As of May 2026, PHL § 18 requires providers to afford inspection of patient records within 10 days of a written request, while copies must be produced within a reasonable time.
The controlling statute depends on who signs the request, how it reaches the provider, and whether a subpoena is involved.
Four overlapping authorities govern New York medical record access. This article covers the controlling statutes, fee-cap distinctions, Arons authorizations, special-category protections, and subpoena procedures that apply across malpractice limitations and personal injury practice.
Statutory Framework Governing Record Access in New York
Four statutes govern New York medical record access, each with distinct fee structures, response timelines, and authorization requirements. The applicable statute turns on the identity of the requester and the procedural mechanism used.
Public Health Law § 18: Patient Access
PHL § 18 governs access by "qualified persons," six categories enumerated in § 18(1)(g). The statute caps paper copy fees at $0.75 per page and requires providers to afford inspection within 10 days of a written request.
Public Health Law § 17: Provider-to-Provider Transfer
PHL § 17 governs physician-to-physician record transfers upon written request of the patient, parent, guardian, or conservator. The $0.75 per page cap mirrors PHL § 18, but the statute specifies no response deadline. Original mammograms are released without a copy charge, though documented costs of furnishing the films may apply.
HIPAA Privacy Rule and HITECH Interaction
The HITECH Act (42 U.S.C. § 17935(e)) and 45 CFR § 164.524 govern an individual's access to their own electronic records. A covered entity may offer a flat fee not exceeding $6.50 or use another permitted cost-based calculation. This Patient Rate applies only when an individual requests a copy of their own records.
A patient's written direction to transmit records to a third party, such as an attorney, is treated differently. In Ciox Health, LLC v. Azar, 435 F. Supp. 3d 30 (D.D.C. 2020), the court vacated the regulatory expansion that had applied the Patient Rate to third-party directives. An attorney-directed request is therefore governed by state law or actual cost, which in New York is PHL § 18's $0.75-per-page schedule.
CPLR § 8001(c): Subpoenaed Records
CPLR § 8001(c) sets a fee of $0.10 per folio where preparation of a transcript of records is required to comply with a subpoena. Practitioners commonly apply that rate to subpoenaed medical records.
Who Qualifies to Request Records Under New York Law
PHL § 18(1)(g) enumerates six categories of "qualified persons," each carrying distinct documentation requirements. The identity of the requester determines what proof of authority must accompany the request.
Patients and Authorized Representatives
Patients, legal guardians appointed under MHL Article 81, and parents of infants each qualify with proper identification, a written request, and appropriate proof of authority.
Attorneys Acting on Behalf of a Client
An attorney qualifies under PHL § 18 only when holding a power of attorney from a qualified person or the subject's estate that explicitly authorizes execution of a PHL § 18 request. In active litigation, a client-signed HIPAA authorization directs disclosure.
Estate Representatives and Deceased Patient Records
A probated estate's executor or administrator presents Letters Testamentary or Letters of Administration. Where no personal representative has been appointed, PHL § 18(2)(g) requires a distributee to attach a certified copy of the death certificate.
Parents, Guardians, and Minor Patient Records
Parents and guardians may access a minor's records only when they consented to the care or the care was provided in an emergency. For sensitive categories, the rules narrow further.
PHL § 17 bars release of abortion records to parents or guardians. Other categories are governed by separate authorities and may require the minor's own authorization or a different access process, including HIV-related information, prenatal care records, sexual-assault treatment records, mental health services, and substance use disorder records.
Response Deadlines and Inspection Rights
PHL § 18 draws a procedural line between inspection and copying. PHL § 18(2)(a) requires providers to afford inspection within 10 days of a written request. Copy production follows within a reasonable time frame, which the NY DOH treats as 10 to 14 days, and providers may place reasonable limitations on inspections under PHL § 18(2)(f).
Provider personal notes and observations fall outside the inspection right under PHL § 18(3) denial grounds. Denial triggers a written notice requirement:
- Providers state specific grounds in a written notice and supply Form DOH-1989.
- Denied requests proceed to the Medical Record Access Review Committee (MRARC).
- MRARC issues a written determination within 90 days.
Together these provisions separate the prompt inspection right from the longer copy-production timeline and the formal appeal process available when access is refused.
Fee Caps Across Three Statutory Schedules
New York record costs depend on who signs the request, whether records are maintained electronically, and whether a subpoena or authorization controls. New York law recognizes separate schedules for PHL § 18 requests, patient self-requests for electronic records governed by HIPAA/HITECH, and subpoena compliance under CPLR § 8001(c).
PHL § 18 Cap: $0.75 Per Page
PHL § 18(2)(e) sets a ceiling of $0.75 per page for paper copies. Fees reflect actual costs incurred.
HITECH Cost-Based Fees for Patient Self-Requests
When an individual requests an electronic copy of their own records, a covered entity may charge a flat fee not exceeding $6.50 or another permitted cost-based calculation under 45 CFR § 164.524(c)(4). The $6.50 flat-fee option is a ceiling for that calculation, not a cap that extends to attorney-directed or other third-party requests.
CPLR § 8001(c): $0.10 Per Folio for Subpoenaed Records
Records produced in response to a subpoena duces tecum are often billed under CPLR § 8001(c) at $0.10 per folio, though the issue is not definitively settled by binding appellate precedent. Fees are tendered before the return date per Jaggars v. Scholeno, 776 N.Y.S.2d 684 (App. Div. 2004).
Postage, Diagnostic Imaging, and Ability-to-Pay Limits
Access cannot be denied solely for inability to pay, and no charge applies for records supporting government benefit applications.
Special Record Categories With Additional Protections
Several categories of medical records carry confidentiality requirements that override general PHL § 18 access rules. Those statutes impose category-specific authorization language, court-order requirements, or both.
Mental Health Records Under MHL § 33.13
MHL § 33.13 protects clinical records maintained at facilities licensed or operated by the Office of Mental Health or the Office for People with Developmental Disabilities. CPLR § 2302(a) requires that any subpoena compelling production of these records be accompanied by a court order. The court must find that the interests of justice significantly outweigh the need for confidentiality.
Substance Use Disorder Records Under 42 CFR Part 2
42 CFR Part 2 restricts disclosure of records from federally assisted SUD programs. Disclosure requires Part 2-compliant written consent under § 2.31 or a court order under §§ 2.61-2.67 with a subpoena. The 2024 Final Rule amendments became effective April 16, 2024, with full compliance required by February 16, 2026.
HIV-Related Information Under PHL Article 27-F
PHL Article 27-F requires a dated, signed written authorization specifying the recipient, purpose, and time period. A general authorization for release of medical information does not constitute a release of confidential HIV-related information. Civil penalties reach $5,000 per occurrence under PHL § 2783.
Genetic Test Results Under Civil Rights Law § 79-l
CRL § 79-l requires written informed consent containing the statute's required disclosures, along with the individual's signature, before genetic test results may be disclosed. A general waiver does not constitute informed consent. Court-ordered disclosure requires consideration of the privacy interests of the individual and close relatives.
Subpoenaing Medical Records in New York Litigation
CPLR §§ 3120 and 3122 impose procedural requirements for provider subpoenas, layered with federal HIPAA satisfactory-assurance obligations. Subpoena practice therefore depends on both New York procedure and federal privacy rules.
Subpoena Duces Tecum Under CPLR §§ 3120 and 3122
CPLR § 3120(2) requires a return date not less than 20 days after service, reasonable particularity in item descriptions, and simultaneous service on all parties under § 3120(3). CPLR § 3122(a)(2) permits medical providers to withhold records when the subpoena lacks written patient authorization. The subpoena must also carry bold-faced warning language on its face stating that records shall not be provided unless the subpoena is accompanied by authorization or a court order.
Compliance Through a Records Custodian Under CPLR § 2305
CPLR § 2305 addresses compliance through a records custodian or other person able to identify the records and testify to their origin, purpose, and custody.
Confidentiality Stipulations and Protective Orders
HIPAA's satisfactory-assurance requirement under 45 CFR § 164.512 independently requires either written notice to the patient or a qualified protective order. A party stipulation can satisfy HIPAA's definition of a qualified protective order when it prohibits use of protected health information (PHI) outside the litigation and requires its return or destruction at conclusion. The satisfactory-assurance pathway still turns on the framework set out in 45 CFR § 164.512(e).
Ex Parte Interviews of Treating Physicians After Arons v. Jutkowitz
Arons v. Jutkowitz, 9 N.Y.3d 393 (2007), authorizes post-note-of-issue ex parte interviews of treating physicians under conditions imposed after the note of issue has been filed. The interview authorization is separate from any records authorization and must contain bold-print disclosure that the disclosure is not at the plaintiff's request and that the purpose is to assist the defendant in defense of the lawsuit. Treating physicians are not obligated to participate.
Subsequent appellate decisions have refined the framework:
- Yan v. Kalikow, 2023 NY Slip Op 03817 (2d Dep't): declined to extend Arons to an ex parte interview about how an accident occurred, confining the procedure to cases where causation is intertwined with the patient's medical condition and treatment.
- Porcelli, 65 AD3d 176 (2d Dep't 2009): held that placing the voluntariness-and-purpose admonition directly on the HIPAA-compliant Arons authorization is consistent with Arons.
- Muzio v. Napolitano, 2011 NY Slip Op 01987 (2d Dep't): an interview without a valid Arons authorization warranted preclusion of the treating physician as an expert.
Together these decisions confine the Arons interview to its narrow purpose and condition its use on a compliant, separately executed authorization.
Applying New York's Four-Statute Records Framework
Medical records access in New York turns on the interaction among PHL §§ 17 and 18, HIPAA/HITECH access rules, CPLR subpoena procedures, and special confidentiality statutes. Fee limits, response timing, and disclosure prerequisites change with the requester, the format requested, and whether production occurs voluntarily or by subpoena. Related retention rules determine which records remain available when a request is made.
Accurate categorization of protected records and complete documentation of request authority underpin every production. Medical record retrieval, defensible chronologies, and documentation workflows depend on records that are both complete and correctly sourced, and AI-powered legal tools support that work across these statutory frameworks.
To learn more, request a demo.
.webp)
.webp)
