Home Medical Records FAQ

Medical Records FAQ

My Duke Health gives you online access to much of your health information, such as test results, visit summaries, medicines, immunizations, and messages with your care team. 

A medical records request provides a more complete copy of your records. You should submit a medical records request when you need your records sent to a third party, such as another healthcare provider or organization that cannot access your records through a health information exchange network, a lawyer, or an insurance company.

Read these answers to frequently asked questions about My Duke Health, accessing your medical record, and how to submit a request.

Accessing Your Medical Records

You can view and download health information directly through My Duke Health without submitting a separate records request. Examples include after-visit summaries, test and imaging results, medication lists, allergies, immunization records, health conditions, parts of provider documentation, and messages with your care team.

Not necessarily. You can access commonly requested information directly through My Duke Health, including test results, after-visit summaries, medicine lists, immunizations, and portions of your medical record.

Submit a medical records request if you need:

  • A more complete copy of your medical record.
  • Records sent to another healthcare provider or organization that cannot access your records through a health information exchange network.
  • Records sent to an attorney or insurance company.
  • Records from a specific date range.
  • Records in a particular format.

A medical records request provides a more complete copy of your records, including:

  • medical history and physical examinations
  • progress notes
  • consultation reports
  • operative and procedure reports
  • laboratory reports
  • radiology reports
  • discharge summaries
  • medicine information

You can request your medical records through My Duke Health by completing and submitting a Duke Health Authorization for Release of Information form English (PDF, 800 KB) and Spanish (PDF, 667 KB). Use the same form for attorneys, warrants, subpoenas, and other third-party, HIPAA-compliant requests.

The completed form must be sent to Duke via email (ROI-Requestor3@dm.duke.edu), fax (919-620-5165), OR it can be mailed to:

Release of Information
Duke University Health System
Box 3016
Durham, NC 27710

View the instructions for completing the authorization form (PDF, 594 KB)

Complete all required sections of the authorization form, sign and date the form, provide identification when required, and clearly identify the records you are requesting. This includes dates of service, provider or clinic name, and where the records should be sent.

No. You have a right to access health information maintained in Duke Health’s Designated Record Set. However, not all information stored in Duke Health systems is part of the Designated Record Set. Some information is maintained for administrative, operational, compliance, security, or technical purposes and will not be included in a medical records release.

Examples of information that is not part of the Designated Record Set include audit trails, metadata, user activity logs, system access logs, security monitoring records, internal compliance records, internal administrative records, and technical or operational system records. These records are maintained to operate, secure, audit, or monitor Duke Health systems and are not used to make decisions about your care or billing.

You may submit a request for information you believe is relevant to your care. Duke Health will review the request and determine whether the information requested is part of the Designated Record Set and subject to patient access requirements under applicable law. Information such as audit trails, metadata, and system access logs is not considered part of the Designated Record Set.

Accessing Medical Records After Delivery

Records delivered through My Duke Health are available for download for 90 days after they are received. After 90 days, the records will no longer be available through the download link.

Yes. We recommend downloading and saving your records to a secure location, such as a password-protected computer, encrypted storage device, or another secure method. Saving a copy ensures you can access your records later without needing to submit another request.

If you do not download your records within 90 days, they will no longer be available through My Duke Health. You may need to submit a new medical records request to receive another copy of your records.

If you believe information was missing or that a determination was made in error, please contact Duke Health Information Management for assistance with your request. Phone: (919) 684-1700.

Accounting of Disclosures

A request for an accounting of disclosures regarding your medical record lists certain disclosures of your protected health information (PHI) made by Duke Health. Under the Health Insurance Portability and Accountability Act (HIPAA), you have the right to receive an accounting of certain disclosures made in the 6 years before the request, or for a shorter time period if requested.

When a disclosure is required to be included in the accounting, the accounting generally includes the date of the disclosure, the name of the person or organization that received the information and address if known, a brief description of the protected health information disclosed, and a brief statement of the purpose of the disclosure or a copy of the written request when applicable.

Complete this form (PDF, 197 KB) to request an accounting of disclosures and mail it to: DUHS Privacy Office, Box 3162, Durham, NC 27710

No. An accounting of disclosures tells you about certain disclosures of your information. It is not a list of every person who accessed your chart, viewed your record, or participated in your care. HIPAA excludes certain disclosures from the accounting requirement. Examples of excluded disclosures are:

  • for treatment payment and health care operations
  • disclosures made to you
  • disclosures made with your authorization
  • facility directory or care-involvement disclosures
  • certain national security, correctional institution, law enforcement, and limited data set disclosures
  • Disclosures that occurred before the applicable HIPAA compliance date.

HIPAA requires Duke Health to act on an accounting of disclosures request no later than 60 days after receipt. If more time is needed, one extension of no more than 30 days may be allowed when the individual is provided a written statement of the reason for the delay and the date the accounting will be provided.

This page was medically reviewed on 08/24/2026
Support Duke Health research or honor a loved one with a tribute gift.