How Long Does It Take to Get Medical Records?

"How long does it take to get medical records" has an unsatisfying honest answer: between one week and six months, and which end you land on depends less on the provider than on how you work the request.

The deadline most people are counting on does not apply to them. That is worth establishing before the timelines make sense.

TL;DR

• The 30-day HIPAA deadline nearly every guide cites governs patients requesting their own records, under 45 CFR § 164.524. Third-party requests under a § 164.508 authorization — what carriers, TPAs, and law firms actually send — carry no federal response deadline at all.
• Typical turnaround runs 7–14 days at a small practice, 30–60 days at a hospital system, and 60–90+ days at a large integrated system. Behavioral health and substance-use records run longest.
• Some states set their own deadlines, commonly 15 to 30 days. Whether a given state's deadline reaches a third-party request rather than only a patient request varies by statute, so it is worth checking rather than assuming.
• Follow-up cadence is the single largest variable you control. Queue position at a busy records department is substantially a function of who is asking, and how often.
• Partial records are the expensive failure. A request that returns 60% of a chart and closes costs more downstream than one that took three weeks longer and returned everything.

The Short Answer, by Provider Type

These are working ranges for a complete, correctly authorized third-party request with routine follow-up. Add time for anything unusual.

Six months at a large integrated system is not a horror story. It is a normal outcome when nobody chases the request.

Why the 30-Day Rule Doesn't Apply to Your Request

This is where most guidance on the topic is confidently wrong, and it changes how you should plan.

The widely repeated rule is that HIPAA gives a provider 30 days, extendable once by 30 more. That rule is real and it lives at 45 CFR § 164.524. But it governs an individual's right of access to their own records. It is a patient-protection provision.

The requests carriers, TPAs, and law firms send are third-party disclosures made under a signed authorization at 45 CFR § 164.508. That section specifies what a valid authorization must contain — six required elements — and says nothing whatsoever about how quickly the provider must act. The authorization carries an expiration date. It does not carry a turnaround obligation.

So the honest answer is that there is no federal clock on your request. A custodian who takes ten weeks has not violated HIPAA.

There is a second consequence worth knowing, because it lands on the invoice rather than the calendar. In Ciox Health, LLC v. Azar, 435 F. Supp. 3d 30 (D.D.C. 2020), the court held that the fee limitation at § 164.524(c)(4) — including the flat-fee option for electronic copies — applies only to an individual requesting their own records, not to requests directing records to a third party. The same provision that gives patients a deadline also gives them a price cap, and third-party requesters get neither.

State Deadlines: the Only Clock That Might Bind

Where a real deadline exists, it comes from state law.

Most states that address records release at all set something in the range of 15 to 30 days. Texas, for example, requires hospitals to furnish records within 15 days of a written request under Health & Safety Code § 241.154. Several states set similar windows for physicians and facilities separately.

The wrinkle is scope. Some state statutes are written broadly enough to cover a request made by someone the patient has authorized; others mirror the federal framing and speak only to the patient's own access. Two states with the same 15-day number can therefore give you very different leverage. Before you rely on a state deadline in a follow-up call, confirm that the statute actually reaches an authorization-based third-party request in that state, and confirm it with counsel rather than a summary table.

Where a binding state deadline does exist, citing it by section number in your follow-up is disproportionately effective. It moves the conversation from a favor to an obligation.

The Seven Reasons a Request Stalls

In practice, delay is rarely one big blocker. It is an accumulation of small ones.

1. The authorization is defective. A missing signature, an expired date, a description of records too vague to act on, or the wrong entity named as discloser. Custodians reject on any of these — often after the form has sat for two or three weeks first, so the clock restarts having already burned a month.

2. It went to the wrong custodian. The practice was acquired, the physician retired, the records moved to a successor entity, or release of information is handled by an outsourced vendor with its own intake process. The request is not late; it is nowhere.

3. The scope is too broad. "All records" against a fifteen-year treatment history triggers manual review and a much longer queue than a date-bounded request for the relevant episode of care.

4. It's sitting in an outsourced ROI queue. Many hospital systems hand release of information to a third party. That adds a hop, and the vendor's SLA is with the hospital, not with you.

5. Nobody followed up. The most common reason, and the one covered below.

6. Part 2 records are mixed in. Substance-use disorder records under 42 CFR Part 2 require their own consent language. When those records sit inside a general chart, the whole request can stall behind a compliance review.

7. The fee wasn't resolved. Since Ciox, third-party requesters have no federal cap, and some custodians will not begin work until an invoice is approved. A request awaiting payment approval looks identical to a request in a queue.

Why Follow-Up Cadence Is the Whole Game

Here is the mechanism most timeline advice misses.

A hospital HIM department is a queue with a human deciding what to work next. Queue position is not purely first-in-first-out — it is substantially a function of who is asking, and how recently. A request that gets one call every two weeks sits behind every request that gets one every other day. Not because anyone is being unfair, but because the clerk works from the top of their attention, and attention is what a follow-up buys.

The arithmetic is unforgiving. On a 60-day nominal turnaround at a hospital system:

• Every-other-day contact keeps the request visible through roughly 20 touches and usually lands well inside the nominal window.
• Weekly contact produces about 8 touches over the same period and typically lands at or past the nominal window.
• Fortnightly contact produces 4, and is how a 60-day request becomes a 120-day request.

The follow-up also has to be varied rather than repeated. A third voicemail on the same unanswered line is the same effort three times, not escalation. Moving to fax, then to a named individual, then to the ROI vendor directly, is what changes the outcome.

This is the part that does not scale with headcount. A coordinator carrying 60 open requests cannot make 20 touches on each of them per month. That ceiling, rather than provider behavior, is what sets most organizations' real turnaround.

What Partial Records Cost You Downstream

The worst outcome is not a slow request. It is a fast one that returns 60% of the chart and gets marked complete.

A partial production usually means the custodian interpreted your scope narrowly, or pulled from one location of a multi-site system, or omitted records held under separate consent. The gap surfaces later — at deposition, at a reserve review, at an IME where the physician notices a referenced visit with no accompanying note.

By then the cost is not another three weeks. It is a re-request from a cold start, a decision already made on incomplete information, and in litigation the disadvantage of discovering a gap after the other side did. Reviewing a production against the treatment timeline before closing the request is cheaper than any of that.

How to Compress the Timeline

Ordered by how much time each one actually saves.

1. Verify the custodian before sending. Confirm the entity still exists, still holds the records, and handles release in-house or through a named vendor. This single step removes the most expensive failure mode, which is weeks spent waiting on a request that was never going to be answered.
2. Bound the scope. Name the date range and the record types. A narrow request skips manual review and lands in a faster queue.
3. Pre-clear the authorization. Check all six § 164.508 elements before it goes out. A rejected form costs a full cycle.
4. Send on every available channel at once. Fax, portal, and mail on day one rather than escalating one at a time — you do not know in advance which channel that custodian actually monitors.
5. Set the cadence at every other day, not weekly. And vary the channel each time.
6. Resolve the fee up front. Ask what it will cost and get approval before the invoice becomes the blocker.
7. Cite the state deadline where one genuinely binds. By section number.

How Superunit Compresses Records Retrieval

The bottleneck in retrieval is not knowing what to do. It is that following up every other day, across multiple channels, on every open request at once, is more contact than a human team can sustain — so cadence degrades to whatever is left after the day's escalations.

Superunit's AI agents run that cadence as the default. Each request goes out across phone, fax, and email simultaneously rather than escalating one channel at a time, and the follow-up sequence continues on schedule without competing for a coordinator's attention. A caseload of 200 open requests receives the same cadence as a caseload of 20, because the capacity is not tied to headcount.

Two things follow from that, and both are about the ceiling rather than the average. Volume spikes stop pushing turnaround out, because a surge does not queue behind whoever is available. And the custodian-verification step in front of the request actually happens on every file, rather than only on the ones somebody had time for.

What Superunit's Request Log Records

Every attempt is recorded with the same fields a defensible file needs: date, time, channel, who was reached, what they said, and a terminal disposition — produced, partial, refused, no record, or unreachable after documented attempts.

That log matters in two specific moments. When a timeline gets questioned, "the custodian took eleven weeks" is an assertion and a dated log across four channels is evidence. And when a production comes back partial, the record of what was requested versus what arrived is what supports a re-request rather than an argument.

For the wider picture of how retrieval fits alongside canvassing and an IME, see our guide to medical records retrieval, and when to order a canvass versus retrieval versus an IME.

Frequently Asked Questions

Does HIPAA require providers to release records within 30 days? For a patient requesting their own records, yes — 45 CFR § 164.524 sets 30 days with one 30-day extension. For a third-party request under a § 164.508 authorization, no. There is no federal deadline for those at all.

What is the fastest realistic turnaround? Seven to ten days from a small practice that handles records in-house, when the authorization is clean and someone follows up. Anything faster usually means the records were already digitized and the custodian answered a phone call.

Why do Kaiser and similar systems take so long? High request volume, a strict centralized process, and no expediting path for third-party requesters. Large integrated systems routinely run 60 to 90 days or more, and persistent follow-up compresses that less than it does at a mid-sized hospital.

Can I subpoena records to make it faster? Sometimes, and not always. A subpoena creates a legal obligation with a return date, which helps in litigation. But many custodians require a judge's signature, and § 164.512(e) imposes its own conditions before a provider may release on a subpoena. It is a different path, not automatically a faster one.

What do I do when a provider simply doesn't respond? Escalate through channels rather than repeating one, identify a named individual in the HIM department or the ROI vendor, and document every attempt with date and channel. Where a state deadline binds, cite it by section. A documented good-faith sequence is also what protects the file if the records never arrive.

Does a records request expire? The authorization does. Every § 164.508 authorization carries an expiration date or triggering event, and a custodian will reject one that has lapsed. On a long-running request this is a real risk, so track the expiration alongside the follow-up cadence.

Is it faster to request records electronically? Usually yes, where the custodian offers a portal — but only for transmission. It does not move you up the queue, and some systems still print, review, and rescan, which removes the advantage entirely.

The Timeline Is Mostly Yours

The provider type sets a range. Where you land inside that range is decided by three things you control: whether the request reached the right custodian, whether the authorization was clean, and how often somebody followed up.

None of those are legal questions, which is fortunate, because the law is not going to help — a third-party request has no federal deadline and no fee cap. What it has is a queue, and a queue responds to attention.

If chasing custodians is consuming your claims or paralegal team, see how Superunit handles records retrieval outreach.