General Court of Massachusetts. Massachusetts General Laws Chapter 93H – Section 6
Individual patients can also sue under Chapter 93A. If a court finds that a provider engaged in unfair or deceptive practices in handling medical records, it can award two to three times actual damages when the violation was willful or knowing, plus reasonable attorney’s fees and costs.17General Court of Massachusetts. Massachusetts General Laws Chapter 93A – Section 9 The multiplied damages and fee-shifting are what give Massachusetts patients real leverage in these cases.
To file a HIPAA complaint about a Massachusetts provider, submit it to the HHS Office for Civil Rights online through the OCR Complaint Portal, by email to OCRComplaint@hhs.gov, or by mail. The complaint must identify the provider, describe what happened, and be filed within 180 days of when you became aware of the violation.18HHS.gov. How to File a Health Information Privacy or Security Complaint For state-law violations involving unfair business practices or data breaches, you can complain to the Massachusetts Attorney General’s office or bring a private lawsuit under Chapter 93A.