Oklahoma medical records laws give you a clear right to see and copy your own health information, cap what a provider can charge you, set minimum retention periods, and impose penalties when a provider mishandles the file. The core state statute is Title 76, Section 19 of the Oklahoma Statutes, and federal HIPAA rules apply on top of it.1Justia. Oklahoma Code 76 – Torts – 76-19 Access to Medical Records
Your Right to See and Copy Your Records
Section 76-19 says any person who is or has been a patient is entitled, on request, to their medical records. That includes X-rays, pathology slides, and medical bills, not just the chart notes.1Justia. Oklahoma Code 76 – Torts – 76-19 Access to Medical Records The provider owns and maintains the file, but the information inside belongs to you in the sense that you have a legal right to access it.
To make a request, submit it in writing with your full name, date of birth, and valid identification. Most providers will also ask you to sign a HIPAA-compliant authorization form. If you want the records sent to someone else, that authorization needs to say so.
A provider can lawfully limit access in a few situations. Under HIPAA, a provider may withhold information if releasing it could reasonably endanger you or someone else. Psychiatric and psychological records are treated separately under state law, discussed below.
What Providers Can Charge You
This is where Oklahoma law is more protective than many states. When you request your own records, the provider cannot charge you a search, retrieval, review, or preparation fee. You pay only for the copies.1Justia. Oklahoma Code 76 – Torts – 76-19 Access to Medical Records
The statutory copy fees are:
- Paper copies: $0.50 per page, not counting X-rays and other images.
- Electronic copies from an electronic health record: $0.30 per page, if the records are stored electronically, requested in electronic format, and can be delivered electronically.
- Total charge for electronically stored and delivered records is capped at $200, plus postage or delivery fees.
These limits apply when the request comes from you, your personal representative, your spouse, or a responsible family member.1Justia. Oklahoma Code 76 – Torts – 76-19 Access to Medical Records
Third-party requests, such as those from attorneys, insurance companies, or through a subpoena, work differently. The provider can charge a $20 base fee whether or not any matching records are found, plus the per-page charges and delivery costs.1Justia. Oklahoma Code 76 – Torts – 76-19 Access to Medical Records HIPAA separately limits what a provider can charge a patient to a reasonable, cost-based fee covering copying labor, supplies, and postage.2eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
Requesting Records for Someone Else
You can get someone else’s records only with the right paperwork, and the paperwork depends on the situation.
Minor Children
Parents and legal guardians generally can request their minor child’s records. Oklahoma carves out exceptions, though, for care a minor consented to on their own. Under Title 63, Section 2602, minors can consent independently to services for pregnancy, sexually transmitted or other reportable communicable diseases, drug and substance abuse, and alcohol abuse. If the minor turns out not to have the condition, the provider cannot reveal any information to a parent, spouse, or guardian without the minor’s consent. A minor who is a victim of sexual assault can also consent independently to a forensic examination, and information from any of these visits generally cannot be shared with schools, employers, law enforcement, or government agencies without the minor’s consent.3Justia. Oklahoma Statutes 63-2602 – Right of Self-Consent Under Certain Conditions – Doctor Patient Privileges
Incapacitated Adults
A healthcare proxy or someone with power of attorney can access records by providing a notarized copy of the document granting that authority. A court-appointed guardian will need to provide the guardianship order.
Deceased Patients
When a patient has died, access requires either a court order or written authorization from someone with statutory priority. First priority is a court-appointed executor, administrator, or personal representative. If no one has been appointed, the spouse can authorize release. If there is no spouse, a responsible family member can, which the statute defines as a parent, adult child, adult sibling, or other adult relative who was actively involved in providing or monitoring the patient’s care, as verified by the provider.1Justia. Oklahoma Code 76 – Torts – 76-19 Access to Medical Records
Mental Health and Substance Use Records Are Treated Differently
If you are trying to get your own mental health file, the ordinary Section 76-19 access right does not automatically apply. Under Title 43A, Section 1-109, communications between a physician or psychotherapist and patient are privileged and confidential, and records can only be shared with people involved in your treatment or related administrative work. Sharing outside that circle requires your written consent, a guardian’s consent, or a court order.4Oklahoma Statutes. Oklahoma Code 43A-1-109 – Confidentiality of Medical Records
Unlike general medical records, you do not have an automatic right to view your own psychiatric or psychological records. Access requires the treating physician’s consent or a court order. The provider can share information from the record as they deem appropriate and consistent with your best interest, which is not the same as handing over the full file.4Oklahoma Statutes. Oklahoma Code 43A-1-109 – Confidentiality of Medical Records Psychotherapy notes get further protection under HIPAA and generally require specific authorization to disclose.
Substance use disorder treatment records covered by federal 42 CFR Part 2 have their own separate rules on top of HIPAA. They cannot be released without patient consent except in narrow circumstances such as a medical emergency or a specific court order, and a general medical authorization form does not release them.5eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
How Long Providers Must Keep Records
Retention minimums depend on the type of provider and the age of the patient. Under the Oklahoma Administrative Code, hospitals must keep medical records for at least five years after the date the patient was last seen, or at least three years after the patient’s death.6Cornell Law School. Oklahoma Administrative Code 310:667-19-14 – Retention and Preservation of Records Records for minors must be kept at least three years past the age of majority, which is 18 in Oklahoma, so the file must survive until the patient turns 21.7Justia. Oklahoma Statutes 15-13 – Minors Defined
For physicians, Title 59, Section 509 requires an office record for each patient that accurately reflects evaluation, treatment, and medical necessity. Failing to keep one is unprofessional conduct that can result in discipline. The statute does not name a specific retention period, so the administrative code minimums serve as the practical floor.8Justia. Oklahoma Statutes 59-509 – Unprofessional Conduct
Providers who participate in Oklahoma Medicaid have a longer obligation: the Oklahoma Health Care Authority requires them to retain records for at least six years to support claims for services furnished to recipients.9Oklahoma.gov. OHCA Record Retention
Fixing Errors in Your Records
If your records contain something you believe is inaccurate or incomplete, you can ask for an amendment under HIPAA. Submit the request in writing, explain what you think is wrong, and include any supporting documentation.
The provider has 60 days to act. They can extend that by up to 30 days if they notify you in writing of the reason and the expected response date. Only one extension is allowed per request.10eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
If the provider agrees, the correction is appended to the record without altering the original entry, and they must make reasonable efforts to notify anyone who previously received the incorrect information. If the provider denies your request, they have to give you a written explanation. Common reasons include a finding that the original entry is accurate or that the record was not created by that provider. You then have the right to submit a written statement of disagreement, which the provider must attach to the record and include in future disclosures of the disputed information.
If a Provider Mishandles Your Records
You have several places to complain, and the penalties are meaningful.
For a HIPAA privacy violation, file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights through the HHS complaint portal.11HHS.gov. Filing a Health Information Privacy Complaint OCR investigates covered entities and their business associates for violations of the Privacy, Security, and Breach Notification Rules, and civil penalties run in tiers that are adjusted annually for inflation, reaching into the millions for uncorrected willful neglect.12Federal Register. Annual Civil Monetary Penalties Inflation Adjustment Criminal violations, handled by the Department of Justice, can bring fines up to $250,000 and up to ten years in prison in the most serious category, which involves selling or maliciously using health information.
At the state level, you can report concerns to the Oklahoma State Department of Health or to the medical licensing board that regulates the provider. Substantiated violations can result in fines, license suspension, or revocation. Oklahoma law also allows you to file a civil lawsuit if improper handling caused you harm.
If your information was exposed in a data breach, Oklahoma’s Security Breach Notification Act in Title 24 requires the entity that owns or licenses the data to notify affected residents without unreasonable delay. As of January 1, 2026, amendments under Senate Bill 626 also require notification to the Oklahoma Attorney General, who can pursue civil penalties of up to $150,000 per breach or series of related breaches discovered in a single investigation.13Oklahoma State Legislature. Oklahoma Statutes Title 24 – Debtor and Creditor – Security Breach Notification Act
When Your Doctor Retires or the Practice Closes
If your provider retires, sells the practice, or shuts down, you can still get your records. Oklahoma licensing boards expect closing providers to notify patients and arrange for the records to be transferred or stored. The Oklahoma State Board of Osteopathic Examiners lists acceptable notification methods including a sign in the waiting room, a note on billing statements, a newspaper notice, or a mailed letter to each patient’s last known address. The notice must tell patients where records will be stored after closing and how to request copies. Physicians also must notify their licensing board in writing within fourteen business days of any relocation or closure.14Oklahoma.gov. Closing the Osteopathic Physician’s Office
If you did not get a notice and cannot locate your former provider, contact the relevant state licensing board. They typically have information on where the records were transferred.