Patient Rights Under HIPAA

HIPAA gives patients core rights over their health information: to see and get copies of their records, ask for corrections, get an accounting of disclosures, ask you to limit how you use and share it, ask for confidential communications, get your Notice of Privacy Practices, and file complaints. Below is what providers must do to honor each one.

Patient Rights Under HIPAA: A Healthcare Provider’s Guide

Understanding patient rights under HIPAA rules is fundamental for every healthcare provider. The HIPAA Privacy Rule grants patients a set of rights over their protected health information (PHI). These rights empower patients to control how their health data is used and shared.

They impose corresponding duties on healthcare providers to honor those rights within specified timeframes.

For providers, patient rights compliance is not optional. OCR (the HHS Office for Civil Rights, which enforces HIPAA) made access rights a top priority. In 2019 it launched a Right of Access Initiative. That effort has produced dozens of enforcement actions against providers that did not give patients their records on time. (Learn how the OCR audit program works.) This guide covers each right, your duties, and the deadlines you must meet.

Right to Access Records

What the Right Covers

Under 45 CFR 164.524, patients can inspect and get a copy of their PHI in a designated record set. A designated record set is the set of records you keep about the patient. For a provider, that means medical records, billing records, and any other records used to make decisions about the patient.

This right applies to PHI kept in any form: electronic, paper, or other media. Patients can pick the form and format they want. You must honor that choice if you can readily produce the records that way. If you cannot, give them a readable paper copy or another format you both agree on.

Provider duties

Healthcare providers must:

• Let patients request access. You may require written requests, but only if you tell patients about that rule ahead of time
• Act on the request within 30 days of getting it. You can take one 30-day extension. To use it, tell the patient in writing, within the first 30 days, why you need more time and the date you will finish
• Provide records in the format requested by the patient, including electronic format, if you can readily produce them that way
• Send copies to a third party the patient names. The patient must give you a written, signed request that says who gets the copy and where to send it
• Charge only a reasonable, cost-based fee. It can cover only the labor of making copies, supplies, postage, and preparing a summary if the patient agrees to one
• Not require the patient to provide a reason for the access request

Grounds for Denial

Providers may deny access in limited circumstances:

• Psychotherapy notes are excluded from the general access right
• Information gathered for a lawsuit or other legal proceeding (or because you reasonably expect one) is not covered by the access right
• PHI created during research that includes treatment can be held back while the research is going on. This applies only if the patient agreed to it when joining the research
• PHI you got from someone other than a healthcare provider under a promise of confidentiality can be withheld if access would likely reveal who the source is
• A licensed healthcare professional determines that access is reasonably likely to endanger the life or physical safety of the patient or another person

If you deny access, you must give a written denial in plain language. It must explain the reason. It must tell the patient about any right to have the denial reviewed. (That right applies only when the denial rests on a licensed professional’s judgment about harm.) It must also explain how to complain to you or to HHS. You must still give access to the other records the patient asked for, as far as you can.

The OCR Right of Access Initiative

OCR launched its Right of Access Initiative in 2019 specifically to enforce the patient access rules. It has produced dozens of enforcement actions. Common failures include:

• Failing to provide records within the required 30-day timeframe
• Charging excessive fees for record copies
• Refusing to provide records in the electronic format requested
• Requiring patients to appear in person to obtain their records
• Failing to respond to access requests entirely

Providers should treat every access request as an enforcement-sensitive duty and track requests through a documented process (see HIPAA documentation requirements) so every response goes out on time.

Right to Amend Records

How the Amendment Right Works

Under 45 CFR 164.526, patients can request changes to their PHI in a designated record set. Medical records may have errors. Those errors can affect care, insurance, or other important decisions.

You may require patients to make requests in writing and give a reason. If you do, you must tell them about that rule in advance. Providers must act within 60 days. You can take one 30-day extension. To use it, tell the patient in writing, within the first 60 days, why you need more time and the date you will finish.

Provider duties for Amendment Requests

If the amendment is accepted:

• Amend the record by appending or linking the amendment to the existing information, rather than deleting the original entry
• Notify the patient that the amendment has been accepted
• Make reasonable efforts to inform other parties that the provider knows have received the PHI and that may have relied on it, including business associates (outside vendors that handle PHI for you) and people the patient names

If the amendment is denied:

• Provide a written denial within the required timeframe
• State the basis for the denial clearly
• Inform the patient of their right to submit a written statement of disagreement
• If the patient submits a disagreement, the provider may prepare a written rebuttal
• Append the request, denial, disagreement, and rebuttal (if any) to the designated record set
• Include these items with any future disclosures of the disputed PHI

Grounds for Denying an Amendment

Providers may deny an amendment request if:

• The PHI was not created by the provider (unless the patient shows a reasonable basis to believe the original creator is no longer available to make the change)
• The PHI is not part of the designated record set
• The PHI would not be available for access under the access right
• The PHI is accurate and complete as kept

Right to an Accounting of Disclosures

Scope of the Accounting Right

Under 45 CFR 164.528, patients can get an accounting of disclosures of their PHI from the past six years. This tells them who got their health data and why.

The accounting must include:

• Date of each disclosure
• Name of the organization or person who received the PHI, and their address if known
• Brief description of the PHI disclosed
• Purpose of the disclosure, or a copy of the written request for the disclosure

Disclosures Exempt from Accounting

The following disclosures are not required to be included in an accounting:

• disclosures for treatment, payment, and healthcare operations
• disclosures to the patient who is the subject of the PHI
• disclosures that happen incidentally, as a side effect of an allowed use or disclosure
• disclosures made under a valid authorization (a signed permission form) from the patient
• disclosures for the facility directory or to people involved in the patient’s care
• disclosures for national security or intelligence purposes
• disclosures to correctional institutions or law enforcement under specific terms
• disclosures that are part of a limited data set (PHI with direct identifiers such as names and street addresses removed, shared under a data use agreement)
• disclosures that occurred before the compliance date of the Privacy Rule

Timeline and Fees

Providers must provide the accounting within 60 days of the request. You can take one 30-day extension if you tell the patient in writing why you need it and the date you will finish. The first accounting in any 12-month period must be provided free of charge. For subsequent requests within the same 12-month period, the provider may charge a reasonable, cost-based fee. However, the provider must inform the patient of the fee in advance and give them the chance to withdraw or modify the request.

Right to Request Restrictions

Understanding Restriction Requests

Under 45 CFR 164.522(a), patients can ask providers to restrict uses and disclosures of their PHI. This means they can ask you to limit certain uses even when HIPAA would normally allow them.

Providers are usually not required to agree to a requested restriction. However, there is one important exception: providers must agree to a restriction request if:

• The disclosure is to a health plan for payment or healthcare operations purposes (not treatment)
• The PHI is only about a service that the patient (or someone other than the health plan) has paid out of pocket in full
• No law otherwise requires the disclosure

This mandatory restriction gives patients meaningful control over disclosures to their health insurers when they self-pay for services.

Implementing Restrictions

When a provider agrees to a restriction:

• The restriction must be documented and consistently followed
• All team members should be made aware of relevant restrictions
• The restriction applies to uses and disclosures covered by the agreement, except in emergency treatment situations where the restricted PHI is needed for treatment
• The provider may end a restriction if the patient agrees in writing. A spoken agreement also works if you document it. You may also end it by telling the patient, but then the end applies only to PHI you create or receive after you tell them. You can never end the required self-pay restriction this way

Right to Confidential Communications

What Confidential Communications Means

Under 45 CFR 164.522(b), patients can ask providers to contact them a different way or at a different place. This matters most for patients facing domestic abuse, safety threats, or other situations where normal contact could cause harm.

Healthcare providers must accommodate reasonable requests for confidential communications. For example:

• A patient may request that appointment reminders be sent to a work email address instead of a home address
• A patient may request that billing statements be sent to a post office box
• A patient may request that the provider call a specific phone number rather than the number on file
• A patient may request that communications be sent in sealed envelopes without the provider’s name visible on the exterior

Provider duties

• You may require the request in writing. You may also ask for the new address or contact method and, when it matters, how payment will be handled
• Providers may not require the patient to explain the reason for the request
• You only have to accommodate requests that are reasonable
• Providers should record the request and ensure that communication systems are configured to honor it

Right to File Complaints

How Patients Exercise This Right

Patients have the right to file a complaint if they believe their privacy rights have been violated. Complaints may be filed with:

• The practice’s Privacy Officer or other designated complaint contact
• The HHS Office for Civil Rights via the OCR complaint portal, by mail, or by email

Providers must:

• Explain how to complain in the Notice of Privacy Practices
• Not retaliate against any person who files a complaint or assists in an investigation
• Designate a contact person to receive complaints and provide information about the complaint process
• Document every complaint you receive and what you did about it

OCR investigates complaints to find out whether a violation occurred. If it finds violations, it may take enforcement action. Understanding the penalties that can result from complaints underscores the importance of responding properly to a HIPAA complaint. Our step-by-step guide covers what to do when a complaint is filed.

Provider duties and Notice of Privacy Practices

The Notice of Privacy Practices

The key document for patient rights is the Notice of Privacy Practices (NPP). Under 45 CFR 164.520, covered entities (the providers, health plans, and clearinghouses HIPAA applies to) must give patients a clear written notice. It must describe:

• How the practice uses and discloses PHI
• The patient’s rights regarding their PHI
• The practice’s legal duties about PHI
• Who to contact for more information or to file a complaint
• Effective date of the notice

Providers with direct treatment relationships must:

• Provide the NPP at the first service encounter (except in emergency treatment situations)
• Make a good faith effort (except in an emergency) to obtain the patient’s written acknowledgment of receipt
• Post the NPP in a prominent location at the service delivery site
• Post the NPP prominently on the practice’s website if it has one

Timeline Summary for Provider duties

For a broader overview of compliance duties, see our complete HIPAA compliance guide and our guide on HIPAA Privacy Rule requirements.

Patient Rights FAQ

Can we charge patients for copies of their medical records?

Yes, but only a reasonable, cost-based fee. You can charge for the labor of making copies, supplies, postage (if mailed), and preparing a summary or explanation if the patient agrees to one. You may not charge for time spent finding and pulling the records. Some states also set their own limits on copy fees, so check your state’s rules.

What if a patient requests their records in an electronic format we do not use?

If you keep the PHI electronically and the patient asks for it in an electronic format, you must provide it in that format if readily producible. If you cannot readily produce that format, work with the patient to agree on another readable electronic format. If the patient does not accept any electronic format, a paper copy may be an option if the patient accepts it.

Can a patient’s family member request their records?

Only if the family member is a personal representative with legal authority to act on the patient’s behalf. For adults, this often requires a healthcare power of attorney, legal guardianship, or other legal documents. For minor children, parents usually serve as personal representatives, with exceptions for certain types of care where state law grants minors privacy rights.

How long must we retain medical records to comply with HIPAA?

HIPAA requires covered entities to keep documentation of their HIPAA compliance work (policies, procedures, risk analyses) for six years. The clock starts when the document was created or when it was last in effect, whichever is later. However, HIPAA does not set specific retention periods for medical records themselves. Medical record retention is set by state law.

The required period varies by state, so check your state’s rules.

What happens if we miss the 30-day deadline for providing record access?

Failing to provide timely access violates the Privacy Rule. It can lead to an OCR complaint, an investigation, and enforcement action. The OCR Right of Access Initiative has produced dozens of enforcement actions. Many were against providers that missed the 30-day deadline. Track every access request and put its deadline on the calendar as soon as it arrives.

Patient Rights Takeaways

Patient rights under HIPAA are not abstract legal concepts. They are enforceable duties that OCR actively enforces. Set up clear procedures for receiving, tracking, and responding to patient rights requests. Practices that do this protect both their patients and themselves from the consequences of noncompliance.

One Guy Consulting walks small practices through software and a step-by-step process for becoming HIPAA compliant. The Full-Scope plan includes 4 hours a month of 1:1 implementation calls with Chuck. For legal advice about a specific patient request, speak with a lawyer. Contact us today to get started.

Frequently Asked Questions

What are the patient rights under HIPAA?

The patient rights under HIPAA include the right to access their medical records (45 CFR 164.524), the right to request amendments to their records (164.526), the right to an accounting of disclosures (164.528), the right to request restrictions on uses and disclosures (164.522), the right to request confidential communications (164.522), the right to receive a Notice of Privacy Practices (164.520), and the right to file a complaint (164.530). Providers must act on access requests within 30 days. They can take one 30-day extension.

Can a patient request all their medical records under HIPAA?

Yes. Under the HIPAA Right of Access, patients can request a copy of any protected health information maintained in a designated record set. This includes medical records, billing records, lab results, and other records used to make decisions about the patient. Providers may charge a reasonable, cost-based fee for copies. They cannot deny access because of an unpaid bill for services. OCR has announced dozens of Right of Access enforcement actions since 2019.

Sources

• 45 CFR 164.524: Access of Individuals to PHI
• 45 CFR 164.526: Amendment of PHI
• 45 CFR 164.528: Accounting of Disclosures
• 45 CFR 164.522: Rights to Request Privacy Protection
• HHS: Your Right to Access Your Health Information

Related Reading

• Protected Health Information Guide
• PHI vs PII vs ePHI
• Notice of Privacy Practices Guide
• HIPAA Authorization Form Requirements
• HIPAA Minimum Necessary Rule
• HIPAA De-Identification Requirements

Related reading: HIPAA vs the Cures Act: May Share, May Not Block, How They Fit