Under the HIPAA right of access (45 CFR 164.524), patients can see or get a copy of their records. You must act within 30 days. You get one 30-day extension if you send a written reason and finish date. You may charge only a cost-based copy fee. You cannot charge for search time or hold records over an unpaid bill.
Most HIPAA enforcement stories involve breaches, hackers, and six-figure settlements against hospital systems. The Right of Access Initiative is different. It is an OCR enforcement program that often reaches solo practices and small clinics. The trigger is usually the same everyday failure: a patient asked for their records and the practice sat on the request.
The rule behind it is 45 CFR 164.524, and it is one of the most patient-favorable provisions in all of HIPAA. Here is what it requires, what you can charge, when you can say no, and the simple workflow that keeps you out of the complaint queue.
HIPAA Right of Access: What 45 CFR 164.524 Requires
What Patients Can Get: The Designated Record Set
Patients have a right to inspect and obtain a copy of their PHI (protected health information) in the "designated record set." Under 45 CFR 164.501, that means the medical records and billing records maintained by or for the provider, plus any records used, in whole or in part, to make decisions about the individual.
Translation: the chart, the billing file, and anything you relied on to make care or payment decisions, including records you received from other providers. Not your quality committee minutes. Not your incident reports. And two named exceptions: psychotherapy notes kept separate from the chart, and information compiled for legal proceedings.
The Clock: 30 Days, One Extension, No Stalling
The regulation is blunt: the covered entity (your practice) "must act on a request for access no later than 30 days after receipt of the request." You can extend that once, by up to 30 more days. To do it, you must give the patient a written statement within the first 30 days. It has to say why you need more time and the date you will finish. One extension. The rule says so explicitly.
State law can shorten that clock, and some states do. Texas gives providers 15 business days for records kept in an electronic health record, which is covered in the Texas requirements article. Your policy follows the shorter clock.
Thirty days is also a ceiling, not a target. HHS guidance says 30 days is an outer limit, meaning the most time you should take. It urges practices to respond as soon as they can. A same-week turnaround is a realistic standard for a small practice with an EHR.
Fees: Cost-Based Means Cost-Based
You may charge a "reasonable, cost-based fee." Under 164.524(c)(4) it can include only: labor for copying, supplies (paper, or the USB drive), postage, and preparing a summary or explanation if the patient agreed to one.
What it cannot include is the thing practices most want to charge for: searching for and retrieving the record. Locating the chart is your cost, not the patient's. A $75 "records processing fee" is how a routine request becomes an OCR complaint. If a patient just wants to look at the chart, or wants records sent through your portal at no marginal cost to you, the defensible fee is zero.
Form and Format
Provide the copy in the form the patient asks for when you can readily produce it that way, including electronic. If the patient asks for email or mail, you cannot require an in-person pickup. Patients can also direct you, in a signed written request, to send an electronic copy to a third party, such as another provider or an attorney. Requests that arrive through a patient's app or attorney carry some extra wrinkles on fees; take those case by case and get advice when the request is unusual.
Denials: A Short List, and Unpaid Bills Are Not On It
You may deny access without any review in narrow cases: the psychotherapy notes and legal-proceedings exceptions above, certain correctional and research situations, certain records covered by the federal Privacy Act, and information someone other than a health care provider gave you on a promise to keep it confidential, if sharing it would likely reveal who gave it. You may also deny access in three situations where the patient gets a right to review. In each one, a licensed health care professional has to make the call. First, access is reasonably likely to endanger the life or physical safety of the patient or someone else.
Second, the record mentions another person who is not a health care provider, and access is reasonably likely to cause that person substantial harm. Third, the request comes from a personal representative (someone legally acting for the patient, such as a parent or guardian). Here, giving that person access is reasonably likely to cause substantial harm to the patient or someone else. A right to review means the patient can ask for a second look. A different licensed health care professional, one who did not make the first decision, reviews the denial.
Notice what is missing. An unpaid balance is not a ground for denial. Withholding records until a bill is paid is one of the most common small-practice mistakes, and it is flatly impermissible. The patient owes you money and you owe them their records. Both things are true at once.
The Right of Access Initiative: Small Practices, Real Money
Since 2019, OCR has resolved dozens of right-of-access cases, and the respondent list is full of small and mid-size providers, not health systems. The fact patterns are boring on purpose: a request ignored for months, a fee that included search time, records sent only after the complaint arrived. Amounts have run from a few thousand dollars into six figures. Settlements usually come with a corrective action plan (a written list of fixes) and OCR monitoring. The broader patient-rights picture is in the provider guide to patient rights under HIPAA.
The Workflow That Keeps You Off the List
Five pieces, one page: a log where every request lands the day it arrives; one named owner; the 30-day date calendared at intake; a standard fee sheet built from actual copying costs; and a denial template that includes the review rights, for the rare case you need it. Then train the front desk to route every request into the log, because the requests that generate complaints are the ones that never made it into any system. Your Notice of Privacy Practices already promises patients this process. The workflow is just keeping that promise.
FAQ
How long does a practice have to provide medical records under HIPAA?
30 days from the day you receive the request. You can extend once, by up to 30 more days. To do that, give the patient a written statement of why you need more time and the date you will finish. State law can be shorter. HHS calls 30 days an outer limit and urges practices to respond as soon as they can.
Can we withhold records because the patient owes money?
No. An unpaid balance is not a permitted ground for denying access under 45 CFR 164.524. You can pursue the balance separately, but the records must be provided.
What can we charge for copies of medical records?
A reasonable, cost-based fee covering only copying labor, supplies, postage, and an agreed summary or explanation. Search and retrieval time cannot be charged to the patient, and state fee caps may apply on top.
Are psychotherapy notes included in the right of access?
No. Psychotherapy notes kept separate from the rest of the record are excluded, as is information compiled for legal proceedings. The underlying chart, medications, and test results remain accessible.
Can a patient have us send records to someone else?
Yes. A patient can direct you, in a signed written request, to send an electronic copy of their PHI to a third party they identify, such as another provider or an attorney.
If your records-request process is "the front desk figures it out," you are one annoyed patient away from an OCR complaint. The Full-Scope plan includes policy and procedure templates. It also includes four hours a month of one-on-one implementation calls with Chuck. Use that time to set up the intake log, the fee sheet, and the response templates, and to talk through odd requests. Start with a free 30-minute intro call. No obligation, no pressure.
Sources
- 45 CFR 164.524 (access of individuals to PHI)
- 45 CFR 164.501 (designated record set definition)
- HHS Right of Access Initiative enforcement actions
Related Reading
- Patient rights under HIPAA: a provider guide
- HIPAA Privacy Rule requirements
- Notice of Privacy Practices guide
Related reading: HIPAA vs the Cures Act: May Share, May Not Block, How They Fit