HIPAA Right of Access: Patient Records Request Guide

Yes, patients have a HIPAA Right of Access to obtain their health records; this guide explains how practices should verify and fulfill requests. Follow the workflow below to verify identity, respond in the required timeframe, provide records in the requested format, and document any denials.

Most HIPAA enforcement stories involve breaches, hackers, and six-figure settlements against hospital systems. The Right of Access Initiative is different. It is an OCR enforcement program that often reaches solo practices and small clinics. The trigger is usually the same everyday failure: a patient asked for their records and the practice sat on the request.

The rule behind it is 45 CFR 164.524, part of the HIPAA Privacy Rule, and it is one of the most patient-favorable provisions in all of HIPAA. Here is what it requires, what you can charge, when you can say no, and the simple workflow that keeps you out of the complaint queue.

HIPAA Right of Access: What 45 CFR 164.524 Requires

Who May Request Records

The patient, or the patient's personal representative. Under 45 CFR 164.502(g), a practice must treat a personal representative as the individual. That covers someone with legal authority to make health care decisions for an adult, such as a health care proxy or guardian, and, with some exceptions set by state law, a parent of a minor child.

Under 45 CFR 164.524(b)(1), you may require requests in writing, provided you tell patients about that requirement. You cannot force one channel. HHS's access guidance says a practice may not require a patient to use a web portal or to mail the request.

How to Verify Patient Requests

Before you release anything, 45 CFR 164.514(h) requires you to "verify the identity of a person requesting protected health information and the authority of any such person" when you do not already know them. HHS says the rule "does not mandate any particular form of verification (such as obtaining a copy of a driver's license)." Match the check to the channel: a known patient at the front desk, a portal login, or a request form that asks for the date of birth and address on file. For a personal representative, get a copy of the document that gives them authority (a health care proxy, guardianship order, or power of attorney) and keep it with the request.

Verification cannot become a barrier. HHS's own example: a practice may not require a patient who wants records mailed home "to physically come to the doctor's office to request access and provide proof of identity in person."

What the Right of Access Covers

Patients have a right to inspect and obtain a copy of their PHI (protected health information) in the "designated record set." Under 45 CFR 164.501, that means the medical records and billing records maintained by or for the provider, plus any records used, in whole or in part, to make decisions about the individual.

Translation: the chart, the billing file, and anything you relied on to make care or payment decisions, including records you received from other providers. Not your quality committee minutes. Not your incident reports. And two named exceptions: psychotherapy notes kept separate from the chart, and information compiled for legal proceedings.

The Clock: 30 Days, One Extension, No Stalling

The regulation is blunt. Under 45 CFR 164.524(b)(2)(i), the covered entity (your practice):

"must act on a request for access no later than 30 days after receipt of the request"

You can extend that once, by up to 30 more days. To do it, you must give the patient a written statement within the first 30 days. It has to say why you need more time and the date you will finish. One extension. The rule says so explicitly.

State law can shorten that clock, and some states do. Texas gives providers 15 business days for records kept in an electronic health record, which is covered in the Texas requirements article. Your policy follows the shorter clock.

Thirty days is also a ceiling, not a target. HHS guidance says 30 days is an outer limit, meaning the most time you should take. It urges practices to respond as soon as they can. A same-week turnaround is a realistic standard for a small practice with an EHR.

Responding: Format, Fees, and Documentation

Fees: Cost-Based Means Cost-Based

You may charge a "reasonable, cost-based fee." Under 164.524(c)(4) it can include only: labor for copying, supplies (paper, or the USB drive), postage, and preparing a summary or explanation if the patient agreed to one.

What it cannot include is the thing practices most want to charge for: searching for and retrieving the record. Locating the chart is your cost, not the patient's. A $75 "records processing fee" is how a routine request becomes an OCR complaint. If a patient just wants to look at the chart, or wants records sent through your portal at no marginal cost to you, the defensible fee is zero.

Form and Format

Provide the copy in the form the patient asks for when you can readily produce it that way, including electronic (45 CFR 164.524(c)(2)). If the patient asks for email or mail, you cannot require an in-person pickup. Patients can also direct you, in a signed written request, to send an electronic copy to a third party, such as another provider or an attorney (164.524(c)(3)(ii)). Requests that arrive through a patient's app or attorney carry some extra wrinkles on fees; take those case by case and get advice when the request is unusual.

Common Exceptions and Denials

You may deny access without any review in narrow cases (45 CFR 164.524(a)(2)): the psychotherapy notes and legal-proceedings exceptions above, certain correctional and research situations, certain records covered by the federal Privacy Act, and information someone other than a health care provider gave you on a promise to keep it confidential, if sharing it would likely reveal who gave it. You may also deny access (164.524(a)(3)) in three situations where the patient gets a right to review. In each one, a licensed health care professional has to make the call. First, access is reasonably likely to endanger the life or physical safety of the patient or someone else.

Second, the record mentions another person who is not a health care provider, and access is reasonably likely to cause that person substantial harm. Third, the request comes from a personal representative (someone legally acting for the patient, such as a parent or guardian). Here, giving that person access is reasonably likely to cause substantial harm to the patient or someone else. A right to review means the patient can ask for a second look. A different licensed health care professional, one who did not make the first decision, reviews the denial.

Notice what is missing. An unpaid balance is not a ground for denial. Withholding records until a bill is paid is one of the most common small-practice mistakes, and it is flatly impermissible. The patient owes you money and you owe them their records. Both things are true at once.

OCR Guidance and Enforcement Examples

Since 2019, OCR has announced 56 right-of-access enforcement actions (the count as of October 2026), and the respondent list is full of small and mid-size providers, not health systems. The fact patterns are boring on purpose: a request ignored for months, a fee that included search time, records sent only after the complaint arrived. Amounts have run from a few thousand dollars into six figures. Settlements usually come with a corrective action plan (a written list of fixes) and OCR monitoring. The broader patient-rights picture is in the provider guide to patient rights under HIPAA.

Three of those cases show the range. The first, in September 2019, cost Bayfront Health St. Petersburg $85,000 after it gave a mother her records more than nine months after she asked. The 55th, announced August 27, 2026, cost Azul Vision $50,000 plus two years of OCR monitoring for missing the 30-day deadline on one patient's request. The 56th, announced October 8, 2026, cost Shen Smiles, a dental practice, $140,000 after a complaint that it failed to provide timely access.

Documenting Responses and Denials

The rule names two things you must document, and 45 CFR 164.530(j) requires you to keep both for six years. First, under 164.524(e), "the designated record sets that are subject to access by individuals" and "the titles of the persons or offices responsible for receiving and processing requests for access." Second, every denial is a written notice "in plain language" that states the basis for the denial, the patient's review rights if they apply, and how to complain to your practice or to HHS, including "the name, or title, and telephone number" of your privacy contact.

Log every request beyond that: the date received, who asked, how you verified identity, the 30-day due date, the fee charged, and the date the records went out. If a patient complains to OCR, that log is how you show you acted on time.

Practical Checklist for Practice Managers

Five pieces, one page:

• A log where every request lands the day it arrives.
• One named owner.
• The 30-day date calendared at intake.
• A standard fee sheet built from actual copying costs.
• A denial template that includes the review rights, for the rare case you need it.

Then train the front desk to route every request into the log, because the requests that generate complaints are the ones that never made it into any system. Your Notice of Privacy Practices already promises patients this process. The workflow is just keeping that promise.

FAQ

What is the Right of Access?

The Right of Access lets patients request and receive their health records from covered entities (45 CFR 164.524).

How should a practice verify a request?

Verify identity and authority before releasing records and log the verification steps.

What formats can patients request?

Provide records in the format requested if readily producible, and document format decisions. If it is not, agree with the patient on another readable format.

When can a request be denied?

Deny only for permissible legal exceptions and provide a written, plain-language reason, the patient's review rights where they apply, and how to complain.

How long does a practice have to provide medical records under HIPAA?

30 days from the day you receive the request. You can extend once, by up to 30 more days. To do that, give the patient a written statement of why you need more time and the date you will finish. State law can be shorter. HHS calls 30 days an outer limit and urges practices to respond as soon as they can.

Can we withhold records because the patient owes money?

No. An unpaid balance is not a permitted ground for denying access under 45 CFR 164.524. You can pursue the balance separately, but the records must be provided.

What can we charge for copies of medical records?

A reasonable, cost-based fee covering only copying labor, supplies, postage, and an agreed summary or explanation. Search and retrieval time cannot be charged to the patient, and state fee caps may apply on top.

Are psychotherapy notes included in the right of access?

No. Psychotherapy notes kept separate from the rest of the record are excluded, as is information compiled for legal proceedings. The underlying chart, medications, and test results remain accessible.

Can a patient have us send records to someone else?

Yes. A patient can direct you, in a signed written request, to send an electronic copy of their PHI to a third party they identify, such as another provider or an attorney.

If your records-request process is "the front desk figures it out," you are one annoyed patient away from an OCR complaint. The Full-Scope plan includes policy and procedure templates. It also includes four hours a month of one-on-one implementation calls with Chuck. Use that time to set up the intake log, the fee sheet, and the response templates, and to talk through odd requests. Start with a free 30-minute intro call. No obligation, no pressure.

One Guy Consulting in 37 seconds

Sources

• 45 CFR 164.524 (access of individuals to PHI)
• 45 CFR 164.501 (designated record set definition)
• HHS Right of Access Initiative enforcement actions
• HHS OCR, Individuals’ Right under HIPAA to Access their Health Information (guidance)
• 45 CFR 164.514(h) (verification of identity and authority)
• 45 CFR 164.502(g) (personal representatives)
• 45 CFR 164.530(j) (documentation and six-year retention)
• HHS, The HIPAA Privacy Rule
• Texas Health and Safety Code 181.102 (consumer access to electronic health records)
• HHS OCR, OCR Settles First Case in HIPAA Right of Access Initiative (Bayfront Health St. Petersburg, 2019)
• HHS, OCR Settles HIPAA Right of Access Investigation with Azul Vision, Inc. (August 27, 2026)
• HHS, OCR Settles HIPAA Privacy Rule Investigation with Shen Smiles, P.C. (October 8, 2026)

---

Related Reading

• Patient rights under HIPAA: a provider guide
• HIPAA Privacy Rule requirements
• Notice of Privacy Practices guide

Related reading: HIPAA vs the Cures Act: May Share, May Not Block, How They Fit