GLP-1 Telehealth Medical Records Request Template

Free patient guide · Last verified August 14, 2026 · By the WPG Research Team

Use this GLP-1 telehealth medical records request template to get a copy of your treatment record — or to send the right records to a new clinician. Send it in writing to the medical group that treated you or the covered entity that maintains the record, not just the brand you paid. Ask for your exact medication, strength, dose, dose-change dates, prescription and pharmacy details, visit notes, dated weights, labs, and any prior authorization records. If the record holder is covered by HIPAA, it generally has 30 calendar days to act. It can charge a reasonable, cost-based fee for making and sending the copy — not for searching for your file or pulling it from storage.

Here's the part almost nobody gets right, and it's the reason these requests disappear into support queues: the company you paid may not be the company holding your chart. We'll show you how to find the right record holder in about 60 seconds.

Start here: which request are you sending?

→ Build my request letter — copy it free. No sign-up.

Already changing clinics? Pair this request with our step-by-step guide to switching GLP-1 providers mid-treatment.

Before you go further, here's the honest version

We'd rather tell you this now than let you find out in three weeks.

Your GLP-1 telehealth chart may be thinner than you're picturing. A study published in JAMA in July 2026 ran secret-shopper visits across 49 direct-to-consumer GLP-1 websites. Every site used a questionnaire. Only 13 of 49 — 26.5% — required a video visit.

The study did not request patient records or measure how long the charts were. So this next part is our inference, not a study finding: when care happens mostly through forms and messages, what comes back may be an intake questionnaire, a short clinician note, messages, and an order history — not pages of narrative.

That's disappointing for about ten seconds. Then it becomes useful.

Because it means asking for "my records" is the wrong move. It lets the company decide what that means, and a short chart plus a vague request can equal two useless pages. A specific request is more likely to get the three facts that are hardest to prove later: your dated starting weight, your dose history with dates, and the exact product, prescriber, and pharmacy tied to each order.

That's what this page is built to get you.

Primary source: JAMA, “Online Prescribing of GLP-1 Receptor Agonists”.

What we actually verified

On August 14, 2026, we opened and read: the current text of 45 CFR §164.524; the current HHS Office for Civil Rights complaint form HHS-700, revised July 2025; HHS guidance on access, fees, email, amendments, complaints, and the Ciox court order; the Hims & Hers privacy policy, terms, and Medical Groups Notice of Privacy Practices; the Ro privacy policy, pricing page, and insurance coverage checker; FDA material on compounded-drug marketing and compounded semaglutide dosing errors; current prior authorization documents from CVS Caremark/CareFirst and FEP Blue; the current OpenLoop consent plus published consent pages from eight separate telehealth brands; and current pharmacy-compounding rules in Virginia and Missouri.

What we did not do: we have not sent a records request to a company and timed the reply. We did not publish a state-by-state deadline table because that work is not complete. We do not claim a public legal page proves a company's private workflow. Anything we could not confirm at a primary source is labeled as an inference, a provider statement, or a limit.

Weight Loss Provider Guide is an independent comparison resource for GLP-1 telehealth providers.

Do telehealth companies have to give you your medical records?

Short answer: yes — if the company holding the records is covered by HIPAA and the records are in its designated record set. Your federal right lives at 45 CFR §164.524. It applies to covered online clinics the same way it applies to a covered doctor's office. You do not need a medical reason or a new clinician's permission.

You're not asking for a favor. You're not being difficult. You're asking for a copy of a record about you.

Three things people get wrong:

Their form can be required — but it cannot become a wall. A covered entity may require a written request and may require its own form if it has told you about that rule. It cannot use unreasonable steps that block or delay access. The clean move is simple: use its form and attach the exact list from this page.

You do not have to explain why. You need to identify yourself and the records you want. The HIPAA access right does not depend on your reason.

It is not just visit notes. The law covers your designated record set — records the covered entity uses to make decisions about you. That can include medical and billing records, payment and claims information, insurance records, lab reports, prescriptions, and clinical notes.

There are two narrow federal exclusions: psychotherapy notes kept separately, and information compiled in reasonable anticipation of a civil, criminal, or administrative action or proceeding. Neither normally drives a GLP-1 continuity request.

One limit worth knowing now: they have to give you records that already exist. They do not have to write a new dose summary or custom explanation. A covered entity can agree to prepare a summary, but you must agree in advance to that arrangement and any fee. So ask for existing records that show your dose history. Do not ask them to create a letter explaining your treatment.

Primary sources: 45 CFR §164.524 and HHS right-of-access guidance.

Who actually has your telehealth chart?

The brand you paid may be a technology or service company. A separate medical group may employ or contract with the clinician and maintain the clinical chart. Hims & Hers says in its own privacy policy that Hims & Hers itself is not a HIPAA covered entity and sends medical-record rights to the applicable Medical Group. If you send a perfect letter only to a platform support inbox, the 30-day clock may not start for the covered entity that actually holds the record.

This is the single most useful thing on this page. It is also why generic records-request templates fail here.

Provider-stated vs. what we verified

What the Hims documents say — and where they disagree

The Hims Medical Groups notice names twelve professional corporations: You Health of Alaska, P.C. · You Health of California P.C. · Bailey Health of Delaware, P.A. · You Health of Hawaii, P.C. · You Health of Kansas, P.A. · Bailey Health of Michigan P.C. · You Health of Nebraska, P.C. · You Health Purdy of Nevada, P.C. · You Health of New Jersey, P.C. · Bailey Health of Oregon, P.C. · Bailey Health of Pennsylvania P.C. · You Health of Texas, P.A.

The current Hims Terms name eight: You Health of Alaska, P.C. · You Health of California P.C., P.A. · You Health of Hawaii, P.C. · You Health of Kansas, P.A. · You Health of Nebraska, P.C. · You Health Williams of Nevada, P.C. · You Health of New Jersey, P.C. · You Health of Texas, P.A.

That is not the same list. The current Terms omit the Delaware, Michigan, Oregon, and Pennsylvania entities named in the notice, and the Nevada name changed from Purdy to Williams. Neither page tells a patient which one handled a specific visit. You have to ask.

One more number we computed. The Hims Medical Groups notice is stamped Last Updated: December 14, 2022. On August 14, 2026, that was 1,339 days old. The broader consumer privacy policy was updated March 26, 2026 — 141 days old.

The medical-group notice was about 9.5 times older than the broader platform privacy policy. Draw your own conclusion. The practical conclusion is easier: use the live request route, but make Hims name the exact Medical Group tied to your chart.

Primary sources: Hims Medical Groups Notice of Privacy Practices, Hims Terms and Conditions, and Hims Privacy Policy.

The part that surprises people: one practice network, many brand names

While reading telehealth consent pages, we kept hitting the same company.

OpenLoop Healthcare Partners, PC or its affiliates are named in the published consent documents of RedBox Rx, Elara Health and Wellness, Claya, Reframe Med, Agile Telehealth, Longevity Direct, Sunnyside, and Vital/Styku. Eight different brand names. One named practice network.

The affiliate list repeated across several of those consents includes: OpenLoop Healthcare Partners California, PC · OpenLoop Healthcare Partners Colorado, PC · OpenLoop Healthcare Partners New Jersey Professional Corporation · OpenLoop Healthcare Partners Wisconsin, S.C. · OpenLoop Healthcare Partners Puerto Rico, P.C. · Reliant MD Medical Associates, PLLC.

Agile's published consent lists a privacy contact: privacy@openloophealth.com, 1-844-819-7956. Confirm the contact on the live consent before sending protected information because legal pages can change.

Two things follow from that, and both matter to you:

The name on your credit card statement may not be the name on your medical record. If you write only to the brand, you may be writing to a company that does not maintain the clinical chart.

Two brands naming OpenLoop does not prove your records were merged. If you used more than one program, list every brand, account email, treatment date, and name you used. Ask the practice to search each one.

Primary sources: OpenLoop's current telehealth consent and the published consent pages for RedBox Rx, Elara, Claya, Reframe Med, Agile Telehealth, Longevity Direct, Sunnyside, and Vital/Styku.

Find your medical group in 60 seconds

This works on any brand, including ones we've never heard of.

1. Open the brand's Telehealth Consent and Notice of Privacy Practices pages. They are often in the footer or patient portal.
2. Search the page (Ctrl+F or Cmd+F) for: PC, P.C., PLLC, P.A., S.C., Medical Group, Practice, or medical records.
3. Write down the exact company name and the published privacy or records route. A state-specific entity may matter.
4. Still nothing? Check your prescription label, after-visit summary, clinician signature, consent form, or old portal message.
5. Still nothing? Ask platform support: “Which legal medical practice maintains my designated record set, and where does that practice accept a HIPAA access request?”

If the covered entity says it does not have the records, use this line:

“If your organization does not maintain the requested information and knows where it is maintained, please tell me where to direct my request, as required by 45 CFR §164.524(d)(3).”

That is not a bluff. If a covered entity denies access because it does not maintain the requested information, but it knows where the information is maintained, the regulation requires it to tell you where to direct the request.

→ Find who holds my chart

Your GLP-1 history may sit in three separate files

Your treatment history may be split across three companies. The medical group has the clinical chart. The pharmacy has a dispensing record and the label details for what it supplied. The platform has billing, shipping, and support history. You may need a separate request for each one. Your federal HIPAA access request runs against a covered entity. A business associate may store records for it, but the covered entity remains responsible for access to information in its designated record set.

Most people send one letter and wonder why half the information is missing. This is why.

Why the pharmacy file matters more here than in normal medicine

With an FDA-approved medication, the approved package and label identify a standardized product, strength, and presentation. Your chart still matters, but there is less guesswork about what product the label describes.

With a compounded preparation — a finished drug product that is not FDA-approved — the label and dispensing details matter more. Concentrations and instructions can differ by pharmacy. FDA has reported dosing errors with compounded injectable semaglutide tied to concentration differences and confusion between milligrams, milliliters, and “units.”

So if your medication was compounded, the pharmacy record helps answer what was dispensed. It does not prove exactly what you injected or swallowed. Ask for the exact product wording, active ingredients, strength or concentration, directions, quantity, fill date, prescriber, and a copy of the label.

State rules separate label fields from internal compounding records. Virginia law, for example, requires certain compounded-drug labels to include the name and strength — or active ingredients and strengths — a control number, a beyond-use date, and quantity. The pharmacy's internal compounding record can contain components, lot numbers, formulas, and production details. Those internal operational records are not automatically part of your designated record set.

And an honest limit: a master formulation record, batch record, source document, or certificate of analysis may be outside your patient record. You can ask for it. HIPAA does not automatically force a pharmacy to create or release an operational document merely because you want it.

One clock to know about: compounding records do not have to be kept forever. Missouri's current rule, for example, requires records covered by that compounding rule to be retained and readily retrievable for inspection for two years from the date of compounding. State rules vary. If the program or pharmacy closed, do this soon.

Primary sources: FDA compounded semaglutide dosing-error alert, Virginia Code §54.1-3410.2, and Missouri Board of Pharmacy Chapter 2 rules.

Which GLP-1 records should you actually ask for?

Ask for the records that show what was prescribed or dispensed, how much, when it changed, and how you responded. Start with a short list you can get fast, then add the fuller chart. Ask for records that already exist — a covered entity does not have to write a new summary.

We built this list in three lanes so you can send the urgent one today and the complete one behind it.

Lane 1 — The fast continuity packet (send this first if you're in a hurry)

Ten items. These are the clearest starting facts for a new clinician.

1. Your latest prescription or medication order
2. The exact product name and formulation
3. Whether the record identifies an FDA-approved brand or a compounded preparation
4. The route and dosage form (injection, tablet, other)
5. The strength or concentration
6. The prescribed dose, units, schedule, and instructions
7. Dose and titration history with dates
8. Last fill date and quantity
9. The prescriber and the dispensing pharmacy
10. The most recent assessment or treatment plan

Lane 2 — The full clinical record

• Visit notes and progress notes
• Starting weight and BMI, with dates (see below — this one is the big one)
• Current recorded weight and BMI
• Diagnoses and clinical indication
• Relevant other conditions
• Allergies and current medications
• All labs held by the practice
• Side-effect notes and any treatment changes made because of them
• Clinician messages used to make treatment decisions
• Consent forms and medication instructions

Lane 3 — Insurance and billing

• Prior authorization submissions
• Approval or denial notices
• Appeal records
• Claims history
• Itemized billing statements
• HSA/FSA receipts
• Subscription, cancellation, and refund records

The one people forget — and it's the one that can cost the most money

Your starting weight.

Here's why we're making a fuss about a number you probably remember anyway. Remembering it is not the same as documenting it.

A current CVS Caremark/CareFirst Zepbound prior authorization form asks for documentation of the patient's weight before starting weight-loss drug therapy and the current weight, with dates. It also tells a prescriber switching a patient from another weight-loss drug to use the baseline BMI at the start of any drug therapy.

A current FEP Blue Zepbound continuation policy gives another concrete example: it requires medical-record documentation that the patient lost at least 5% of baseline body weight or maintained that initial loss.

Put those together. If your first GLP-1 dose was two years ago through a telehealth program, that first program may hold the cleanest dated proof of your baseline. Lose it and a later coverage review may start from a weaker record or the wrong date.

That's not a scare tactic. Those are current coverage documents showing why a dated starting weight can be worth real money. Your own plan may use different rules.

Primary sources: CVS Caremark/CareFirst Zepbound PA form and FEP Blue Zepbound policy, effective July 1, 2026.

→ Add these records to my request

GLP-1 telehealth medical records request template (copy, fill in, send)

Copy the version that matches your situation, fill in the brackets, and send it in writing to the medical group or other record holder. Keep the sent copy, delivery proof, and every reply. The date the covered entity receives it starts the federal timing rule.

Use the record holder's published route: patient portal, secure email, fax, mail, or its required form. Personal email can be used when the patient accepts the privacy risk and the provider uses reasonable safeguards, but a secure portal is safer. Sign and date the request in the way the holder requires; do not assume a typed name will satisfy every form or state rule.

Version 1 — The main request (records sent to you)

This should be your default. You get to check the packet before anyone else sees it, you keep your own copy, and the HIPAA cost-based fee rule is clearest when the copy is sent to you.

Subject: Request for access to my medical records under 45 CFR §164.524 — [Full name], DOB [date]

Hello,

I am requesting an electronic copy of the records your organization maintains about my treatment from [start date] through [end date].

Please include existing records that show:

• My exact medication or product and its formulation
• Whether the record identifies it as an FDA-approved brand or a compounded preparation
• The dosage form and route
• The strength or concentration
• The prescribed dose, units, schedule, and instructions
• My dose and titration history, with dates
• Prescription, refill, and dispensing details your organization maintains
• The prescriber and the dispensing pharmacy
• Visit notes, assessments, and treatment plans
• My weight and BMI history with dates, including the earliest recorded weight
• Relevant labs and vitals
• Allergies and current medications
• Side-effect notes and any treatment changes
• Any prior authorization, claims, or billing records your organization maintains

Please send these records directly to me at the destination below, as a searchable PDF or another electronic form and format you can readily produce.

If your organization is a HIPAA covered entity, please treat this as a request for access under 45 CFR §164.524. If your organization does not maintain the requested information and knows where it is maintained, please tell me where to direct my request.

If you require your own request form or an identity check, please send me the instructions and confirm the date you received this request.

If any fee applies, please tell me the estimated amount before you process the request.

Full name:
Date of birth:
Account or patient number, if known:
Email:
Phone:
Preferred delivery destination:
Signature:
Date:

Thank you.

Version 2 — Fast proof (when you can't wait for the whole chart)

Subject: Time-sensitive request for current treatment records — [Full name], DOB [date]

Hello,

I am requesting an electronic copy of the existing records that show my current treatment. Please send:

• My latest prescription or medication order
• The exact product and formulation
• Dosage form and route
• Strength or concentration
• Prescribed dose, units, schedule, and instructions
• Dose and titration history with dates
• Last fill date and dispensing pharmacy
• Most recent assessment or treatment plan

Please confirm you received this and tell me whether you need a form or identity check from me. If these items are ready before the rest of my chart, please send them first and send the remainder afterward.

[Name, date of birth, email, phone, signature, date]

That last line is a request, not a separate legal deadline. The federal rule treats 30 days as an outside limit for acting on the access request; it does not require the company to wait until day 30 or forbid a partial production you asked for.

Version 3 — Sending records straight to a new clinician

Use this when your new clinic has given you an exact secure destination. Read the next section first — the federal third-party direction right is narrower than many old templates say, and fee protections can differ.

Subject: Signed direction to send an electronic copy of my records

Hello,

I direct you to send an electronic copy of the electronic health record information listed below to my new treating clinician:

Recipient name:
Organization:
Secure destination (portal, secure email, fax, or upload link):

Records requested: [list]
Date range: [start] through [end]

If this request does not qualify for the HIPAA third-party direction process, requires your standard authorization or release form, or includes records you cannot send through this route, please send me the correct form, the available delivery options, and any estimated fee.

Patient name:
Date of birth:
Signature:
Date:

Version 4 — The seven-day nudge

On [date] I sent a request for access to my records. Please confirm the date your organization received it, the current status, and whether you need a form or identity check from me. If you cannot provide the form or format I asked for, please tell me which electronic form and format you can readily provide.

Version 5 — The deadline follow-up

Your organization received my records request on [date]. The 30-calendar-day period ended on [date]. I have not received the records, a written denial, or a written extension notice that gives a reason and a new completion date. If HIPAA applies to your organization and this request, please provide the records or send the required written response. If your organization does not maintain these records and knows where they are maintained, please tell me where to direct my request.

If you received a valid written extension notice, replace the second sentence with:

The new completion date stated in your written extension notice was [date], and that date has passed.

Why this letter is built the way it is

This isn't a template we made pretty. We built it backwards from the government's current complaint form.

The current HHS Office for Civil Rights form — HHS-700, revised July 2025 — asks you to identify:

• The organization you believe violated HIPAA
• When the problem happened
• How and why you believe the rule was violated
• Whether you tried to resolve it with the organization
• The documents that support what you say

Read those backwards and they are an instruction manual. A strong request is in writing, dated, specific about the records, sent to the correct legal entity, and saved with delivery proof and follow-up replies.

A phone call can help, but it leaves less proof. A support chat is useful only if you save it. A request sent to the wrong company can create a month of confusion before the real record holder even receives it.

The old version of this page used the 2022 HHS-700 form to claim you should wait until day 61 because that form asked whether the request was more than 60 days old. That is no longer current. The July 2025 form does not ask that question. If the first 30-day deadline passes without the records, a denial, or a valid written extension notice, you do not have to invent a 31-day waiting period before filing a complaint.

Primary sources: current HHS-700 complaint form and HHS complaint process.

→ Copy my letter and mark my deadline

Should you have the records sent to you, or straight to your new doctor?

For most people: have them sent to you first. You get to check the packet, you keep your own copy, and the HIPAA cost-based fee limit is clearest that way. A direct transfer can work, but a 2020 federal court decision narrowed the mandatory third-party direction rule, and the patient-copy fee limit does not apply the same way when you ask for delivery to someone else.

This is the tip on this page that can save the most money, and almost nobody knows it.

In Ciox Health, LLC v. Azar (D.D.C., January 23, 2020), a federal court vacated the part of HHS guidance that extended the patient-rate fee limit to third-party deliveries. HHS also says the surviving third-party direction right is limited to electronic copies of electronic health records.

Translation, in plain money terms: “Please send my records to me” uses the patient access fee rule. “Please send my records to Dr. Nguyen” may use a different process and price.

So do this: ask for an electronic copy sent to you, check it, then send the useful pages to your new clinician through the secure route the clinic gives you. Before choosing direct delivery, ask what fee and form apply.

When a direct transfer makes sense

• Your new clinic gave you an exact secure destination
• The requested information is in an electronic health record
• The old clinic accepts that workflow
• You know the fee, if any

When you should use their release form

• Some records are not in an electronic health record
• The request is broad or includes mixed formats
• The office says its authorization form is required
• Someone other than you is directing the disclosure

One more useful fact: HIPAA permits one covered provider to share records with another provider for treatment without your written authorization. That does not force the old office to move on your preferred timeline or through your chosen method. But your new clinic can often ask while your own access request runs in parallel.

Primary source: HHS notice on the Ciox court order.

For the full handoff sequence, see how to transfer a GLP-1 prescription to a new provider.

How long do they have to respond to a medical records request?

If the company holding your record is covered by HIPAA, it must act within 30 calendar days of receiving the request. It can take one extra 30 days — but only if it tells you in writing inside the first 30 days, gives a reason, and gives you a new completion date. There is no second extension. Sixty days is the federal outer limit after one valid extension, not ninety.

“Act on” is doing some work there. Inside the deadline, the covered entity must do one of three things:

1. Give you access to the records
2. Give you a written denial that explains the basis and any review or complaint rights that apply
3. Send a written extension notice with a reason and a new completion date

Silence is not one of the three.

The 90-day medical records myth

You'll still find pages saying providers get 60 days for off-site records and up to 90 days total.

That old timing structure was removed in 2013. It is not in the current text of §164.524. If a company quotes you 90 days under HIPAA, ask it to identify the current rule it is relying on.

Does your state give you a faster deadline?

Some state laws give patients stronger access rights, shorter deadlines, or different fee rules. HIPAA is a federal floor, not always the whole answer.

Do not assume the law of the platform's headquarters controls. Do not assume your home-state rule always controls either. The answer can depend on where the practice and clinician are licensed, where the care legally occurred, which entity holds the record, and the wording of the state law.

We are not publishing a state-by-state table until each row is checked against the current statute or board rule. A confident wrong deadline is worse than no table.

Your deadline worksheet

Write the actual dates. Do not count from the day you drafted the letter.

→ Mark my deadline

Primary source: 45 CFR §164.524(b)(2).

What can they charge for medical records?

For a HIPAA access request sent to you, the fee must be reasonable and cost-based. It may include labor for copying, supplies used to make the copy, and postage when you ask for mail. It cannot include the cost of searching for your file or retrieving it. A covered provider also cannot deny access because you owe money for past care.

The fee categories are listed in §164.524(c)(4). That is the list.

Some organizations provide electronic copies for $0. Do not assume yours will, and do not accept a mystery “records fee” without asking what it covers.

Three specific things worth knowing:

They cannot hold your records hostage over an old bill. HHS says a covered provider cannot deny access because you have not paid for prior care. A permitted copying fee is separate.

Do not quote “$6.50” as a universal cap. HHS allows a covered entity to offer a flat fee of up to $6.50 for certain electronic copies instead of calculating actual or average cost. It is an optional method, not a cap you can force every provider to use.

Ask for the number first. Add this line to your letter:

“Before you process any request that will create a fee, please send me the estimated total and a breakdown of the copying, supply, and postage costs.”

That gives you a chance to narrow the request, choose electronic delivery, or question a charge before anyone prints 400 pages.

Primary sources: 45 CFR §164.524(c)(4), HHS clarification on the $6.50 option, and HHS patient access guidance.

What if they ignore your medical records request?

Start with a calm status check. A missing form, failed identity check, or wrong inbox can cause a delay. But if the 30-day deadline passes with no records, no written denial, and no valid written extension notice, you can file a free complaint with the HHS Office for Civil Rights. You do not need a lawyer, and you do not have to wait until day 61.

Work the ladder in order. Threats on day 8 usually do not help.

What the current HHS complaint form actually wants

The July 2025 HHS-700 form asks when the problem happened, what the organization did, whether you tried to resolve it, and what documents support your complaint. That is why you save:

• The original dated request
• Proof the correct entity received it
• Any required form you completed
• Identity-check messages
• Every reply
• The day-7 status check
• The deadline follow-up
• Any extension notice

File through the HHS OCR complaint process. A complaint generally must be filed within 180 days of when you knew about the act or omission, although OCR may extend that period for good cause. HIPAA prohibits retaliation for filing or participating in a complaint.

Set your expectations correctly. A complaint is not a payout. OCR may close or refer a matter, provide technical assistance, investigate, or seek voluntary or formal corrective action depending on the facts and its jurisdiction.

The second lane most people do not know exists

Under the 21st Century Cures Act, certain health care providers and other “actors” are subject to information-blocking rules for electronic health information.

Two honest caveats, because people get this wrong:

It is judged case by case. A practice that does not meet an exception is not automatically information blocking. The actor, the information, the reason for the delay, and the knowledge standard all matter.

Do not lead with it. Start with the HIPAA access request and the deadline ladder. Use the information-blocking route only when the facts fit and the normal request has failed.

Claims can be submitted through the ASTP/ONC information-blocking portal. HHS has a final provider-disincentives rule, but that does not turn every slow request into a violation.

→ Copy my follow-up message

What if the telehealth company shut down — or you lost portal access?

A closed brand does not prove the medical record disappeared. State retention and practice-closure rules may require a clinician, medical group, successor, or records custodian to keep it for a set period. The hard part is finding that custodian. The answer varies by state and by the legal entity that treated you.

This is one of the hardest versions of the problem, but it is often still fixable.

Where to look, in order:

1. Your own documents first. Check the prescription label, after-visit summary, consent form, clinician signature, billing statement, and email footer. The medical group name may be in one of them.
2. A web archive of the old brand's legal pages. The Telehealth Consent and Notice of Privacy Practices are the pages you want. Legal entities can outlive a website.
3. The state medical board. Search the clinician and practice. Ask whether the board has a records-custodian notice or closure filing.
4. The state board of pharmacy for the dispensing pharmacy. It is a separate company and may still be operating.
5. The acquiring company or bankruptcy contact, if the brand was sold or entered a formal proceeding.
6. Your insurer or PBM, if insurance was used. It may have claims, prior authorization decisions, and dispensing history even when it does not have the clinical note.

On losing portal access: save anything visible in your account before you cancel. Access after cancellation varies by provider. Screenshot or download your prescriptions, dose history, dated weights, messages, and receipts while you still can.

And do not mix up two separate jobs: ending a subscription or recurring charge is not a medical-record request. Complete the cancellation through the provider's required route, save proof, and send the records request separately.

What people are actually trying to solve

These are real questions from public GLP-1 discussions. We include them to show the problem in patients' own words — not as medical, legal, or safety evidence, and not as reviews of anything we sell.

“Did you need medical records or proof of the original prescription? If so, what documentation did they accept?” — r/CompoundedSemaglutide

“My old provider won't provide copy of last prescription or medical records.” — r/tirzepatidecompound

That second one is the whole reason this page exists. That person does not need a lecture on HIPAA. They need to know who to write to and what to say.

Your records arrived. Now what?

Check the packet against what you asked for before you send it anywhere. Look for the medication, formulation, strength, dose history with dates, and your earliest recorded weight. Ask for any existing record that is missing, request an amendment if something is wrong, and share only the useful packet with your new clinician through the secure channel that clinic gives you.

The five-minute check

Go down this list. It takes less time than reading it did.

1. Is your name right on every page?
2. Is the product and formulation clear — not just “GLP-1”?
3. Is the strength or concentration there?
4. Are the dose, units, and schedule clear?
5. Are the dose-change dates included?
6. Are prescription and fill dates included?
7. Do the weight and BMI entries have dates?
8. Are the labs you asked for attached?
9. Are side effects and treatment changes represented?
10. Are the insurance records there, if you asked for them?

If something is missing

Thank you for sending these. The packet does not appear to include [specific existing record] from [date range]. Please send that record, or confirm that your organization does not maintain it.

If something is wrong

You have a separate right here. HHS says you can ask a covered provider or plan to amend medical or billing information that is inaccurate or incomplete. If it denies the request, you can generally submit a statement of disagreement that it must add to the record.

This matters more than it sounds. A wrong starting weight, medication, or dose can affect later care and coverage reviews.

Build the packet your new clinician can actually use

Put it in this order. One PDF.

1. A one-page cover sheet
2. Latest prescription or order
3. Pharmacy label or dispensing record
4. Dose and titration timeline
5. Most recent assessment and treatment plan
6. Relevant labs
7. Dated weight and BMI history
8. Side-effect and treatment-change notes
9. Prior authorization or insurance records
10. The full record behind all of it

Your cover sheet should be boring and factual: current product, route, strength or concentration, prescribed dose and schedule, last documented dose, last fill date, treatment start date, what is included, and what is still pending.

If you add anything from your own memory or notes, label it clearly:

Patient-reported. Not copied from the clinical chart.

That label separates chart facts from memory. It makes the packet easier to trust.

Primary source: HHS guidance on reviewing and amending medical records.

Will these records make a new provider keep you at the same dose?

No. Records give a new clinician evidence of what happened before. That clinician still makes an independent decision about the medication, formulation, and dose. A strong packet reduces guesswork; it does not create an obligation to prescribe or continue anything.

We'd be lying if we told you otherwise, and you'd find out in your first appointment.

The new clinician may weigh how long it has been since your last dose, side effects, other medications, current health, the exact prior product and concentration, and whether continuing treatment is appropriate now.

A compliance note that is also a safety note: a compounded finished drug is not FDA-approved and is not a generic version of an FDA-approved drug. FDA does not review compounded drugs for safety, effectiveness, or quality before they are marketed. Keep an approved brand and a compounded preparation clearly separated in every record and cover sheet. FDA has warned telehealth marketers against implying they are the same, and it has reported dosing errors tied to compounded semaglutide concentrations and unit confusion.

Precision in your paperwork is not red tape here. It is the point.

Primary sources: FDA warning letters to 30 telehealth companies and FDA compounded semaglutide dosing-error alert.

What most people do once they have their records

You came here for a letter. You've got it, plus the checklist, deadlines, and escalation path — all free. This section is optional. If you're only here for the records, skip it. Nothing below changes anything above.

But almost everyone who requests these records is about to do one of two things. Here's the honest version of both.

Advertising disclosure: We may earn a commission if you use a provider link. That does not change the records advice, source checks, or limitations above.

If you're taking them to insurance

Your records are the evidence. They are not the decision. Your plan still applies its own rules.

Start with your own doctor if you have one. An existing primary care office may be the lowest-cost route because you may avoid a separate telehealth membership, but office charges and insurance cost sharing can still apply.

If you do not have that route, or your last prior authorization went nowhere: Ro is worth knowing about for this specific job. Ro says its program offers access to FDA-approved options including Zepbound, Wegovy, and Foundayo, and it offers an insurance concierge. Its free GLP-1 Insurance Coverage Checker can check coverage for the Ozempic pen, Wegovy pen, and Zepbound pen. It asks for personal and insurance information and sends a coverage report; it is not a treatment request or an approval.

Ro Body starts at $39 for the first month. After that, the membership is $74/month on a 12-month plan prepaid annually, $89/month on a 6-month plan, $99/month on a 3-month plan, or $149 month to month. Medication cost is separate.

Here's what Ro does not do: it cannot retrieve your old records for you, and it cannot make your plan say yes. The checker does not cover every Ro product or dosage form, and a coverage result is not a prior authorization approval. If your plan excludes weight-loss medication, an insurance concierge cannot rewrite the benefit. Our GLP-1 prior authorization timing guide explains the next paperwork steps and realistic timelines.

But that limit is also why the checker is useful before a full enrollment: it can show what the plan appears to cover before you commit to a longer paperwork path.

Check coverage with Ro — free checker; insurance information required

Provider-stated details verified August 14, 2026 at Ro pricing and the Ro coverage checker.

If you're switching programs and don't want a gap

Different situation, different answer.

If you're leaving a cash-pay program and want to explore another cash-pay route, Embody currently advertises weekly compounded semaglutide injections starting at $79/month and compounded tirzepatide injections starting at $129/month, subject to clinical approval and availability. These compounded medications are not FDA-approved and FDA does not review them for safety, effectiveness, or quality before marketing.

Its current terms say the program uses recurring billing. Discounted quarterly, six-month, and 12-month plans carry commitment terms. The terms also say the final charge may vary based on the prescribed medication and selected pharmacy. Older gum programs shown in the same terms are marked “NO LONGER ACTIVE,” so this page does not present gum as a current option.

Bring your dose history to the intake. A new clinician can only account for where you are if you can show it — which is the whole reason you're on this page.

See Embody's current eligibility and pricing — verify your state, checkout price, commitment, and medication before paying

Provider-stated details verified August 14, 2026 at Embody's site and Embody Terms and Conditions.

If neither of those is you

Then ignore this entire section. Seriously. The letter above is the point of this page, it is free, and it works the same whether you ever click anything on this site again.

Frequently asked questions

Can I request only my prescription, not my whole chart? Yes. Ask for a focused set: the latest order, exact product and formulation, strength or concentration, dose, units, instructions, prescriber, pharmacy, and fill date. A focused request is easier to understand and may be faster, but no rule guarantees it will be handled first.

Do I have to say why I want my records? No. Identify yourself and the records you want. If a form asks for a purpose, “personal copy” or “continuity of care” is enough unless another law or form requirement applies.

Can they refuse because I owe them money? A HIPAA covered provider cannot deny access because you owe money for past care. A permitted copying fee is separate.

Do they have to write me a dose summary letter? No. They have to provide existing records in the designated record set. They do not have to create a new explanation. They can agree to prepare a summary if you agree in advance to the arrangement and fee.

Can I get billing, claims, and prior authorization records too? Often, yes. A designated record set can include billing, payment, claims, and insurance records. Different pieces may sit with different companies: the prescriber may have the submission, while the insurer or PBM may have the decision.

Can they send it by email? Often. A secure portal is safer. HIPAA does not flatly ban unencrypted email between a covered provider and a patient, but the provider must use reasonable safeguards and may explain the risk. Ask for an electronic form and delivery method the holder can readily produce.

Is a photo of my vial or label enough proof? Sometimes, as one piece of evidence. It may not show titration history, tolerance, clinical reasoning, or what a new clinic requires. The receiving clinician decides what is enough.

Does HIPAA apply to every telehealth company? No. HIPAA applies to covered health plans, clearinghouses, covered health care providers that conduct covered electronic transactions, and their business associates. A platform may not be a covered entity even when the medical group behind it is.

Can my spouse request my records for me? A spouse does not automatically have full access just because you are married. The company may require a signed authorization. A legally recognized personal representative has rights based on the scope of that authority, subject to limited exceptions.

Can I correct a wrong dose or medication in my record? You can request an amendment. If the covered provider or plan denies it, you can generally submit a statement of disagreement that becomes part of the record.

Can I ask for records faster than 30 days? Yes. Thirty days is the federal outside limit for acting on a covered request, not a required waiting period. Ask for the fast-proof list now and the rest afterward. The holder is not required to accept your proposed seven-day deadline.

What if the company closed? The record may still be with a medical group, successor, custodian, pharmacy, insurer, or other entity under state retention rules. Start with your own documents, then the state medical board, pharmacy board, and any acquiring company.

Does canceling my subscription cancel my access to records? No. A subscription cancellation and a record request are separate. Portal access after cancellation varies, so save what you can see before canceling and follow the provider's required cancellation process.

Should I just ask for “all records”? You can. But a specific list makes the important documents clear. Send the fast list and the full request together if you want both.

How we built this, and who we are

We're the WPG Research Team at Weight Loss Provider Guide, an independent comparison resource for GLP-1 telehealth providers.

We built this page because generic medical-records templates do not fit telehealth. They assume there is one records department at an address you already know. In GLP-1 telehealth there may be a brand, a separate medical practice, a separate pharmacy, an insurer or PBM, and different records at each one. A perfect letter sent to the wrong company is still a wasted month.

Primary-source verification ledger

We used public patient discussions only to understand how people describe the problem — never as proof of a legal, medical, or safety claim.

What this page does not claim: that every telehealth company is covered by HIPAA. That every clinic accepts the same proof. That a label or screenshot guarantees continuation. That every state has the same deadline. That a public document proves a company's internal workflow. That this template overrides a required form. Or that records require any clinician to prescribe anything.

This is educational information, not legal or medical advice. There is no medical reviewer on this page and we're not going to pretend otherwise — nothing here is a treatment recommendation.

Found something wrong? Tell us and we'll fix it with a dated correction.

Still not sure which GLP-1 program is right for you? Take our free 60-second matching quiz.

Get a personalized action plan. The quiz does not ask for your medical records, decide whether you qualify for treatment, or replace a clinician.

By the WPG Research Team · Published August 14, 2026 · Last verified August 14, 2026 · How we verify · Advertising disclosure