State of Virginia Law states the following:
A request for copies of medical records must be in writing, dated and signed by the person making the request, and include a reasonable description of the records sought. If someone is making a request on your behalf, he or she must provide evidence of the authority to receive the records (such as a power of attorney). The provider must accept a photocopy, facsimile, or other copy of the original signed by the requester as if it were an original (Virginia Code § 32.1-127.1:03).
Upon receipt of such a request, the health care provider has 15 days to do one of the following:
- provide copies of the records;
- inform the requester if the information does not exist or cannot be found;
- inform the requester of the provider who now maintains the records; or
- deny the records for specific reasons set out in Section F of the statute.
§ 32.1-127.1:03 also provides that the patient's physician or clinical psychologist may make a notation in a patient's record that furnishing of the records will be "would be reasonably likely to endanger the life or physical safety of the individual or another person, or that such health record makes reference to a person other than a health care provider and the access requested would be reasonably likely to cause substantial harm to such referenced person." If a patient's request for his record is denied for this reason, the provider must permit the record to be copied and reviewed by a provider, selected by the patient, of similar background to the individual who made the notation in the chart, and that practitioner may make a judgment as to whether the records should be made available to the patient.
So, basically, the clinic owns and maintains the records and may deny access to them based upon the fact that they think that the records may somehow be harmful to you (for example, therapy session notes are often not shared with the patient). However, HIPAA ensures that your medical records must and will be transferred to your current provider (if not to you). Thus, I suggest that you request them in writing and be specific about which records you want (diagnostic, medication, etc). You might also gently remind them that they have 15 days to respond back to you. If they deny the request again, you will have it in writing and may be able to seek further action.
I hope this answers your question!