Right of access
Patients' right to see and get copies of their health records: deadlines, formats, fees, third-party requests, and what a small practice needs in place.
Right of access at a glance
Under the HIPAA right of access (45 CFR 164.524), patients can inspect and get copies of their health records held in a designated record set, in the electronic form they request if readily producible, and can direct that an electronic copy of PHI in an EHR be sent to a third party. A covered entity must act within 30 days, with one 30-day extension, and may charge only a reasonable, cost-based fee. Psychotherapy notes are excluded.
| Rule | 45 CFR 164.524 |
|---|---|
| Deadline | 30 days from the request; one 30-day extension with written notice |
| Format | The form and format requested if readily producible, including electronic copies |
| Fees | Reasonable, cost-based: copying labor, supplies, postage |
| Third parties | Electronic copy of EHR data to a designated third party (narrowed by Ciox Health v. Azar, 2020) |
| Excluded | Psychotherapy notes; information compiled for legal proceedings |
What patients can ask for
Patients have a right to inspect and get a copy of PHI about them in a designated record set — medical and billing records and other records used to make decisions about them (164.524(a)). They can ask for it:
- on paper or electronically — if the records are kept electronically and the patient asks for an electronic copy, you must provide it in the form they want if readily producible, or another readable electronic form you agree on;
- sent to someone else — the regulation requires you to send a copy to a person the patient designates in a signed written request. After the 2020 Ciox Health v. Azar decision, this third-party directive applies only to an electronic copy of PHI held in an electronic health record; other requests to send records to third parties are handled as ordinary disclosures, usually with an authorization.
Deadlines
| Step | Deadline |
|---|---|
| Act on the request | Within 30 days of receipt |
| Extension | Once, up to 30 more days, with a written explanation to the patient |
Fees
When patients request their own copy, only a reasonable, cost-based fee covering labor for copying, supplies for paper or portable media, postage, and preparing a summary if the patient agrees to one (164.524(c)(4)). The same court decision struck down HHS guidance applying these fee limits to copies sent to third parties, so the cost-based limit applies to patients’ own requests, not to third-party directives.
What can be withheld
Psychotherapy notes and information compiled for legal proceedings are excluded from the right of access. Other denials are limited and may require offering a review.
What a practice needs
- A simple written process and someone responsible for requests.
- Tools that can find and export a patient’s full record quickly — an important test when choosing an EHR.
- A log of requests and response dates.
OCR has made right-of-access delays a frequent enforcement focus, so slow responses are one of the easiest ways for a small practice to end up with a penalty.
Guides
Related requirements
Frequently asked questions
How long does a provider have to give a patient their records?
No later than 30 days after receiving the request. If the provider can't meet that deadline it may extend once by up to 30 days, after telling the patient in writing why and when they'll get the records.
Can a practice require patients to sign a release form to get their own records?
No authorization is needed for a patient's own records. A practice may require access requests in writing if it tells patients so, but it should not demand an authorization form.
Can a provider refuse access until a bill is paid?
No. Access can't be conditioned on paying for health care services. Only a reasonable, cost-based fee for the copy may be charged.