How to send medical records securely: a guide for patients

You have a PDF of your lab results, a stack of imaging reports or a discharge summary, and someone needs them: a new doctor, a specialist, an insurer, a school or a family member who helps with your care. This guide is for that moment, written for the patient, not the practice.

How to send medical records securely

The safest route is usually not to send them yourself. Ask your current provider to send the records directly to the new one, or download them from the patient portal and upload them to the new provider's portal. If you have to send them yourself, use end-to-end encrypted email, or a password-protected PDF with the password given by phone. Avoid plain email attachments, and send only the pages the recipient needs.

Does HIPAA apply when you send your own records?

No. This surprises many people. HIPAA's rules apply to specific organizations, not to patients. HHS says "The HIPAA Rules apply to covered entities and business associates," which means health care providers, health plans and health care clearinghouses, plus the companies working for them. "If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules" (HHS).

Two practical consequences follow:

You can't "violate HIPAA" by emailing your own records. You can share your own health information however you choose.
Once the records leave the provider, HIPAA no longer protects that copy. Protecting it is up to you and the tools you pick.

The same is true of most employers. HHS says the Privacy Rule "does not protect your employment records, even if the information in those records is health-related," and that "in most cases, the Privacy Rule does not apply to the actions of an employer" (HHS). A doctor's note you email to your manager is, legally, just an email.

Your right to get your records, including by email

Before you can send records, you need a copy. HIPAA gives you a strong right to one.

You can ask for the format you want. HHS tells patients: "In most cases, you can get a copy the way you want it, such as by e-mail" (HHS). If the records are kept electronically and you ask for an electronic copy, the provider must give it to you in the form you ask for "if it is readily producible in such form and format" (45 CFR 164.524). HHS adds that a provider with paper records that can readily scan them must do so (HHS FAQ).
There is a deadline. The regulation requires action "no later than 30 days after receipt of the request," with one extension of no more than 30 days if the provider gives you a written reason and a completion date within the first 30 days (45 CFR 164.524). HHS notes that providers can often do it "much sooner than that."
Fees are limited. A provider "may charge for the reasonable costs for copying and mailing the records" but "cannot charge you a fee for searching for or retrieving your records," and it "cannot deny you a copy of your records because you have not paid for the services you have received" (HHS).
A portal is often fastest. HHS says that if your doctor offers a web portal, "you may be able to easily view and download your health information whenever you want."

There are a few exceptions, such as a mental health professional's separate psychotherapy notes, which HHS says you do not have a right to access.

Can your doctor email you your records unencrypted?

Yes, if you ask for it. When HHS updated the HIPAA rules in 2013, it addressed this directly: "covered entities are permitted to send individuals unencrypted emails if they have advised the individual of the risk, and the individual still prefers the unencrypted email." It continued: "If individuals are notified of the risks and still prefer unencrypted email, the individual has the right to receive protected health information in that way, and covered entities are not responsible for unauthorized access of protected health information while in transmission to the individual based on the individual's request. Further, covered entities are not responsible for safeguarding information once delivered to the individual" (Federal Register, 78 FR 5566).

Read that last sentence again. Once your records arrive in your inbox, keeping them safe is your job.

It also works the other way. HHS says that if unencrypted email "is unacceptable to a patient who requests confidential communications, other means of communicating with the patient, such as by more secure electronic methods, or by mail or telephone, should be offered and accommodated" (HHS FAQ). If you'd rather not receive records by plain email, say so and ask for the portal or another secure method.

The ways to send medical records, ranked

Rank	Method	Who can still read the records afterward
1	Provider sends directly to the new provider	Both providers, which are covered by HIPAA
2	Download from one portal, upload to the other	You and both providers
3	End-to-end encrypted email	You and the recipient
4	Password-protected PDF by email, password by phone	Anyone who gets both the file and the password
5	Paper copies, in person or by tracked mail	Whoever handles the envelope

Method 1 keeps the records inside the system that is legally required to protect them. HHS says a provider "may send copies of your records to another provider or health plan only as needed for treatment or payment or with your permission" (HHS). Call the new office, ask what it needs, then ask the old office to send it there. You may be asked to sign an authorization form.

Method 2 works well when both offices have portals. Download a PDF of the records, upload it to the new provider's portal, then delete the download from your computer and phone.

Method 3 is the right choice when you send records to someone outside the health system, such as a family caregiver or a lawyer, or when there is no portal. Only you and the recipient hold the keys, so a breach at either email provider exposes nothing readable. Our walkthrough on how to send an encrypted email covers the options in Outlook, Gmail and Apple Mail.

Method 4 is the fallback when the other side only has ordinary email. The steps to lock a PDF on a Mac or PC, and why the password must never travel by email, are in our guide on how to send tax documents securely.

Method 5 is slow but leaves no digital copy. Send copies, keep the originals, and use tracking.

Sending records to an employer, school or insurer

These are the requests where people tend to send too much.

Ask exactly what they need. An employer handling sick leave usually needs a note confirming dates, not your chart. HHS says your employer "can ask you for a doctor's note or other health information if they need the information for sick leave, workers' compensation, wellness programs, or health insurance" (HHS).
Send the shortest document that answers the question. A one-page letter from your doctor is better than a 40-page record.
Use the organization's portal if it has one.
Remember HIPAA does not follow the document. Once it reaches your employer, the protection comes from employment law and the employer's own policies, not from HIPAA.

Before you hit send

A two-minute checklist:

Check the address twice. HHS suggests providers check "the e-mail address for accuracy before sending." The same applies to you. Autocomplete can easily pick the wrong "Dr. Lee."
Confirm the request is real. If an email asks for your medical records, call the office on a number you found yourself.
Remove pages they don't need. Most PDF viewers let you delete pages before saving a copy.
Keep the subject line and file name bland. "Documents for appointment" is fine. "HIV test results, Jane Doe" is not.
Leave your Social Security number and insurance ID out of the message body.

Clean up afterward

Delete the sent email and empty your trash.
Delete downloaded copies from your Downloads folder and phone.
Keep one copy of important records in encrypted storage, not in an open inbox.

If the records include your Social Security number, the extra steps in is it safe to email your Social Security number? apply too.

Where Secria fits

Health records tend to collect in personal inboxes: test results, referral letters, insurance letters, years of them. In Secria Mail, every message you send and receive is stored with zero-access encryption: your keys are made on your device and only reach our servers encrypted, and each message gets its own AES-256-GCM key. Encryption is post-quantum on every plan, with ML-KEM-1024 and X25519 together, and there are no ads and no profile built from your mail.

The free plan gives you 1 GB, 2 aliases and 3 folders, so you can keep one folder just for health paperwork. Sign-up needs no phone number and no card.

FAQ

Can I email my own medical records? Yes. HIPAA's rules apply to providers, health plans and their business associates, not to patients, so you can share your own records however you choose. Because HIPAA no longer protects the copy once it is yours, use encrypted email or a password-protected PDF rather than a plain attachment.

Is it safe to email medical records? Not as a plain attachment. Readable copies stay in your Sent folder and the recipient's inbox for years. A provider-to-provider transfer or a portal upload is safest, and end-to-end encrypted email is the best option when you send them yourself.

Can my doctor email me my medical records? Yes. HHS says that in most cases you can get a copy the way you want it, such as by email. If you ask for unencrypted email after being warned of the risk, the provider can send it that way, and it is not responsible for the records once they are delivered to you.

How long does a doctor have to give me my records? The rule says no later than 30 days after your request, with one possible extension of up to 30 more days if the provider tells you why in writing. Many offices are faster, and portals are often instant.

Is it a HIPAA violation to email my own medical records to someone? No. HIPAA rules apply to covered entities and their business associates, not to individuals sharing their own information.

How do I send medical records to a new doctor? Ask the new office what it needs, then ask your current provider to send the records there directly. You may need to sign an authorization form. If you have the records yourself, upload them to the new provider's portal.

Your health history is the most personal file you own, and it will keep growing. If you want the inbox it lands in to be sealed by default, you can get Secria for free.