Your Medical Record After Cosmetic Surgery: The File You Do Not Have and May Not Be Able to Get

Six years after an augmentation, a woman needs an MRI and the radiologist asks what is in her chest. Manufacturer. Style. Placement plane. She does not know. She calls the office where it was done. The number rings to a different practice now. The surgeon retired in 2023, the suite was leased to a dermatology group, and nobody at the new number has ever heard of her.

This is not a rare story and it is not primarily a story about a careless patient. It is a structural feature of how aesthetic surgery is organized in the United States. The overwhelming majority of it happens in a single private office, paid in cash, outside the hospital record departments, the insurance claim trails, and the federal payment programs that quietly make everyone else's medical history durable. A knee replacement generates a record in an institution that will outlive the surgeon. A breast augmentation generates a record in a filing cabinet or a practice management system owned by one physician who will eventually stop practicing.

You do have a federal right to that file. It is narrower, slower, and more conditional than most people assume, and the clock that determines whether the file still exists is set by your state, not by Washington.

What is actually in the record, and the four documents that matter

The short answer: the legal object is the designated record set, which covers the clinical and billing records the practice uses to make decisions about you, and within that set four documents carry nearly all of the future value.

HIPAA does not give you a right to "your file" in the colloquial sense. It gives you a right to the designated record set, defined at 45 CFR 164.501 as the medical and billing records maintained by or for the provider, plus any other records used in whole or in part to make decisions about you. That definition is broad on purpose and it is broader than what most front desks think it covers.

Two categories sit outside it. Psychotherapy notes kept separately by a mental health professional are exempt, which almost never applies here. Information compiled in reasonable anticipation of litigation is also exempt, which occasionally does.

Inside the set, four documents are worth more than everything else combined:

• The operative report. This is the only document that states what was actually done rather than what was planned. Plane of dissection, pedicle design, incision, whether mesh or an acellular matrix was placed, what was resected and how much. A revision surgeon opening a breast without it is reconstructing your anatomy by inference, which matters enormously in an operation like a combined lift and augmentation where the nipple survives on a pedicle whose location determines where the next surgeon can safely cut.
• The device identifiers. Manufacturer, style or model number, lot number, serial number, fill volume. Without these you cannot look your device up in the FDA's complaint database, you cannot make a manufacturer warranty claim, and you cannot answer the radiologist. Since October 2021 the FDA has required breast implant labeling to include a patient device card handed to you at discharge. Patients lose them. The operative record is the backup, and it is the only backup.
• The anesthesia record. Agents, doses, airway management, any intraoperative event. This is the document that matters if you ever have a reaction on a future table, and it is the one nobody thinks to request. It is also the record that would identify a triggering agent exposure relevant to the emergencies an office facility has to be stocked for.
• The pathology report, where tissue was removed. Reductions, gynecomastia excisions, and lifts all generate specimens, and what that report says occasionally matters years later.

Add the signed consents and the pre-operative and post-operative photographs and you have the complete useful file. It is usually under thirty pages.

The federal right, the deadline, and the fee

The short answer: you have a right of access under 45 CFR 164.524, the practice has thirty days to comply with one permitted thirty-day extension, and it may charge only a reasonable cost-based fee that excludes the labor of finding your chart.

The mechanics are more favorable than most patients realize, and knowing them changes the conversation at the front desk.

Thirty days, once. A covered entity must act on a request within 30 calendar days. It may take one 30-day extension, but only with written notice stating the reason and the date it will deliver. There is no second extension. Several states impose shorter deadlines, and where a state law is more protective it governs.

You choose the format. If you ask for an electronic copy and the practice can readily produce one, it must. You can also direct the records to a third party, such as the surgeon you are consulting for a revision, in a signed written request.

The fee is capped, and search time is not billable. A practice may charge a reasonable, cost-based fee covering labor for copying, supplies, postage, and a summary if you agreed to one. It may not charge you for the time spent locating your chart, and it may not charge a fee for the act of accessing records at all. In practice, a request for a PDF of thirty pages should cost close to nothing, and a three-figure quote is a signal that the person handling it does not know the rule.

One genuine complication belongs here. In January 2020, the federal district court in Washington decided Ciox Health, LLC v. Azar and vacated the government's extension of the patient-rate fee cap to records sent to third parties. The practical result is a split: when you request your own copy, the cost-based limit applies. When you direct records to an attorney or another business, the practice may charge under state law instead, which is frequently much more. If cost is the obstacle, ask for the records to be sent to you and forward them yourself.

"

A practice may not bill you for the time it spends looking for your chart. It may bill for copying it. The difference is the entire reason a thirty page request sometimes comes back with a two hundred dollar quote.

"

There is real enforcement, and then there is the gap. The HHS Office for Civil Rights launched a Right of Access Initiative in 2019 and has since announced more than forty enforcement actions against providers who did not hand over records, with settlements running from a few thousand dollars into the six figures. Most targets were small practices. This is one of the few areas of health privacy law where a solo office genuinely gets penalized, and a written complaint to OCR, filed within 180 days, is the lever that works. You can file it yourself online and it costs nothing.

Now the gap. The 21st Century Cures Act information blocking rules, in force since April 2021, were supposed to make records move on demand across all of health care. They apply to health care providers, to developers of certified health IT, and to information networks. Developers and networks face civil monetary penalties of up to a million dollars per violation. Providers do not. For providers, Congress directed HHS to establish "appropriate disincentives," and the rule finalizing them in June 2024 built all three of them out of Medicare: a hit to the Promoting Interoperability payment adjustment, a zero score in the corresponding MIPS performance category, and a bar from the Medicare Shared Savings Program.

Every one of those is a lever attached to a Medicare payment. A cash-pay cosmetic surgery practice that bills no Medicare, participates in no quality program, and runs a non-certified practice management system is subject to the information blocking rules and structurally immune to the consequences of breaking them. That is not a loophole anyone drafted on purpose. It is what happens when an enforcement regime is bolted onto a payment system and one specialty operates almost entirely outside that payment system, the same structural reason office-based cosmetic surgery sits outside hospital privileging and depends on voluntary facility accreditation rather than mandatory oversight.

The photographs are the part they will argue about

The short answer: clinical photographs used to plan or evaluate your surgery are part of the designated record set and you can demand them, but they are usually stored in a separate imaging system under a separate consent, and that separation is where practices push back.

Aesthetic surgery is a photographic specialty. Standardized pre-operative views drive planning, and post-operative views drive the assessment of whether the result worked. Those images are used to make decisions about you, which is the exact language that puts them inside the record set.

The friction is architectural. Photographs typically live in a dedicated imaging platform rather than the chart, and the person answering your request pulls the chart. You will sometimes be told the photos are "marketing images" and not part of your record. That answer conflates two different consents that frequently share a signature line, a problem covered in detail in what the paperwork you sign before surgery actually does. Consent to be photographed for clinical documentation and consent to have your images used in advertising are separate agreements. Withdrawing the second one does not touch the first, and the first is yours on request.

Ask for them explicitly, by name, in the same written request: "all clinical photographs, pre-operative and post-operative, in native resolution." Native resolution matters. A practice that emails four compressed thumbnails has technically responded and given you nothing usable. These are also the only images of your own case you will ever control, which is worth weighing against the curated versions of everyone else's case that you learned to read in how to read a before-and-after gallery.

Retention is a state question, and the clock starts at your last visit

The short answer: HIPAA sets no retention period for medical records at all, state law does, the common range is roughly five to ten years, and the clock almost always runs from your last contact with the practice rather than from anything else.

This surprises people, including clinicians. HIPAA requires six-year retention of HIPAA documentation, meaning policies, notices, and authorizations. It says nothing about how long a provider must keep your chart. That is state medical board and statutory territory, and it varies widely.

The commonly cited examples give the shape of it. Florida's board rule requires physicians to keep records five years from the last patient contact. New York sets six years. Texas sets seven years from the last treatment, longer for minors. Some states specify nothing for physician offices and leave it to board guidance. A hospital in the same state is frequently held to a longer period than the physician down the street.

The trigger is the part that matters for cosmetic patients specifically, and it is genuinely adverse. Retention runs from last contact, not from the date of the operation plus a long tail, and not from the last time the record could conceivably be useful. A patient with a chronic condition resets that clock every year by showing up. A cosmetic patient has a consult, an operation, three post-operative visits, and then disappears by design, because a good result means you never go back. Your retention clock effectively starts about three months after surgery.

Run the arithmetic against a device. Breast implants are not lifetime devices and the questions in long-term implant surveillance and whether implants need replacing arrive at eight, ten, fifteen years. In a five-year retention state, the operative report that names your device can be lawfully destroyed a full three years before the first FDA-suggested imaging interval for silent rupture in a silicone device, and long before any of the surveillance questions in breast imaging after implants or the rare disease picture in BIA-ALCL would send you looking for it.

Nothing about that is illegal. It is a retention rule written for episodic primary care applied to a permanently implanted device.

What actually happens when the practice closes

The short answer: state boards require closing physicians to notify patients and name a custodian, but the notification duty is usually limited to recently seen patients, and the cosmetic patient from six years ago is definitionally not one of them.

Practices end in five ways and the records behave differently in each.

Retirement or relocation. Most boards impose an affirmative duty. Florida requires publishing notice in a newspaper of general circulation in the county once a week for four consecutive weeks and posting a sign in the office. Texas requires posting, publishing in the largest local paper, and sending letters to patients seen within the last two years. Read that last clause carefully, because it is the whole problem. The direct-mail obligation reaches patients with a recent visit. A cosmetic patient three years out is outside the window, gets no letter, and would have to have been reading legal notices in a newspaper to know anything happened.

Sale of the practice. Records transfer to the buyer as a business asset. This is permitted under HIPAA as a disclosure for health care operations, and it is generally the best outcome for you, because the file continues to exist somewhere with a phone number. The buyer inherits the obligation to respond to your access request.

Death of the physician. The estate becomes responsible, and boards typically require the executor to arrange custodianship and notify patients. Compliance is uneven for the obvious reason that an executor is usually a family member handling a medical practice for the first time.

Chain and group closure. Med spa and multi-location aesthetic groups close individual sites regularly. Records normally move to a corporate custodian or a commercial storage vendor. The entity that holds your file may have no clinical staff and no memory of your case, which slows a request but does not defeat it. The same delegation and supervision distance covered in who is actually injecting you shows up again on the records side, where the person who documented your treatment and the entity now holding the document have never met.

Bankruptcy or abrupt closure. This is the bad one. Records are still protected health information and cannot simply be abandoned, but enforcement after the fact is slow and the practical outcome for an individual patient is frequently that nobody knows where the file went. The state board is the place to start, since it maintains custodian information where a closure was properly reported.

Two additional cases deserve a line. If your surgery was performed abroad, none of this applies and the discussion in what surgical tourism actually costs understates the records problem: you have no HIPAA rights against a foreign clinic and no state board to petition. And if the operation was performed at an accredited surgical facility rather than in the surgeon's own office, the facility keeps its own record, including the anesthesia record, which is a second and completely independent copy most patients never think to ask for. When the surgeon's office is gone, the facility may still have your operative documentation. Ask.

The honest summary

The right of access is real and it works. Thirty days, one extension, a cost-based fee that cannot include search time, and a federal complaint route with a track record of penalizing small practices that stonewall. Patients who use it deliberately, in writing, almost always get their records.

What does not work is the assumption underneath most patients' behavior, which is that the file will keep existing until they need it. It will not necessarily. Your retention clock starts at your last post-operative visit, it runs five to seven years in much of the country, the practice can close without ever being required to write to you, and the federal machinery built to force records to move on demand reaches cosmetic surgery in principle and cannot touch it in practice, because every consequence it carries is a Medicare payment adjustment and this specialty does not take Medicare payments.

So the entire problem collapses into one decision made at one moment. Ask for the complete file in the weeks after your operation, when the request is trivial and the answer is yes, and keep your own copy. That is the whole strategy. Everything else in this article is a description of what it costs to have skipped it.

Two closing notes for anyone already past that window. First, ask anyway, because a surprising number of practices still have your chart even past the state minimum, and the surgical facility may hold a duplicate even when the surgeon's office does not. Second, if you are choosing a surgeon right now, add this to the questions in the second consultation: who holds the record, how long do they hold it, and what happens to it if you retire. It is an unglamorous question, and the way a practice answers it tells you roughly the same thing that the case volume question tells you, which is whether anyone there is thinking past the date of your operation.