Most HIPAA enforcement stories involve breaches, hackers, and six-figure settlements against hospital systems. The Right of Access Initiative is different. It is the one OCR enforcement program that routinely reaches solo practices and small clinics, and the trigger is always the same mundane failure: a patient asked for their records and the practice sat on the request.
The rule behind it is 45 CFR 164.524, and it is one of the most patient-favorable provisions in all of HIPAA. Here is what it requires, what you can charge, when you can say no, and the simple workflow that keeps you out of the complaint queue.
HIPAA Right of Access: What 45 CFR 164.524 Requires
What Patients Can Get: The Designated Record Set
Patients have a right to inspect and obtain a copy of their P.H.I. (Protected Health Information) in the "designated record set." Under 45 CFR 164.501, that means the medical records and billing records maintained by or for the provider, plus any records used, in whole or in part, to make decisions about the individual.
Translation: the chart, the billing file, and anything you relied on to make care or payment decisions, including records you received from other providers. Not your quality committee minutes. Not your incident reports. And two named exceptions: psychotherapy notes kept separate from the chart, and information compiled for legal proceedings.
The Clock: 30 Days, One Extension, No Stalling
The regulation is blunt: the covered entity "must act on a request for access no later than 30 days after receipt of the request." You get one extension of up to 30 more days, and only if you give the patient written notice of the delay and the date you will finish. One extension. The rule says so explicitly.
State law can shorten that clock, and some states do. Texas gives providers 15 days, which is covered in the Texas requirements article. Your policy follows the shorter clock.
Thirty days is also a ceiling, not a target. HHS has said repeatedly that it expects most requests to be fulfilled well inside the limit. A same-week turnaround is a realistic standard for a small practice with an EHR.
Fees: Cost-Based Means Cost-Based
You may charge a "reasonable, cost-based fee." Under 164.524(c)(4) it can include only: labor for copying, supplies (paper, or the USB drive), postage, and preparing a summary if the patient agreed to one.
What it cannot include is the thing practices most want to charge for: searching for and retrieving the record. Locating the chart is your cost, not the patient's. A $75 "records processing fee" is how a routine request becomes an OCR complaint. If a patient just wants to look at the chart, or wants records sent through your portal at no marginal cost to you, the defensible fee is zero.
Form and Format
Provide the copy in the form the patient asks for when you can readily produce it that way, including electronic. If the patient asks for email or mail, you cannot require an in-person pickup. Patients can also direct you in writing to send an electronic copy to a third party, such as another provider or an attorney. Requests that arrive through a patient's app or attorney carry some extra wrinkles on fees; take those case by case and get advice when the request is unusual.
Denials: A Short List, and Unpaid Bills Are Not On It
You may deny access without any review in narrow cases: the psychotherapy notes and legal-proceedings exceptions above, certain correctional and research situations, and records obtained from a source under a promise of confidentiality. You may deny with a right to review in essentially one situation: a licensed professional determines access is reasonably likely to endanger someone's life or physical safety.
Notice what is missing. An unpaid balance is not a ground for denial. Withholding records until a bill is paid is one of the most common small-practice mistakes, and it is flatly impermissible. The patient owes you money and you owe them their records. Both things are true at once.
The Right of Access Initiative: Small Practices, Real Money
Since 2019, OCR has settled dozens of right-of-access cases, and the respondent list is full of small and mid-size providers, not health systems. The fact patterns are boring on purpose: a request ignored for months, a fee that included search time, records sent only after the complaint arrived. Settlements have run from a few thousand dollars into six figures, and every one comes with a corrective action plan and monitoring. The broader patient-rights picture is in the provider guide to patient rights under HIPAA.
The Workflow That Keeps You Off the List
Five pieces, one page: a log where every request lands the day it arrives; one named owner; the 30-day date calendared at intake; a standard fee sheet built from actual copying costs; and a denial template that includes the review rights, for the rare case you need it. Then train the front desk to route every request into the log, because the requests that generate complaints are the ones that never made it into any system. Your Notice of Privacy Practices already promises patients this process. The workflow is just keeping that promise.
---
FAQ
How long does a practice have to provide medical records under HIPAA?
30 days from receipt of the request, with one extension of up to 30 more days if the patient gets written notice of the delay. State law can be shorter, and OCR expects most requests to be handled well inside the limit.
Can we withhold records because the patient owes money?
No. An unpaid balance is not a permitted ground for denying access under 45 CFR 164.524. You can pursue the balance separately, but the records must be provided.
What can we charge for copies of medical records?
A reasonable, cost-based fee covering only copying labor, supplies, postage, and an agreed summary. Search and retrieval time cannot be charged to the patient, and state fee caps may apply on top.
Are psychotherapy notes included in the right of access?
No. Psychotherapy notes kept separate from the rest of the record are excluded, as is information compiled for legal proceedings. The underlying chart, medications, and test results remain accessible.
Can a patient have us send records to someone else?
Yes. A patient can direct you in writing to send an electronic copy of their PHI to a third party they identify, such as another provider or an attorney.
Conclusion
If your records-request process is "the front desk figures it out," you are one annoyed patient away from an OCR complaint. One Guy Consulting builds the intake log, the fee sheet, and the response templates as part of the Full-Scope plan, with four hours of consulting a month to handle the weird requests. Start with a free 30-minute compliance review. No obligation, no pressure.
Sources
- 45 CFR 164.524 (access of individuals to PHI)
- 45 CFR 164.501 (designated record set definition)
- HHS Right of Access Initiative enforcement actions
Related Reading