Hawaii medical records laws

How Hawaii differs from federal HIPAA

• No state patient deadline or fee cap — HIPAA's 30 days and cost-based fee govern.
• Attorneys with a signed authorization must get copies within 10 working days.
• Hawaii requires 7-year retention (minors: majority plus 7) and 25-year retention of basic information — HIPAA sets no retention period for medical records.

How long a provider has to respond

Hawaii sets no deadline for a patient's own request (only 10 working days for a patient's attorney with signed authorization), so HIPAA's 30 days, with one 30-day extension on written notice, applies to you.(Haw. Rev. Stat. § 622-57, 45 CFR 164.524)

Under 45 CFR § 164.524, a provider may take one 30-day extension only if it tells you in writing, within the first 30 days, why and when you will get the records.

What a provider can charge

Hawaii law says the requester bears the provider's reasonable costs of making copies but sets no dollar cap; for your own records HIPAA limits the fee to reasonable cost-based labor, supplies and postage.(Haw. Rev. Stat. § 622-57, 45 CFR 164.524)

Paper copies

No state per-page cap — reasonable costs (HIPAA cost-based fee applies)

Electronic copies

No state rule; HIPAA cost-based fee applies.

A provider cannot refuse to give you your records because you owe money for treatment. Compare every state on the medical records fees by state page.

How long records must be kept

• Health care providers (including hospitals/facilities): At least 7 years after the last data entry; minors through minority plus 7 years; basic information (e.g., name, diagnoses, drugs, discharge summaries) 25 years after last entry (minors: minority plus 25 years)(Haw. Rev. Stat. § 622-58)
• X-rays, EEG tracings and similar imaging: At least 7 years, then may be given to the patient or destroyed(Haw. Rev. Stat. § 622-58)

Minors and sensitive records

• Minors: Records of minors must be kept through the age of majority plus 7 years (basic information through minority plus 25 years). No minor-specific access rule found in § 622-57; under HIPAA a parent is generally the minor's personal representative.(Haw. Rev. Stat. § 622-58, 45 CFR 164.524)

If a provider doesn't comply

If a provider believes release would be detrimental to the patient's health, it may instead release copies to the patient's attorney on signed authorization. No state private right of action or penalty for access violations found; HIPAA has none — file with RICO or HHS OCR.(Haw. Rev. Stat. § 622-57)

• Hawaii DCCA Regulated Industries Complaints Office (RICO)

  licensees of professional boards (e.g., physicians)

• HHS Office for Civil Rights

  HIPAA violations by any covered entity, within 180 days

How to request your records in Hawaii

1. Ask the provider's medical records (health information) department for its request form, or write your own request with your name, date of birth, dates of care, the records you want, and the format (paper or electronic).
2. Keep a copy and note the date — the 30 days (HIPAA) clock runs from when the provider receives it.
3. If the deadline passes or the bill exceeds the rules above, use the complaint routes on this page.

Templates and step-by-step help are on the records-access hub. Find a Hawaii hospital's records office, or browse hospitals in Hawaii.

Common questions about Hawaii medical records