Fulfilling a patient Right of Access request
A patient asking for their own records has strong rights and a hard deadline attached. Right of Access is one of the most enforced parts of HIPAA, and the rules are simpler than most staff expect.
A patient asking for their own records has strong rights and a hard deadline attached. Right of Access is one of the most actively enforced parts of HIPAA — and the rules are simpler than most staff expect.
The essentials
| Deadline | 30 days, with one 30-day extension if you notify the patient in writing with a reason. Many states require faster — the shorter deadline wins. |
|---|---|
| Format | The patient’s requested form and format if you can readily produce it. If they ask for electronic and you hold it electronically, you must provide electronic. |
| Delivery | Including by unencrypted email if that is what they ask for, after you warn them of the risk. You may not refuse on that basis alone. |
| Fees | Reasonable, cost-based only: labour for copying, supplies, postage, and preparing an explanation if requested. Not search or retrieval time. |
| Third parties | Patients may direct a copy to a person or entity they nominate, in writing. |
| Scope | The designated record set — medical and billing records used to make decisions about the patient. Broader than just clinical notes. |
What you may not do
- Require a specific form. You may offer one for convenience; you may not insist on it as a precondition, nor require the request be made in person.
- Require a reason. Do not ask why they want it.
- Withhold for an unpaid bill. An outstanding balance is not grounds to refuse access.
- Charge a per-page rate that exceeds actual cost for electronic copies, or charge for search and retrieval.
- Refuse because the request came by email or phone, provided you can verify identity.
- Delay pending physician review as a routine step. Review is not a permitted reason to miss the deadline.
Handling a request
Log it the day it arrives
Date received starts the clock, however it arrived — phone, email, portal, letter, in person. A single log with dates is your evidence of compliance.
Verify identity reasonably
You must verify, but the method must not be an obstacle. Portal authentication, a known phone number, or standard identifying details are all reasonable. Demanding a notarised form is not.
Confirm scope and format
Everything, or a date range? Electronic or paper? Where should it go? A short clarifying call often reduces the work substantially.
Assemble from the whole record set
Remember imaging, lab results received from outside, and billing records. Do not send only what is convenient to export.
Send it and record what you sent
Note the date, the format, the delivery method, and the fee if any. Keep this with the request log.
The narrow exceptions
Access may be denied only in limited circumstances — psychotherapy notes kept separately, information compiled for legal proceedings, and a small set of cases where a licensed professional determines access is reasonably likely to endanger someone. Most denials carry a right to review by another professional, and the denial must be in writing, explain the basis, and describe how to complain. If you find yourself reaching for an exception, get advice first — these are genuinely narrow.
Make it easy on yourselves
- Publish how to request records on your website, with a named contact.
- Keep a single log with date received, date responded, format and fee.
- Put your fee schedule in writing and make sure it reflects real costs.
- Train reception to recognise a request whatever words the patient uses — they will rarely say “Right of Access”.
- Use the patient portal where you can. It is fast, verifiable, and creates its own audit trail.
FAQ
A lawyer is requesting records. Same rules?
Not necessarily. A patient directing a copy to their attorney is a Right of Access request, with its fee limits and deadline. A third-party request made under a HIPAA authorisation is a different route with different fee rules. How the request is framed decides which applies — read it carefully.
The patient wants records for a minor.
Generally a parent or guardian is the personal representative and holds the right. State law creates significant exceptions — particularly around reproductive, mental health and substance use care for adolescents. Check your state rules; this is one area where federal law defers heavily.
We changed EHR. Do we still have to provide old records?
Yes. Your obligation follows the records, not the system. This is exactly why migration planning must include how legacy data stays accessible — see Preparing for an EHR migration.