How to Request Records and What You’re Actually Entitled to Receive
If you’re a case manager who’s been on the other end of a records request and wants to understand why the family across the table is so insistent, this one’s for you too.
Somewhere in a filing cabinet, or more likely a server, sits a folder with your child’s name on it. Incident reports. Medication logs. Treatment plan updates. Notes from the Tuesday group session where your kid said something that mattered enough for a staff member to write it down. That folder exists whether or not you’ve ever seen it, and here is the thing nobody tells you at intake: you are entitled to most of it, you are entitled to it faster than the facility would like you to believe, and the request itself is not a favor you’re asking. It’s a right you’re exercising.
I’ve talked to parents who assumed records requests were a courtesy extended at the facility’s discretion — something you ask nicely for and hope doesn’t ruffle feathers. I’ve talked to others who tried once, got a vague non-answer, and quietly decided the records must be more complicated or more restricted than they actually are. Both of these are the wrong story. The right story is duller and more useful: there is a federal floor under your feet called HIPAA, there is a specific legal category called the designated record set, and there is a clock that starts ticking the moment your request lands on the right desk.
The record you’re asking for has a name, and knowing it changes the conversation
When people say “I want my kid’s records,” facilities sometimes respond as though that’s an impossibly broad, vague, borderline unreasonable ask — the institutional equivalent of raising an eyebrow and saying, all of it? It isn’t vague. It has a name. Under HIPAA, it’s called the designated record set, and it includes the medical and billing records used to make decisions about your child’s care: diagnoses, treatment plans, medication records, lab results, assessments, progress notes, and discharge summaries. As a parent or legal guardian, you are generally treated as your minor child’s personal representative, which means you have essentially the same right to that record set that your child would have if they were an adult requesting their own file.
Learn that phrase — designated record set — and use it when you make your request. Facilities that are used to fielding vague, emotional asks from overwhelmed parents are considerably less likely to stall when the person on the phone uses the term the regulation uses. It signals, correctly, that you know what you’re asking for and that you’ll know if the answer doesn’t match the ask.
There is one meaningful exception worth knowing up front: psychotherapy notes — a clinician’s private, separately-maintained process notes from an individual therapy session — are specifically excluded from this right of access under HIPAA. That’s a real carve-out, not a stalling tactic, and it’s worth knowing the difference so you’re not fighting a battle that isn’t winnable and missing the ones that are. Everything else in that file — the treatment plan, the incident reports, the medication administration record, the discharge paperwork — is fair game.
You are not asking a favor. You are exercising a right that has a name, a deadline, and a paper trail.
The clock is real, and most facilities are counting on you not to know it exists
Once your request is submitted, the covered entity — the facility, the hospital, the treating provider — generally has thirty days to respond under HIPAA, with the possibility of one thirty-day extension in limited circumstances, and some states impose even shorter deadlines. Thirty days sounds like a long time until you’re the parent calling week after week being told the request is “still being processed,” at which point thirty days becomes the difference between a facility that’s slow and a facility that’s stalling, and you now have a way to tell which one you’re dealing with.
Submit your request in writing. Not a phone call, not a hallway conversation with a case manager who nods sympathetically and promises to look into it — an email or letter, dated, sent to the facility’s privacy officer or medical records department, specifying exactly what you’re requesting. This does two things at once: it starts the clock in a way you can prove, and it removes the plausible deniability that verbal requests hand facilities by the fistful. If a facility later claims they never received your request, or that your request was unclear, a dated email makes that claim considerably harder to sustain.
Be specific if you have a specific need — a date range, a document type, a particular incident you already know occurred and want documentation on — but don’t let specificity talk you out of asking for the full designated record set if that’s what you actually want. You’re allowed to ask for everything. You’re also allowed to ask for one thing. What you shouldn’t do is let a facility’s discomfort with the size of your request shrink it before you’ve even decided what you need.
A denial is not the end of the conversation, and it usually isn’t even a real denial
Here’s where things get interesting, because a facility that doesn’t want to hand over records rarely says so outright. Outright refusal is easy to challenge. What you’ll more often encounter is delay dressed up as diligence — the request is “under review,” the records are “being compiled,” someone is “checking with the treatment team” about whether release is appropriate. Sometimes this is legitimate. More often it’s a facility hoping you’ll get tired before they get organized.
If you receive an actual denial, ask specifically what legal basis it rests on. There are a small number of genuine exceptions — records tied to a service a minor legally consented to on their own under state law, certain substance use treatment records with extra federal protection, situations where a court order limits parental access, or a provider’s professional judgment that access could endanger the child. These exceptions exist and they’re sometimes legitimate, particularly in cases involving abuse investigations or a minor’s confidential treatment relationship. But “we don’t usually share that” is not a legal basis. “The treatment team prefers not to” is not a legal basis. If the answer you’re getting doesn’t map onto one of the actual exceptions, ask directly which one applies, in writing, and ask for a second-level review if the first answer doesn’t satisfy you. Facilities are required to have an internal review process for access denials, and most staff hoping you won’t ask about it are, frankly, betting correctly most of the time.
If you hit a wall that genuinely doesn’t move — no legal basis offered, no review process honored, weeks past any reasonable deadline — the next stop is a complaint to the Department of Health and Human Services’ Office for Civil Rights, which enforces HIPAA and has, in recent guidance, explicitly named parental access to children’s records an enforcement priority. That is not a small thing. It means a complaint filed correctly is not a shot in the dark; it’s aimed at an agency that has already said this is exactly the kind of noncompliance it intends to act on.
Facilities are not the only place your child’s paper trail lives
Medical and treatment records are only part of the picture, and if your child’s placement touches education, the juvenile justice system, or a state licensing agency, there are more folders with their name on them than the ones sitting in the facility’s clinical files. If your child attended school while placed — many residential facilities operate an on-site school or contract with a local district — those records typically fall under FERPA rather than HIPAA, a different federal law with its own access rights and its own forty-five-day response window in many cases, and its own habit of getting lost in the gap between “that’s a medical question” and “that’s an education question” while nobody actually answers you.
If your child’s placement involved a state agency — child protective services, juvenile probation, a Medicaid-funded program — there are often state public records statutes that apply on top of, or instead of, HIPAA, and those have their own timelines and their own designated custodian to request from. And if you ever have reason to believe an incident occurred that the facility didn’t fully disclose — a restraint, an injury, a peer conflict that got glossed over in a phone call — the facility’s licensing body is a second, independent source of documentation, because facilities are generally required to report certain incidents to their state licensing or oversight agency regardless of what they tell you directly. If the story you’re getting from the facility and the story sitting in a licensing file don’t match, that discrepancy is itself information, and it’s the kind of information you can only find by asking more than one source.
What to actually do, starting today
If your child is currently placed anywhere, or was placed anywhere in the last several years, put in a written records request now, before you have an urgent reason to need it. Use the phrase designated record set. Address it to the privacy officer or medical records department by name if you can find one. Keep a copy of what you sent and note the date. If thirty days pass with no response, follow up in writing referencing your original request date. If you receive a denial, ask which specific legal exception it’s based on, and request the internal review process by name.
Do this even if nothing has gone wrong. Especially if nothing has gone wrong, because the file you request during a calm season is a file you understand before you ever need to defend against a version of events that doesn’t match what actually happened. A record you’ve already seen is a record you can catch changes in. A record you’ve never asked for is a record someone else gets to describe to you, on their timeline, in their language, and you will have no way of knowing what they left out.
Your child’s file is not the facility’s story about your child. It’s a document you have a right to read, on a timeline the law already set, and the only thing standing between you and it is usually just the asking — done in writing, done with the right words, done before you need it rather than after.