Patient Record Requests Under HIPAA

The HIPAA right of access is one of the Privacy Rule’s most enforced provisions. Since 2019, OCR has run an active enforcement initiative targeting right of access violations and has settled dozens of cases against covered entities of all sizes, including small practices.

What Patients Have the Right to Access

Under 45 CFR § 164.524, patients have the right to inspect and obtain copies of their protected health information in a designated record set.

The designated record set includes:

• The medical record: clinical notes, lab results, imaging reports, treatment plans, medication records, progress notes
• The billing record: claims submitted, payments received, balances, EOBs, insurance information
• Any other records used to make decisions about the individual’s care or payment for care

What is excluded from the designated record set:

• Psychotherapy notes kept separately from the medical record (these are specifically excluded under 45 CFR § 164.524(a)(1))
• Information compiled in anticipation of or for use in litigation
• Quality improvement or peer review records that are separately maintained and not used for individual care decisions

The right of access applies to PHI the clinic maintains. A patient cannot use this right to compel the clinic to obtain records from another provider.

The 30-Day Response Timeline

After receiving a request, the clinic must:

• Provide access (or a denial with explanation) within 30 calendar days
• If records are stored off-site and cannot be retrieved within 30 days, one 30-day extension is allowed, but the clinic must notify the patient in writing within the original 30-day window that an extension is needed and why

The clock starts when the clinic receives the request - not when it processes it, verifies identity, or gets around to it. A response sent on Day 35 without a timely extension notice is a violation even if the records are eventually provided.

Format Requirements

Patients can request records in a specific format. The clinic must:

• Provide records in the requested format if it can readily produce records in that format
• If the clinic cannot produce records in the requested format, it must provide the records in a readable format and explain why the requested format is unavailable

Electronic records: If the PHI is maintained electronically and the patient requests an electronic copy, the clinic must provide it in an electronic format. It may ask the patient to specify a preferred format (PDF, direct portal download, USB drive, email) but cannot force the patient to accept paper when electronic is readily available.

Paper records: If the patient requests paper copies, the clinic may fulfill the request with paper, even if electronic copies are also available.

Sending paper copies to a patient who specifically requested a CD or portal download does not satisfy the request.

Fee Limits

Clinics may charge patients a reasonable, cost-based fee for records copies. What that means:

Allowed:

• Labor for copying (per-page labor for paper; staff time to create an electronic file)
• Supplies for paper copies
• Postage if mailed
• Preparation of a summary, if the patient requested a summary

Not allowed:

• Search fees (the time to locate the record in the system)
• Retrieval fees (overhead for looking up the account)
• Verification fees (confirming the patient’s identity before processing the request)
• Any fee that functions as a barrier to access

Many states have fee caps stricter than HIPAA’s federal standard. New York, for example, has a statutory fee schedule for medical records that overrides the cost-based calculation for some record types. Check your state’s law before setting your fee schedule.

When the Clinic Can Deny Access

The right of access is strong but not unlimited. Clinics may deny access in limited circumstances:

Grounds for Denial	Reviewable?
Information is likely to endanger the life or safety of the patient or another person (clinical determination)	Yes. Patient can request a review by a licensed professional.
Information was compiled in anticipation of litigation	No
Information references another person and access would cause harm to that person	Yes. Reviewable.
Information is excluded from the designated record set (psychotherapy notes, quality improvement records)	No. Not subject to access.

Denying access because the clinic doesn’t want to deal with the request, or because the patient owes a balance, is not a permissible basis for denial. OCR has settled cases specifically against clinics that conditioned records release on payment of past-due bills.

Documentation Requirements

Each records request and response should be documented:

• Date request received
• Form of request (written, email, in-person)
• Patient or authorized representative identity verification method
• Requested format
• Date records provided (or denial issued)
• Format records were provided in
• Any fee charged and the basis for it

This documentation is how the clinic shows it met the 30-day deadline - without it, there is no evidence the request was processed at all.

The OCR Enforcement Pattern

OCR’s right of access enforcement initiative has targeted clinics of all sizes. Common findings in settled cases:

• Failure to respond within 30 days (or within the extended 30-day period)
• Requiring patients to appear in person to pick up records when they requested electronic delivery
• Charging fees that included retrieval or search costs
• Conditioning records release on payment of outstanding balances
• Requiring a specific authorization form when the patient submitted a valid written request

Civil money penalties in these cases have ranged from a few thousand dollars to tens of thousands, depending on the number of violations and prior history.

Build a consistent, documented process for receiving and responding to records requests. Every front desk staff member needs to know it - because the requests come to them, not to the Privacy Officer.

For a complete definition of the patient’s right of access and how it applies in practice, see right of access. Patients also have a related right to amend their records and a right to an accounting of disclosures.