Healthcare in the United States exchanges billions of fax pages a year, and medical records requests are a large part of that traffic. If you have been told to fax a release form to get your own records — or to move them to a new doctor — knowing how to fax medical records correctly is mostly about getting the paperwork right before you send anything.

This guide to how to fax medical records covers what the authorization must contain, the deadline the provider is legally working to, what they may charge you, and how to confirm the request actually landed.

  • Your HIPAA right of access — the 30-day rule and the single permitted extension
  • What a release form must include to avoid being rejected
  • Fee limits and how to ask for an itemised breakdown

Table of Contents

Your right to your own records

Under the HIPAA right of access, you can inspect or obtain a copy of the health information a covered entity holds about you — medical and billing records, enrollment and claims files, and other records used to make decisions about you. You can also direct that a copy be sent to a person or app you choose.

The deadline is specific. A covered entity must respond within 30 calendar days of receiving the request. If it cannot, it may take one extension of up to 30 additional days — but it must notify you in writing within the original 30 days, explain the delay, and give a date. Only one extension is permitted.

That deadline is why your transmission confirmation matters. The clock starts when they receive the request, and your fax confirmation is what establishes that date.

What the release form must contain

Most rejections are paperwork problems, not disputes. A complete authorization includes:

  • Patient identification — full name and date of birth, plus a patient ID or medical record number if you have one.
  • The provider holding the records — full name and address of the practice, hospital, or facility.
  • What you want — the specific records and the date range. You can request everything, but naming what you actually need usually gets a faster response than a request for a complete file spanning decades.
  • Where to send it — the destination fax number, address, or portal, and confirmation that the receiving line is under your control.
  • A handwritten signature and date. An unsigned form cannot be processed, and this is the single most common reason a request stalls.

If you are requesting records on behalf of someone else — a parent for a minor, an executor, a person with power of attorney — include documentation of that authority. Records departments will not release without it.

How to fax the request, step by step

  1. Call first and confirm the fax number. Records departments frequently have a separate line from the main office number listed on a website. A wrong number here means a document containing health information arrives somewhere it should not.

  2. Fill in the authorization completely. Blank fields become follow-up calls, and each round trip costs days.

  3. Sign and date by hand. Fax transmission is black and white at low resolution; sign in dark ink so the signature survives.

  4. Scan cleanly. Even lighting, no shadows, and black-and-white mode if the original is already a photocopy. If you cannot read it comfortably on your screen, the recipient will receive a worse version.

  5. Send the fax and save the confirmation. If you do not have a fax machine, sending it online produces the same transmission and records the delivery timestamp automatically — more useful than a printed slip you have to keep track of.

  6. Call again to confirm receipt. A brief call verifies the fax arrived legibly and confirms the request is in the queue. It is worth the two minutes.

What providers can charge

HIPAA permits a reasonable, cost-based fee for a copy of your health information. It may cover the labor of copying, supplies, and postage if the records are mailed — and that is the extent of it.

You are entitled to ask for a breakdown. If you request an itemisation of the labor, supplies, and postage that make up the total, the provider should give you one. Fees that look like a flat administrative charge unconnected to actual copying costs are worth questioning.

Faxing records and HIPAA safeguards

Fax remains one of the most heavily used channels in US healthcare, which is why nearly every records department still accepts it. The compliance question is not whether fax is allowed but whether reasonable safeguards are in place.

Practically, that means:

  • Verify the destination number before sending, ideally by phone.
  • Make sure the receiving line is controlled by the intended recipient. A fax to a shared machine in an open office area is a disclosure risk, which is why authorization forms often ask you to confirm you have sole control of your fax line.
  • Do not leave documents on a machine. With an online fax service this is moot — nothing prints on your end.
  • Keep your copy secure. The records you receive are yours to protect too.

When the records don't arrive

If the 30 days pass with no records and no written extension notice, you have a few escalating options.

Start by calling the records department with your fax confirmation date in hand — most delays are administrative and resolve with a phone call. If that fails, ask to speak with the practice's privacy officer, who is responsible for right-of-access compliance and generally knows the deadline is not optional.

If it still goes nowhere, the HHS Office for Civil Rights accepts complaints about right-of-access violations, and it has imposed financial penalties on providers who failed to give patients timely access to their records.

Getting your medical records by fax comes down to three things: a complete and hand-signed authorization, a fax number confirmed by phone, and a saved transmission confirmation that proves when the 30-day clock started. Sending the request online costs $2.99 with no subscription and puts the delivery timestamp in your records automatically.

For related procedures, see faxing a prior authorization and the general guide to sending a fax online.

Fax your records request →

Frequently asked questions

How long does a provider have to send my medical records?

Under the HIPAA right of access, a covered entity must respond within 30 calendar days of receiving your request. One extension of up to 30 additional days is allowed, but the provider must tell you in writing within the first 30 days why it is delayed and when the records will arrive.

Can a doctor's office charge me for my medical records?

Yes, but only a reasonable, cost-based fee. It may cover the labor of copying, supplies, and postage if mailed. You can ask for an itemised breakdown of labor, supplies, and postage, and the provider should give you one.

Is faxing medical records HIPAA compliant?

Fax is an accepted channel for protected health information and is used heavily across US healthcare. The compliance obligations concern reasonable safeguards: confirm the destination number before sending, make sure the receiving line is controlled by the intended recipient, and do not leave documents unattended on a shared machine.

What has to be on a medical records release form?

The patient's full name and date of birth, a patient or medical record number if known, the provider holding the records, a description of the records and the date range requested, where the records should be sent, and the patient's handwritten signature and date.

How do I prove I sent the request?

Keep the fax transmission confirmation, which records that the receiving fax machine accepted the pages and when. Combined with a copy of the signed form, it establishes both what you asked for and the date the 30-day clock started.

Sources