How to Get Your Medical Records in Arizona

By Joe Styler, editor (not an attorney). Updated October 9, 2026. Sources checked

If you have questions about care you or a family member received, getting the medical records is a practical step you can take on your own. Arizona has a statute on who may ask, what a provider may charge and how long it has to respond. Federal HIPAA rules add their own, and this page keeps the two apart.

What counts as a medical record in Arizona

Arizona’s medical records law starts at A.R.S. 12-2291, and its definition is broad. “Medical records” means all communications related to a patient’s physical or mental health or condition that are recorded in any form or medium and kept for diagnosis or treatment.

X-rays and other diagnostic images are “source data” under the statute, and source data may be kept separately from the rest of the record, so ask for imaging by name.

Materials prepared for utilization review, peer review or quality assurance activities are not part of the “medical record” under this law. Medical and payment records are privileged and confidential, and a provider may disclose them only as the law allows or with written authorization (A.R.S. 12-2292).

Who can ask for the records

Under A.R.S. 12-2293, two people can make the request: the patient, or the patient’s health care decision maker. A health care decision maker is someone authorized to make health care treatment decisions for the patient, including a parent of a minor. The request can cover both the medical records and the payment records.

If the patient has died

A.R.S. 12-2294(D) says a provider “may” disclose a deceased patient’s records to the health care decision maker the patient had at the time of death. It also may disclose them to the personal representative or administrator of the estate. If no personal representative or administrator has been appointed, the statute lists people in this order of priority:

1. the spouse, unless the two were legally separated
2. the acting trustee of the patient’s revocable trust
3. an adult child
4. a parent
5. an adult brother or sister
6. a guardian or conservator

The word is “may”, not “must”: the law allows release to these people but does not require it. Release to family can also be blocked if the patient, while alive, or a person higher on the list told the provider in writing that the patient opposed release.

How to ask: a written request, step by step

Arizona’s statute is built around a written request (A.R.S. 12-2293(A)). HIPAA also lets a covered provider require requests in writing, as long as it tells people about that requirement (45 CFR 164.524(b)(1)).

1. List every place that treated the patient for this care, such as offices, hospitals, labs and imaging centers, and send each its own request.
2. Say who you are: the patient, or the health care decision maker and on what basis. For a deceased patient, say whether you are the personal representative or which family member.
3. Say what you want: access, copies, or both, of the medical records and the payment records, for the dates of care that matter. Name any imaging you want.
4. Say what form you want. Under HIPAA, a covered provider must give access in the form and format you ask for if the records are readily producible that way, and records kept electronically that you ask for electronically must be provided in an electronic form (45 CFR 164.524(c)(2)).
5. Keep a copy of the request and write down the date you sent it.

What the provider may charge

Arizona’s statute does not set a dollar or per-page amount. A.R.S. 12-2295(A) allows a “reasonable fee” for reproducing the records. The provider may require payment in advance, except as necessary for continuity of care.

Some copies must be free. The statute bars a charge for the pertinent information in records given to the patient for the demonstrated purpose of obtaining health care, or to the patient or the patient’s legal representative for appealing a denial of benefits under the Social Security Act. Requests made for a lawsuit are not among the purposes listed.

For a patient’s own request, HIPAA allows only a reasonable, cost-based fee covering the labor for copying, supplies, postage, and preparing an explanation or summary if you agree to one (45 CFR 164.524(c)(4)). This page does not cover fees for requests sent by a lawyer or another third party.

How long the provider has to respond

Two different laws set response times, and they do not combine into one number. Start with Arizona. Subsection (A) of A.R.S. 12-2293 says the provider must respond “promptly and within not more than seven business days.” Subsection (E) then opens with “Notwithstanding any other provision of this section” and sets its own time frames. For any purpose other than upcoming medical treatment, including litigation and deceased-patient requests, the time is thirty calendar days. So Arizona law gives providers up to 30 calendar days to respond to requests made for litigation or for a deceased patient’s records. Do not plan on seven business days.

For upcoming medical treatment, subsection (E) sets shorter times of ten or fifteen business days, depending on the age of the records, when they are in the provider’s current electronic health record system. It does not require a provider to create or compile records that do not already exist (12-2293(F)).

HIPAA is a separate federal rule. A covered entity must act on an access request no later than 30 days after receiving it. It may take one extension of no more than 30 days, and only if it gives you a written statement of the reasons for the delay and the date it will finish (45 CFR 164.524(b)(2)).

Do the records you already have raise questions about the care? Request a free case review.

When a provider can say no

Arizona allows a denial only on narrow grounds. Some require a health professional’s determination, such as a finding that access is reasonably likely to endanger the life or physical safety of the patient or another person (A.R.S. 12-2293(B)). Others cover information from clinical research, where the patient agreed to the denial when consenting to the research, and inmates in correctional institutions (12-2293(C)).

The provider must give a written explanation of the reason, and it must still release the parts of the record it has no basis to withhold (12-2293(D)). HIPAA likewise requires a timely, written denial and, to the extent possible, access to the rest (45 CFR 164.524(d)).

How long providers keep records

A.R.S. 12-2297 sets minimum periods. For an adult, records must be kept for at least six years after the last date the patient received care from that provider. For a child, the period is at least three years after the eighteenth birthday or at least six years after the last care, whichever date occurs later. Source data such as images must be kept six years from the date it was collected. A provider who retires or sells a practice must take reasonable measures to make sure records are kept for the required period. If the care was years ago, ask anyway.

How records come up later in a lawsuit

If a malpractice lawsuit is filed, Rule 26.3 of the Arizona Rules of Civil Procedure requires the plaintiff, within 5 days after a defendant answers or files a motion responding to the complaint, to serve that defendant with the plaintiff’s available relevant medical records and a medical records authorization. Within 10 days after that, each defendant must serve the relevant records it has on the plaintiff and all other parties. Our page on how a medical malpractice claim works in Arizona covers the other steps, including the expert affidavit Arizona requires when expert testimony is needed.

A records request goes to a provider. It is not a notice of claim and it is not a lawsuit. Arizona’s general deadline for a malpractice lawsuit is two years after the cause of action accrues (A.R.S. 12-542). A claim against a public entity, public school or public employee needs a notice of claim within 180 days after the cause of action accrues (A.R.S. 12-821.01). Our page on Arizona medical malpractice deadlines explains these clocks. If records are slow to arrive, ask a lawyer about your dates anyway. Sending our form does not stop or pause any deadline. If your concern is mainly a doctor’s conduct, see our page on a Medical Board complaint versus a lawsuit.

Frequently asked questions

How long does a provider in Arizona have to send medical records?

Two separate rules apply. Arizona law gives providers up to 30 calendar days to respond to requests made for litigation or for a deceased patient’s records (A.R.S. 12-2293(E)), even though subsection (A) says seven business days. HIPAA separately requires a covered entity to act within 30 days, with one extension of up to 30 more if it explains the delay in writing.

Can a provider charge me for copies of my records?

Yes, within limits. A.R.S. 12-2295 allows a reasonable fee and sets no dollar amount, but bars a charge for pertinent records given to the patient to obtain health care or for appealing a denial of Social Security benefits. For a patient’s own request, HIPAA limits the fee to a reasonable, cost-based amount.

Can family members get a deceased patient’s medical records?

Arizona law allows it but does not require it. A.R.S. 12-2294 says a provider may release a deceased patient’s records to the personal representative or administrator of the estate or, if none has been appointed, to family members in a set order of priority, starting with the spouse. A written objection by the patient during life, or by a person higher in the order, can block release.

Can a provider refuse to give me my records?

Only on narrow grounds, such as a health professional’s finding that access is reasonably likely to endanger someone’s life or physical safety. A.R.S. 12-2293 then requires a written explanation and release of the parts there is no basis to withhold.