New York's main access law, Public Health Law § 18, lets patients inspect their records within 10 days and caps paper copies at 75 cents per page. A provider cannot deny access solely because the patient cannot pay. For lawsuits, New York has an unusual rule: a practice served with a records subpoena does not have to respond unless the subpoena comes with the patient's written authorization or was issued or directed by a court.
At a glance
| Question | Answer |
|---|---|
| Deadline for a patient's request | Inspection within 10 days of a written request. Copies "within a reasonable time." HIPAA's 30-day limit still applies. |
| Copy fees a practice can charge | A reasonable charge not over the provider's costs, and no more than 75 cents per page for paper copies. No charge for records supporting a government benefit claim or appeal. Access cannot be denied solely for inability to pay. |
| Requests from the patient's attorney | An attorney with a power of attorney that explicitly authorizes record requests under § 18 is treated like the patient. Other attorney requests are third-party disclosures; the practice files a copy of the patient's written authorization with the record. |
| Subpoenas | A medical provider need not respond to a records subpoena (other than a court-issued trial subpoena) unless it comes with the patient's written authorization. The subpoena must say so in bold type. |
| Records that need extra consent | HIV-related information needs a specific HIV release or a court order. Genetic test results need written informed consent. Records of state-licensed mental health facilities have their own rules. |
| How long to keep records | At least 6 years. Minor patients: at least 6 years and until one year after age 18 (physician statute) or age 21 (Board of Regents rule for licensed professions). |
| Recent changes (2023–2026) | Chapter 347 of 2024 added a right to ask for a physical (paper) copy, effective September 27, 2024. |
When the patient asks
Public Health Law § 18 gives a "qualified person" (the patient, and in some cases a parent, guardian or other listed person) the right to inspect records within 10 days of a written request. Copies must be provided "within a reasonable time." New York does not set a fixed number of days for copies, so the HIPAA 30-day limit is the practical outer deadline.
Fees must be reasonable and may not exceed the provider's costs. Paper copies are capped at 75 cents per page. A qualified person cannot be denied access solely because of inability to pay. There is no charge when the records are requested to support an application, claim or appeal for a government benefit or program. A provider may not charge for copying an original mammogram given to a qualified person.
Since 2024, a qualified person may ask for a physical copy of any records requested under § 18. Section 17 separately requires a provider to send records to another physician or hospital the patient designates, with the same 75-cent cap.
A provider may deny access in limited cases, for example when review can reasonably be expected to cause substantial and identifiable harm to the patient or others, or for the practitioner's personal notes and observations. Failing to give qualified persons access under § 18 is listed as professional misconduct for physicians (Education Law § 6530(40)) and as unprofessional conduct for other licensed professions (8 NYCRR 29.2).
When the patient's attorney asks
Section 18 treats an attorney as a qualified person when the attorney represents the patient (or the estate) and holds a power of attorney that explicitly authorizes the attorney to request patient information under § 18. A copy of the power of attorney must be attached to the request. That attorney has the same access, fee cap and inability-to-pay protection as the patient.
When records go to any other third party, including an attorney with a signed authorization, § 18(6) requires the practice to add a copy of the patient's written authorization to the record. We could not confirm in a primary source whether the 75-cent cap applies to an attorney who holds only a HIPAA authorization and no power of attorney.
Subpoenas
Under CPLR 3122(a), a medical provider served with a subpoena duces tecum for a patient's records, other than a trial subpoena issued by a court, need not respond or object if the subpoena is not accompanied by the patient's written authorization. Every such subpoena must state in conspicuous bold-faced type that the records shall not be provided unless the subpoena comes with the patient's written authorization, or the court has issued the subpoena or otherwise directed production.
A non-party's reasonable production expenses are paid by the party seeking discovery (CPLR 3122(d)). CPLR 8001 sets witness fees of $15 per day of attendance plus 23 cents per mile, and 10 cents per folio when a transcript of records must be prepared to comply with a subpoena.
CPLR 3122-a lets a custodian or other qualified witness certify business records by sworn affidavit. The certification states that the affiant is authorized, the copies are accurate and complete (or gaps are explained), and the records were made in the regular course of business. The party offering the records must give notice at least 30 days before trial. CPLR 2306, which allows certified copies by mail, covers hospitals and government agencies, not private practices.
Records that need extra consent
HIV-related information. Under Public Health Law § 2782, confidential HIV-related information may be released only as the statute lists, including under a written "release of confidential HIV related information" or a court order under § 2785. Section 2780 says the release must be signed, dated, name the recipient, state the purpose and say how long it lasts. A general medical authorization does not count unless it states that it also authorizes release of HIV-related information. Each disclosure must carry the statutory notice against redisclosure.
Genetic test results. Civil Rights Law § 79-l says results may not be disclosed without the written informed consent of the person tested, with limited exceptions including a court order.
Mental health facilities. Mental Hygiene Law § 33.13 governs clinical records of facilities licensed or operated by the Office of Mental Health or the Office for People With Developmental Disabilities. It allows release with the patient's consent or under a court order finding that the interests of justice significantly outweigh the need for confidentiality.
Billing records and medical bills
CPLR 4533-a lets a party prove an itemized bill of $2,000 or less, receipted or marked paid, without live testimony. The provider certifies the bill and gives a verified statement that no part of the payment will be refunded and that the charges are its usual and customary rates. A copy and notice must be served at least 10 days before trial. CPLR 4518(b) has a separate certification rule for hospital bills.
How long to keep records
Physicians: Education Law § 6530(32) requires patient records to be kept at least six years. Obstetrical records and records of minors must be kept at least six years and until one year after the minor turns 18.
Other licensed health professions, including chiropractic and physical therapy: the Board of Regents rule at 8 NYCRR 29.2 also requires at least six years, but for obstetrical and minor records it says at least six years and until one year after the minor turns 21. That rule also lists medicine, so a physician practice that keeps minors' records until age 22 meets both texts.
Recent changes
Chapter 347 of the Laws of 2024 (S7846/A7860), signed September 27, 2024 and effective immediately, added a sentence to Public Health Law § 18(2)(d): a qualified person may request a physical copy of any patient information requested under the section.
What this means for your practice
- Track two clocks: 10 days to offer inspection, and a reasonable time (no later than HIPAA's 30 days) to send copies.
- Cap paper copies at 75 cents per page and your actual costs, and do not hold records back because a patient cannot pay.
- Offer a paper copy when a patient asks for one, even if you normally send records electronically.
- Check attorney requests for either a power of attorney that names § 18 or a signed authorization, and file the authorization with the chart.
- Do not produce records on a non-court subpoena unless the patient's written authorization is attached.
- Pull HIV-related and genetic results out of general releases unless the authorization specifically covers them.
Sources
- New York Public Health Law § 18, Access to patient information
- New York Public Health Law § 17, Release of medical records
- Senate Bill S7846 (2023–2024), signed as Chapter 347 of 2024
- CPLR 3122, Objection to disclosure, inspection or examination
- CPLR 3122-a, Certification of business records
- CPLR 2306, Hospital records
- CPLR 4518, Business records
- CPLR 4533-a, Prima facie proof of damages
- CPLR 8001, Persons subpoenaed
- New York Education Law § 6530, Definitions of professional misconduct
- 8 NYCRR 29.2, General provisions for health professions (Rules of the Board of Regents)
- New York Public Health Law § 2780, Definitions (HIV)
- New York Public Health Law § 2782, Confidentiality and disclosure (HIV)
- New York Mental Hygiene Law § 33.13, Clinical records; confidentiality
- New York Civil Rights Law § 79-l, Confidentiality of records of genetic tests
How we verified: statutes were read on the New York State Senate's official laws site and the Board of Regents rule on the NYSED Office of the Professions site, on November 12, 2026.