You can visit this site to find out how long a facility must keep records (it is typically 7 years, though it is not uncommon for facilities to keep them much longer). Please note this site may be out of date.

Medical Retention Laws for My State

Check with other survivors of your facility and see if they have received similar documents. The amount of time you were there should correspond with how many documents you receive. For example, if you were in a facility for a year and you only receive intake, discharge, you may not have received your full record.

If you suspect you have not gotten the complete record that exists, you can file a HIPAA complaint.

Where an individual requests an electronic copy of records that a covered entity maintains only on paper, the covered entity is required to provide the individual with an electronic copy if it is readily “producible electronically” (e.g., the covered entity can readily scan the paper record into an electronic format) and in the electronic format requested if readily producible in that format, or if not, in a readable alternative electronic format or hard copy format as agreed to by the covered entity and the individual.

If a program refuses to provide you with electronic documents, you may need to inform them of this and apply additional pressure on them to provide you with the electronic records.

If not, you should file a HIPAA complaint. Several of these programs arguably have the resources to put them in electronic format in this day and age, especially if you’ve paid them thousands of dollars for treatment.

Yes, HIPAA law allows for facilities to verify an identity through a variety of ways, with a driver’s license being one of them. They may also request that you verify your identity orally, through writing, or by filling out a form that they provide.

If you feel that the way you are being asked to verify your identity is strange or the form is asking you to waive the facility of liability for more than just releasing the records, please email us at info@esaalliance.org

A program can only charge “reasonable, cost-based fees”. For a better understanding of what that could look like, please check out this website. Please keep in mind it may be slightly out of date.

Medical Record Copying Fees

If they are charging an extreme amount, you should try to first negotiate a more reasonable amount (including by informing them that you already paid thousands for treatment), and if unsuccessful, you can file a HIPAA complaint.

Never send a photo of a credit card through email to the facility. Call and give them the information over the phone or send a check.

You can also use a prepaid card if you are concerned about the facility having access to your personal card.

Programs have 30 days from the receipt of your request to send your records. They may request one extension which is allowed in some states but they must make you aware of the extension. Typically, this extension only extends the deadline to 60 days from the date of the request.

If they have not shipped/sent your records within 30 days (without notifying you of an extension) or have denied/ignored your request, you can file a HIPAA complaint.

ypically, a program will only keep therapy progress notes which you do have a right to. If a therapist jotted down private notes that were kept separate from your records, you may not be able to get access to those. However, in our experience, separate notes may not exist.

Some facilities have attempted to have survivors get a note from their therapist or waive the facility of liability in return for releasing therapy progress notes. This is a HIPAA violation.

Facilities can only deny access to records if they believe that the information would be reasonably likely to endanger the life or physical safety of someone.

You being upset from seeing your records does not qualify for this. You can file a HIPAA complaint to request a review of the reason for their denial.

They are only allowed to use this stipulation when they truly believe someone will be physically injured or die as a result of the records being released. You can file a HIPAA complaint and request a review of their reasoning.

A program will not typically require you to sign a HIPAA release form to get access to your own records.

If they do, read the document thoroughly to ensure that the release only pertains to the disclosure of records and nothing else. Here is an example of what a HIPAA release form may include.

HIPPA Release Form

Possibly. If a program still physically has the records, they are required to give them to you. If they destroyed them, you can ask for a Record of Destruction which should specify when and how your records were destroyed.

Possibly, especially if you were at the program within the last seven years because they should not have been destroyed in that case. If the facility has a parent company, you can contact them and ask how to get them.

If the facility was shut down by law enforcement, contact the office that shut them down and ask if they have them. If the facility has rebranded and is under a different name, contact the currently open facility and ask if they have them.

This may be a violation of the law and you can file a HIPAA complaint.