Medical records laws in Pennsylvania give you a statutory right to copies of your own chart, cap what a provider can charge you for those copies, set deadlines for producing them, and back the whole framework with both state licensing discipline and federal HIPAA penalties. The details below cover how to request records, what you’ll pay, when a provider can say no, and how long your records stick around after your last visit.
Your Right to See and Copy Your Records
Under 42 Pa. C.S. § 6155, you and anyone you designate, including your attorney, can access your medical charts and get photocopies without a subpoena.1Pennsylvania General Assembly. 42 Pennsylvania Consolidated Statutes 6155 – Rights of Patients The right covers paper and electronic records alike, and it belongs to you whether you want a second opinion, a switch of provider, a benefits application, or just a look at what’s in your file.
Authorized representatives can request records on your behalf. Legal guardians and people holding power of attorney qualify. So do executors and next of kin for a deceased patient, provided they produce the right documentation. Parents and legal guardians can generally access a minor child’s records, with a significant exception for a minor’s own mental health treatment, addressed below.
How Fast the Provider Has to Respond
Pennsylvania’s access statute doesn’t set a specific turnaround. The federal deadline fills that gap. Under HIPAA, a covered entity must act on your access request within 30 days of receiving it.2eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information “Act on” means either giving you the records or sending a written denial with the reason. If the provider can’t meet the deadline, it can take one 30-day extension, but only after sending you a written explanation and a date you can expect a response. No further extensions.
What Copies Can Cost in 2026
Pennsylvania caps copying fees on a schedule the Department of Health updates each year. The statutory baseline is 42 Pa. C.S. § 6152; the Department adjusts the numbers upward annually.3Pennsylvania General Assembly. 42 Pennsylvania Consolidated Statutes 6152 – Subpoena of Records For 2026, the caps are:
- Pages 1–20: up to $2.00 per page
- Pages 21–60: up to $1.48 per page
- Pages 61 and beyond: up to $0.52 per page
- Microfilm copies: up to $2.95 per page
- Search and retrieval fee: up to $29.61, but providers cannot charge this fee when you are requesting your own records
These per-page rates apply whether copies come on paper or on electronic media, regardless of how the records are stored.4PA Department of Health. Medical Record Fees Separate flat fees exist for records supporting Social Security or financial needs-based program claims ($37.52) and for records requested by a district attorney ($29.61). If a provider tries to bill above the current annual cap, you have grounds to push back.
When a Provider Can Deny Access
Your right to your records is broad, not unlimited. HIPAA identifies specific grounds for denial and splits them into two categories: denials you cannot appeal to the provider, and denials you can.
Unreviewable Denials
Certain denials don’t come with an internal review right. They include:
- Psychotherapy notes: a mental health professional’s personal notes kept separate from your main chart, documenting or analyzing counseling sessions, are excluded from access rights entirely.
- Litigation-related materials: information compiled in anticipation of a lawsuit or legal proceeding can be withheld.
- Active research participation: if you agreed to suspend access as part of a clinical trial, the provider can deny access until the study ends.
- Confidential source information: if the record contains information obtained from someone other than a health care provider under a promise of confidentiality, and disclosure would reveal that source, access can be denied.
The psychotherapy notes exception is the one most people misread. It only covers a therapist’s private session notes kept apart from your chart. Your diagnosis, treatment plan, medications, and session summaries in the main record remain accessible.5HHS.gov. Individuals’ Right Under HIPAA to Access Their Health Information
Reviewable Denials
A provider may also deny access when a licensed health care professional determines that releasing the records is reasonably likely to endanger your life or physical safety, endanger someone else, or cause substantial harm to a person referenced in the records. If you get a reviewable denial, you have the right to have a different licensed professional review that decision. A provider cannot deny access because it dislikes your reason for asking, and it cannot refuse because a business associate rather than the provider itself holds the records.5HHS.gov. Individuals’ Right Under HIPAA to Access Their Health Information
Fixing Errors in Your File
If you find something wrong in your records, federal law gives you the right to request an amendment. The provider must act on the request within 60 days, with one 30-day extension available if it sends you a written explanation of the delay.6eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
The provider can require your request in writing along with an explanation of why the change is warranted, as long as it tells you about those requirements upfront. If it grants the amendment, it must flag the corrected records and make reasonable efforts to notify anyone who previously received the wrong information and may have relied on it.
Providers can deny amendment requests, but the denial has to be written and explain the reason. You then have the right to submit a written statement of disagreement. The provider must attach your original request, its denial, your statement of disagreement, and any rebuttal it writes to the record permanently. Every future disclosure of the disputed information must carry these attachments or an accurate summary.6eCFR. 45 CFR 164.526 – Amendment of Protected Health Information Your side of the record travels with the record.
Records With Extra Protection
HIPAA’s Privacy Rule prohibits covered entities from using or disclosing protected health information except as permitted or required by regulation, and the Security Rule adds technical requirements for electronic records.7eCFR. 45 CFR Part 164 – Security and Privacy Pennsylvania and other federal rules add stricter layers for certain categories.
Mental Health
The Pennsylvania Mental Health Procedures Act (50 P.S. § 7101 et seq.) imposes stricter confidentiality on psychiatric treatment records. Privileged communications, written or oral, generally cannot be disclosed without the patient’s written consent.
HIV-Related Information
The Confidentiality of HIV-Related Information Act (35 P.S. § 7601 et seq.) requires specific written authorization before HIV test results or related information can be disclosed. A person who obtains this information through providing health or social services cannot disclose it or be compelled to disclose it without proper authorization.8Pennsylvania General Assembly. Confidentiality of HIV-Related Information Act
Substance Use Treatment
Federal regulations at 42 C.F.R. Part 2 restrict the use and disclosure of records from substance use disorder treatment programs. These protections stack on top of HIPAA and Pennsylvania law and add another layer of consent requirements before any disclosure.9eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
Minors’ Mental Health Records
A parent or legal guardian can generally consent to release of a child’s medical records, but Pennsylvania carves out mental health treatment. Minors between 14 and 18 can consent to inpatient or outpatient mental health treatment on their own, and when they do, the minor controls the release of those mental health records in most situations. A parent who consented to the treatment can authorize release only to the minor’s current mental health provider, to a prior provider if the information is relevant, or to a primary care provider if the current mental health professional determines the release will not be detrimental to the minor. All other release decisions belong to the minor.
Disclosures Without Your Consent
Outside the protected categories, Pennsylvania generally requires your written consent before a provider releases your records. A few situations create legal authority for disclosure without your explicit permission.
Subpoenas and Court Orders
A subpoena alone does not automatically entitle someone to your records in Pennsylvania. Under 42 Pa. C.S. § 6155, you, anyone acting on your behalf, and the facility holding your records all have standing to ask the court for a protective order that restricts or blocks access.1Pennsylvania General Assembly. 42 Pennsylvania Consolidated Statutes 6155 – Rights of Patients Courts weigh privacy interests against the need for evidence and may limit how records are used.
Workers’ Compensation
When you file a workers’ comp claim, employers and insurers gain access to records that are material and relevant to the proceeding. Pennsylvania’s discovery rules allow parties to obtain records related to treatment, hospitalization, testing, and examination, limited to information connected to the claim.10Legal Information Institute. 34 Pa Code 131.68 – Discovery of Records A comp claim is not open season on your entire medical history.
Data Breaches
Pennsylvania’s Breach of Personal Information Notification Act (73 P.S. § 2301 et seq.) requires any entity that maintains personal information, including medical information, to notify affected Pennsylvania residents when unencrypted data is accessed by an unauthorized person.11Pennsylvania General Assembly. Breach of Personal Information Notification Act When a breach affects more than 500 residents, the entity must also notify the Pennsylvania Attorney General’s Office at the same time.12PA Office of Attorney General. Breach of Personal Information Notification Act (BPINA)
How Long Providers Have to Keep Your Records
Pennsylvania’s age of majority is 18. Retention rules build from there, and they differ for hospitals and private-practice physicians.
Hospitals and Health Care Facilities
Hospitals must retain medical records for at least seven years after discharge. For minors, records must be kept until the patient reaches 18, plus an additional seven years.13Legal Information Institute. 28 Pa Code 563.6 – Preservation of Medical Records A child treated at age 10 would have records retained until at least age 25.
Physicians in Private Practice
Physicians must keep records for at least seven years from the date of the last service. For minor patients, records must be retained until one year after the minor reaches 18, even if that exceeds seven years.14Legal Information Institute. 49 Pa Code 16.95 – Medical Records A minor’s records from a private physician must therefore be kept until the patient turns 19 at minimum. Many liability insurers recommend physicians keep records longer than the legal floor to support potential malpractice defense.
What Happens When the Rules Are Broken
Multiple agencies have authority over medical record violations, and the consequences escalate depending on who violated what.
State Licensing Discipline
The Pennsylvania State Board of Medicine can take disciplinary action against physicians for unprofessional conduct, which includes improper recordkeeping and unauthorized disclosures. Penalties range from fines to license suspension or revocation. The Pennsylvania Department of Health and other state licensing boards have parallel authority over hospitals and other facilities.
Federal HIPAA Penalties
The U.S. Department of Health and Human Services enforces HIPAA through a tiered penalty system that escalates with the level of negligence. Penalties in 2026 range from $145 per violation for unknowing breaches despite reasonable efforts, up to $73,011 or more per violation for willful neglect that goes uncorrected. Annual caps for the most serious tier reach approximately $2.19 million. Criminal violations can carry fines up to $250,000 and imprisonment.
Private Legal Action
If your records are disclosed without authorization, you may have grounds to sue for invasion of privacy. Pennsylvania’s Unfair Trade Practices and Consumer Protection Law (73 P.S. § 201-1 et seq.) can also apply when a health care entity engages in deceptive conduct related to its data security practices, such as misrepresenting how it protects patient information.15Pennsylvania General Assembly. Unfair Trade Practices and Consumer Protection Law
Health Apps Sit Outside HIPAA
A growing amount of health data lives in apps and wearable devices that fall outside HIPAA entirely. HIPAA applies to covered entities like hospitals, insurers, and their business associates. If you share health data with a fitness tracker, a period-tracking app, or a telehealth platform that doesn’t qualify as a covered entity, HIPAA protections do not follow that data. The FTC has brought enforcement actions under the Health Breach Notification Rule, warning companies they need adequate safeguards and consumer consent before sharing sensitive health data with third parties. But the area remains a patchwork, and health information you voluntarily share with a non-HIPAA app has far less legal protection than what sits in your doctor’s chart.