Medical records requests in California: what providers must give you and when

Published October 9, 2026

This is general information for law firm staff, not legal advice.

Records requests go faster when you know which rule you are using. There are two main routes. In the first, the patient (your client) asks for their own records, or directs the provider to send them to you. In the second, the firm requests records using the client's signed authorization.

Each route has its own timing and fee rules. The responsible attorney decides which route the firm uses on each case.

Route 1, the patient’s own right of access: the federal rule

A covered entity must act on an access request no later than 30 days after receiving it. It may extend that once, by no more than 30 days, if within the first 30 days it gives the patient a written statement of the reasons and the date it will finish (45 CFR 164.524(b)(2)). It may require requests in writing if it tells patients so (paragraph (b)(1)). As of the eCFR text current through October 7, 2026, the period is still 30 days.

The fee for a copy must be reasonable and cost-based, and may include only labor for copying, supplies for portable media the patient asked for, postage the patient asked for, and preparing a summary the patient agreed to (45 CFR 164.524(c)(4)).

A patient may direct the provider to send the copy to someone else. The request must be in writing, signed, and clearly identify the person and where to send it (paragraph (c)(3)(ii)). Note the limits on this. HHS says a 2020 federal court order (Ciox Health v. Azar) vacated that directive except for electronic copies of an electronic health record. HHS also says the fee limit applies only to a patient's request for their own records, not to a request to send records to a third party (HHS notice). Expect a provider to treat a directive that names your firm differently from a request the client makes for themselves.

Route 1, the patient’s own right of access: the California rule

Under Health and Safety Code § 123110:

The patient may inspect records during business hours within five working days after the request (subd. (a)).
Paper or electronic copies must be transmitted within 15 days after the request (subd. (b)(1)), in the form and format requested if readily producible (subd. (b)(2)).
The fee may include only labor, supplies, postage and an agreed summary, and may not exceed 25 cents per page for paper copies or 50 cents per page for microfilm (subd. (j)).
A provider may not withhold records because of an unpaid medical bill (subd. (i)).
A free copy is available for some public benefit and immigration claims, but not for a patient whose private attorney is paying the costs of that claim (subd. (d)).
A provider may require reasonable verification of identity, but not to delay compliance (subd. (f)).

Route 2, the firm’s request with a signed authorization: Evidence Code § 1158

Before a lawsuit is filed or a defendant appears, an attorney or the attorney's representative may present a written authorization signed by the patient (or a guardian, conservator, parent of a minor, or personal representative or heir of a deceased patient). The provider must then promptly make all of the patient's records in its custody available for inspection and copying (Evid. Code § 1158, subd. (b)). The section covers listed licensed professionals, pharmacies and licensed hospitals (subd. (a)).

Timing. Failure to make the records available during business hours within five days after the authorization is presented may make the provider liable for reasonable expenses, including attorney's fees, of enforcing the section (subd. (d)).
Costs. Reasonable costs may be charged to the requesting attorney, including 10 cents per page for standard copies, 20 cents per page from microfilm, actual cost for oversize or special processing, clerical time at up to $16 per hour ($4 per quarter hour), actual postage, and actual third-party retrieval charges (subd. (e)). If the records are inspected or copied at the custodian's place of business, the fee may not exceed $15 plus third-party retrieval costs (subd. (f)).
Copy services. When the attorney uses a professional photocopier or registered representative, the provider does not do the copying (subd. (c)).
Electronic copies. Records kept electronically must be provided in the electronic form requested if readily producible (subd. (g)).
The statutory form. A provider must accept a valid, completed authorization printed in at least 14-point type and in substantially the form set out in the section (subd. (h)). That form notes that mental health records, alcohol or drug records and HIV test results are not disclosed unless specifically checked.

What a HIPAA authorization must contain

A valid authorization must be in plain language, and the patient gets a copy. It must also tell the patient about the right to revoke in writing, whether treatment can be conditioned on signing, and that information disclosed may be redisclosed and no longer protected (45 CFR 164.508(c)).

It needs at least these core elements:

Checklist

A specific and meaningful description of the information.
Who may make the disclosure.
Who may receive it.
Each purpose ("at the request of the individual" is enough when the patient starts it).
An expiration date or event.
The patient's signature and date, or a personal representative's signature with a description of their authority.

Substance use disorder program records (42 CFR Part 2)

Records from a federally assisted substance use disorder program need a Part 2 consent, which is stricter than a HIPAA authorization. Under 42 CFR 2.31 (amended February 16, 2024, 89 FR 12625, per the eCFR history note), the written consent may be paper or electronic and must include the patient's name; who may disclose; a specific description of the information; the recipients; each purpose; the right to revoke in writing and how; an expiration date or event; the signature (with the rules for minors and patients lacking capacity); and the date signed (paragraph (a)).

If a client was treated at a recovery center or detox program, tell the attorney before any request goes out.

Two points are important for a law firm:

A consent for use of records in a civil, criminal, administrative or legislative proceeding cannot be combined with a consent for any other purpose (paragraph (d)).
A program may not disclose on a consent that has expired, is known to be revoked, is materially false, or on its face substantially fails to meet paragraph (a) (paragraph (c)). SUD counseling notes need their own separate consent (paragraph (b)).

What a complete request contains

Have the responsible attorney approve the request form and the authorization before the first request goes out. Brennick drafts and tracks records requests to the providers named in the file and reads the production in the common file types it arrives in. A complete request has: