Research
What happens to your records when a seller disappears
The federal right to a copy of your health information runs against a specific kind of organization, covers a specific set of documents, and lasts exactly as long as those documents are kept.
The right is not against everyone who sold you something
People describe the federal health privacy rules as if they follow health information around like a label. They do not. They attach to particular organizations.
The rules define a covered entity as one of three things: a health plan, a health care clearinghouse, or a health care provider who transmits health information electronically in connection with a covered transaction.
The definition of a health care provider is broader than the word suggests. It reaches a provider of services, a provider of medical or health services, and any other person or organization who furnishes, bills, or is paid for health care in the normal course of business.
A clinical practice sits comfortably inside that. So does a pharmacy. A business that sells a labeled vial with no clinician anywhere in the transaction is not furnishing health care, and the right described below is not the right that governs what it holds about you.
Which of those you bought from is therefore the first question, not a detail. It determines whether the paragraphs that follow apply at all.
What the right actually is
The rule gives an individual a right of access to inspect and obtain a copy of protected health information about them in a designated record set.
A designated record set is the collection the organization uses to make decisions about you, which in practice means the intake answers, the clinical notes, the orders written, the results received and the billing records.
Two categories are carved out. Psychotherapy notes, and information compiled in reasonable anticipation of a legal proceeding.
Everything else in that set is reachable, and the rule attaches an important qualifier to the whole right: it lasts for as long as the information is maintained in the designated record set.
That clause is the hinge of this entire article, and it comes back at the end.
The clock, the format and the bill
The rule is unusually concrete about the mechanics, which makes it easy to check whether a company is following it.
On timing, the organization must act on a request no later than thirty days after receiving it. It may extend once, by no more than thirty days, and only if it gives you a written statement of the reasons for the delay and the date it will complete.
One extension. Not a series of them.
On format, it must provide the information in the form and format you requested if that is readily producible. Where records are kept electronically and you ask for an electronic copy, it must give you the electronic form you asked for if readily producible, and otherwise a readable electronic form you both agree on.
On cost, it may impose a reasonable, cost-based fee, and the rule lists what that fee may include. Labor for copying. Supplies for a paper copy or for portable media. Postage, if you asked for it to be mailed. And preparing a summary or explanation, if you agreed to one.
Read that list for what it leaves out rather than what it contains. It is a short, closed list of cost categories, not an invitation to price a records request however anyone likes.
You can point the copy at someone else
A feature people miss: the rule contemplates you directing the copy to a third party rather than to yourself.
The request has to be in writing, signed by you, and it has to clearly identify the designated person and where to send the copy.
That is the mechanism for handing a complete file to a new clinician without becoming the courier yourself.
It is also the mechanism that is most useful in exactly the situation this article is about, when one relationship is ending and another is starting.
A refusal has a shape
Access can be denied, and the rule sorts the grounds into two piles.
One pile is unreviewable. It covers the carved-out categories, certain correctional situations, and research a person agreed to be blinded from while it runs. It also covers some records under a separate federal privacy statute, and information obtained from a non-provider under a promise of confidentiality.
The other pile is reviewable, and it turns on professional judgment about danger to a person. A licensed health care professional has to make that determination.
When access is denied on a reviewable ground, you have the right to have the denial reviewed by a licensed health care professional the organization designates, who did not take part in the original decision.
A denial also has to be in writing, and the organization has to give you access to the parts it does not have a ground to withhold.
None of that tells you whether a particular refusal was correct. It tells you what a properly conducted refusal looks like, which is enough to notice one that has no shape at all.
The six-year rule is not about your chart
A six-year retention period appears constantly in discussions of health records, and it is routinely attached to the wrong documents.
The provision says a covered entity must retain the documentation required by a particular paragraph for six years from creation or from the date it was last in effect, whichever is later.
That paragraph is about the organization's own compliance paperwork. Its policies and procedures. Communications the rules require to be in writing. Records of actions, activities and designations the rules require to be documented.
It is not a rule about how long your medical record is kept. Medical record retention is a matter of state law, and it varies by state and by the kind of practitioner.
The distinction matters here more than usual. If you assume a federal rule is preserving your chart for six years, you will not go and get a copy while getting one is easy.
Two holders, two requests
In a compounded-medication purchase there are usually at least two organizations holding records about you, and they are not interchangeable.
The clinical side holds the intake, the clinician review, any results and the order that was written. The dispensing pharmacy holds its own record of what it actually filled and when.
Each is a separate holder. A request to one is not a request to the other, and the pharmacy's record is the one that answers the question of what you actually received.
This is one of the more practical reasons a seller that names its dispensing pharmacy has given you something a seller that does not has withheld. You cannot direct a request at an organization you cannot name.
And then the business stops existing
Return to the qualifier from earlier. The right runs for as long as the information is maintained in the designated record set.
The right, in other words, is a right against a maintained record. It is not a guarantee that the record will be maintained. And it is not a rule about what happens when an organization winds down.
What does happen on a closure is governed by other law, including state pharmacy and medical record rules and whatever arrangements a business makes for its files. This site has not surveyed those, and the honest answer is that they vary.
The reliable observation is about sequence rather than law. The right is easiest to use while the organization is operating, staffed and answering mail.
Which turns a legal question into a scheduling one. The records request that is trivially easy today is the one that becomes a research project the month a company goes quiet.
What to establish before you need it
A handful of things are checkable at signup and nearly impossible to reconstruct afterward.
Is there a named clinical entity, and is there a documented way to request records from it? Is the dispensing pharmacy named, so a second request has an address?
Does the seller publish a privacy notice that identifies it as the kind of organization the health privacy rules cover, or does it describe itself only as a retailer?
If it is the second, the questions in this article mostly do not apply to it, and what it holds about you is governed by its own policy and by other law. That is not a scandal. It is a materially different arrangement, and worth knowing you are in.
Key takeaways
- The federal right of access runs against covered entities, not against every business that sold you something.
- It covers the designated record set, minus psychotherapy notes and material compiled for litigation.
- An organization must act within thirty days and may take only one extension of up to thirty more.
- The permitted fee is a closed list: copying labor, supplies, postage and an agreed summary.
- A copy can be directed to a third party on a written, signed request naming the recipient.
- The six-year retention rule covers compliance documentation, not your medical record.
- The right lasts only for as long as the record is maintained, which makes it a scheduling problem as much as a legal one.
Frequently asked questions
Do the federal health privacy rules cover every company that sells medication online?
No. They attach to covered entities, defined as a health plan, a health care clearinghouse, or a health care provider who transmits health information electronically in connection with a covered transaction. A health care provider is any person or organization that furnishes, bills or is paid for health care in the normal course of business. A clinical practice and a pharmacy sit inside that. A business selling a labeled vial with no clinician involved does not.
How long does a company have to respond to a records request?
It must act on the request no later than thirty days after receiving it. It may take one extension of no more than thirty days, and only if it provides a written statement of the reasons for the delay along with the date it will complete. The rule allows a single extension, not a series of them.
Can I be charged for a copy of my own records?
A reasonable, cost-based fee is allowed, and the rule closes the list of what it may include. Labor for copying the information. Supplies for a paper copy or for portable media, if you asked for that. Postage, if you asked for it to be mailed. And preparing a summary or explanation, if you agreed to one. The list is short and closed rather than illustrative.
Does the six-year rule mean my medical records are kept for six years?
No, and this is a common mix-up. The six-year provision covers the organization's own compliance documentation: its policies and procedures, communications the rules require in writing, and records of required actions and designations. Retention of the medical record itself is a matter of state law and varies by state and by practitioner type.
Can I have my records sent straight to a new clinician?
The rule contemplates it. You may direct that the copy go to a person you designate, provided the request is in writing, signed by you, and clearly identifies the designated person and where to send the copy. That is the cleanest route when one relationship is ending and another is beginning, because it avoids you having to act as the courier.
What happens to my records if the company shuts down?
The right of access runs for as long as the information is maintained in the designated record set. So it is a right against a maintained record, rather than a guarantee that the record will be maintained. What actually happens on a wind-down is governed by other law, including state medical and pharmacy record rules, and it varies. The practical consequence is about timing: a request is far easier while a business is operating.
Sources
Each document below is named as it names itself, with the date printed on that document rather than the day it was read.
- Title 45 Code of Federal Regulations section 164.524, Access of individuals to protected health information — Electronic Code of Federal Regulations, Office of the Federal Register, February 2014
- Title 45 Code of Federal Regulations section 160.103, Definitions, including covered entity and health care provider — Electronic Code of Federal Regulations, Office of the Federal Register, March 2026
- Title 45 Code of Federal Regulations section 164.530(j), Administrative requirements, documentation and retention period — Electronic Code of Federal Regulations, Office of the Federal Register, August 2009