Kentucky medical records laws

How Kentucky differs from federal HIPAA

• Stricter on cost: the first copy must be free; HIPAA allows a cost-based fee.
• Additional copies capped at $1 per page; HIPAA's cost-based limit still applies to a patient's own requests.
• Kentucky hospitals must keep records 6 years from discharge (longer for minors); HIPAA sets no medical-record retention period.

How long a provider has to respond

Kentucky law does not set a deadline, so HIPAA applies: the provider must respond within 30 days and may extend once by 30 days with written notice.(KRS 422.317, 45 CFR 164.524)

Under 45 CFR § 164.524, a provider may take one 30-day extension only if it tells you in writing, within the first 30 days, why and when you will get the records.

What a provider can charge

On a patient's written request, Kentucky hospitals and health care providers must provide a copy of the medical record without charge. A second copy requested by the patient, the patient's attorney or authorized representative may cost no more than $1 per page. A 2023 bill (HB 51) to replace the free copy with a $20 minimum fee was not enacted.(KRS 422.317, 2023 RS HB 51 (Ky.) — bill record)

Paper copies

First copy free; additional copies up to $1.00 per page

Electronic copies

Not addressed by KRS 422.317; HIPAA cost-based limits apply to electronic copies.

When copies are free

A hospital or health care provider must give the patient one copy of the medical record free on written request.

A provider cannot refuse to give you your records because you owe money for treatment. Compare every state on the medical records fees by state page.

How long records must be kept

• Hospitals: 6 years from discharge, or for a minor 3 years after reaching the age of majority, whichever is longer.(902 KAR 20:016, Section 3(11)(b)(2))

Minors and sensitive records

• Minors: Since July 15, 2024, KRS 422.355 gives a parent or personal representative of a patient under 18 access to the minor's health information in a medical record, unless HIPAA or another federal or state law prohibits it. Hospitals must keep a minor's records at least 3 years after the patient reaches the age of majority (or 6 years from discharge, if longer).(KRS 422.355, 902 KAR 20:016, Section 3(11)(b)(2))

If a provider doesn't comply

• Kentucky Board of Medical Licensure

  physicians (signed grievance form, mailed to 310 Whittington Parkway, Suite 1B, Louisville, KY 40222) · (502) 429-7150

• HHS Office for Civil Rights

  HIPAA violations by any covered entity, within 180 days

How to request your records in Kentucky

1. Ask the provider's medical records (health information) department for its request form, or write your own request with your name, date of birth, dates of care, the records you want, and the format (paper or electronic).
2. Keep a copy and note the date — the 30 days (HIPAA) clock runs from when the provider receives it.
3. If the deadline passes or the bill exceeds the rules above, use the complaint routes on this page.

Templates and step-by-step help are on the records-access hub. Find a Kentucky hospital's records office, or browse hospitals in Kentucky.

Common questions about Kentucky medical records