Your Medical Records Rights: HIPAA, MIC3 & Military Law
Understanding your legal rights to access, control, and protect your military family's medical records
Last Updated: January 11, 2026 • 10 min read
Your Legal Rights at a Glance
- ✅ HIPAA: Right to your records within 30 days, nationwide
- ✅ MIC3: Easier record sharing between states for military families
- ✅ MSRRA: Special protections for service members' legal documents
- ✅ No unpaid bills barrier: Providers cannot withhold records due to unpaid bills
- ✅ Reasonable fees only: Typically $0.50-$1/page or $6.50 electronic
HIPAA: Your Foundation Rights
HIPAA (Health Insurance Portability and Accountability Act) is the primary federal law protecting your medical records rights. It applies to all healthcare providers nationwide - military, civilian, public, private.
Right of Access (45 CFR § 164.524)
What it means: You have the right to inspect and obtain copies of your medical records.
- Timeline: Providers must respond within 30 days (can extend once for another 30 days with written notice)
- Format: You can request paper copies, electronic files, or specific format
- Fees: Reasonable, cost-based fees only (copying, postage, labor)
- No denial based on unpaid bills: Providers cannot withhold records because you owe money
Right to Direct Records to Third Parties
You can request records be sent directly to another person or organization (new doctor, school, EFMP office, etc.) at no charge to you. Saves you from being the middleman.
Right to Amend Records
If you believe information in your record is incorrect or incomplete, you can request an amendment. Provider doesn't have to agree, but must add your statement to the record.
Military-Specific Protections: MIC3 & MSRRA
MIC3 (Military Interstate Children's Compact) - Article IV
What it is: Interstate compact adopted by all 50 states ensuring military children's educational and medical records transfer seamlessly between states.
For medical records: Schools in member states must accept immunization and health records from your previous state without requiring re-testing or additional documentation, even if formats differ.
Practical Impact:
- Schools cannot require "state-specific" shot record forms - must accept official records from previous state
- Cannot force re-vaccinations if records show compliance with previous state's requirements
- Must give reasonable time (30 days) to obtain records from previous providers
MSRRA (Military Spouses Residency Relief Act)
What it is: Federal law allowing military spouses to maintain legal residency in home state despite PCS moves.
For medical records: When requesting records or signing power of attorney documents, you can use your home state residency even if you live elsewhere. Providers must honor POA documents from your home state.
The 30-Day Federal Requirement
Federal law is clear:
Healthcare providers must provide you with your medical records (or send to designated recipient) within 30 days of your request. They can extend once for an additional 30 days, but must notify you in writing of the delay and reason.
Citation: 45 CFR § 164.524(b)(2)
What Starts the Clock
The 30-day countdown begins when the provider receives your written request (DD Form 2870, state form, or written letter). Use certified mail to prove delivery date.
What "Provide Records" Means
Within 30 days, provider must either: (1) give you the records, (2) mail them to you, or (3) inform you of denial with specific legal reason. "We're busy" or "processing takes 60 days" are NOT valid reasons.
What Providers Can Charge
HIPAA allows providers to charge reasonable, cost-based fees. Specific amounts vary by state law, but federal guidelines cap fees:
| Fee Type | Typical Range |
|---|---|
| Per-page copying | $0.50 - $1.00 per page |
| Electronic records (CD/USB/email) | $6.50 flat fee |
| Labor (searching/retrieving) | $25-50 (only for large/complex requests) |
| Postage | Actual cost (usually $5-15) |
| Preparing summary | Not allowed - you have right to full records |
Prohibited Fees
Providers cannot charge for: searching for records, retrieving records from storage, or withholding records due to unpaid medical bills. If charged excessive fees, you can file a HIPAA complaint.
Power of Attorney for Medical Records
When You Need POA
- Spouse's records: You cannot automatically access your spouse's records (even if sponsor). Need POA or written authorization.
- Adult children: Once dependents turn 18, parents lose automatic access. Adult child must sign authorization.
- During deployment: Sponsor can grant POA to spouse to manage family's medical affairs
- Elderly parents: If caring for elderly parents, POA allows you to manage their medical records/care
Types of Medical POA
General Medical Power of Attorney
Broad authority to make all healthcare decisions and access records. Typically used during deployments.
Limited Authorization (HIPAA Release)
Specific permission to access records only, no decision-making authority. Common for spouse accessing spouse's records.
Military Legal Assistance Offices
Most military installations have free legal assistance offices that can help service members and families draft POA documents. Call JAG office at your base for appointment. Bring IDs for all parties.
Accessing Your Children's Records
Under Age 18
Parents/legal guardians have automatic right to access minor children's medical records. No special authorization needed. Either parent can request (unless court order restricts access).
Sensitive Services (Varies by State)
Some states allow minors to consent to certain services without parental knowledge:
- Mental health counseling (typically age 12+)
- Substance abuse treatment
- Sexual health services
For these services, parents may need minor's written permission to access records. State laws vary widely.
Age 18+
Once your child turns 18, you lose automatic access even if they're still your dependent. They must sign HIPAA authorization for you to access their records or discuss care with providers.
Pro Tip for Military Families:
Have your 18+ dependent sign a standing HIPAA authorization when they enroll in college or before a deployment. Makes PCS moves and medical emergencies much easier.
What to Do If Denied Access
Valid Reasons for Denial (Rare)
Providers can only deny access in specific circumstances:
- Psychotherapy notes (therapist's personal notes, separate from treatment records)
- Information compiled in anticipation of legal proceedings
- Laboratory results subject to CLIA (if law prohibits direct patient access)
- Inmate records if facility determines access would endanger safety
- Research records while study is in progress (if you agreed to temporary suspension)
Note: Regular medical records, lab results, visit notes, prescriptions, etc. CANNOT be withheld.
Steps If Your Request Is Denied or Ignored
Request Written Denial
If denied, provider must give you written explanation citing specific legal reason (45 CFR § 164.524(a)(4)). If they refuse to provide written denial, that itself is a HIPAA violation.
Request Review (If Denial Is Reviewable)
For certain denials, you can request a review by another licensed healthcare provider. Provider must inform you if this applies to your case.
File HIPAA Complaint
If provider ignores your request, denies without valid reason, or charges excessive fees, file complaint with:
HHS Office for Civil Rights
Online: hhs.gov/hipaa/filing-a-complaint
Phone: 1-800-368-1019
Mail: Regional OCR office
Deadline: File within 180 days of when you knew about violation (can extend if good reason)
Contact State Medical Board
Report provider to their state licensing board for non-compliance with medical records laws. This can result in board review and potential disciplinary action.
Military-Specific: Contact TRICARE or Base Legal
If provider accepts TRICARE, file complaint with TRICARE regional contractor. For MTF denials, contact base patient advocate or legal assistance office.
Military Treatment Facilities: Special Considerations
MTFs Are Subject to HIPAA
Military hospitals and clinics must comply with HIPAA just like civilian providers. Same 30-day rule, same fee limits, same access rights.
Command Access to Active Duty Records
Special rule for active duty service members only: Command has limited access to medical information necessary for:
- Fitness for duty determinations
- Deployment medical clearance
- Line of duty investigations
This does NOT apply to family members. Spouses and dependents have full HIPAA privacy protections - commands cannot access their records.
MHS Genesis Makes It Easier
MTF records since Genesis rollout are easily accessible via patient portal (mhsgenesis.health.mil). See our MHS Genesis Guide for step-by-step instructions.
CarryForward Protects Your Rights
Knowing your rights is step one. CarryForward helps you exercise them:
- Track the 30-day clock - Automatic reminders to follow up on overdue requests
- Generate compliant requests - Pre-filled DD Form 2870 with all required elements
- Document denials - Built-in templates for follow-up letters and HIPAA complaints
- Fee transparency - Flag excessive fees and generate dispute letters
Common Questions
Can my spouse access my medical records?
No, not automatically. You must sign a HIPAA authorization or grant power of attorney for your spouse to access your records, even if you're married.
What if I find errors in my records?
Request an amendment in writing. Provider must either correct it or add your statement of disagreement to your record. They cannot simply ignore your request.
Do HIPAA rights apply overseas?
HIPAA only applies to US-based providers and MTFs. Overseas civilian providers may have different rules. However, overseas MTFs (US military facilities) must still comply with HIPAA.
Can I refuse to let my provider share my information?
You can restrict certain disclosures, but providers may deny treatment if they can't share necessary information for your care. You cannot restrict disclosures required by law (public health reporting, court orders, etc.).