Medical record access laws give many patients significant rights to inspect or obtain health information maintained about them. Under the HIPAA Privacy Rule, covered health-care providers and health plans generally must provide access to protected health information contained in designated record sets, subject to defined exceptions and procedural rules.
What Medical Records Can Patients Request?
HIPAA’s access right reaches more than a doctor’s progress notes. A designated record set can include medical and billing records, claims information, laboratory reports, X-rays, insurance information, and other records used to make decisions about an individual.
The information may be electronic, paper-based, archived, or maintained on behalf of the covered entity by a business associate.
People browsing digital information archives should distinguish publicly available material from private patient records governed by health-information laws.
How Long Can a Provider Take?
Under HIPAA, a covered entity generally must act on a valid access request no later than 30 calendar days after receiving it. If it cannot complete the request in that period, one extension of up to another 30 days may be available if the patient receives the required written explanation within the original period.
Thirty days is an outer federal limit rather than a suggested waiting period. State laws or other rules may sometimes require faster access.
Electronic and Paper Copies
When requested information is readily producible in the requested form and format, HIPAA generally requires the covered entity to provide it that way. Otherwise, the parties may agree on another readable format.
General directory-based research may help locate organizations, but record requests should normally be directed to the provider, health plan, records department, or other entity responsible for the designated record set.
| Access Issue | General HIPAA Rule | Practical Point |
|---|---|---|
| Response time | Generally within 30 days | One qualifying extension may apply |
| Record age | Old records can still qualify | Archiving alone is not a denial reason |
| Format | Requested format when readily producible | Alternatives may be agreed upon |
| Copy fees | Reasonable and cost-based | Only permitted costs may be charged |
What Fees Can Be Charged?
HIPAA permits reasonable, cost-based fees for certain copies. HHS explains that allowable charges can include specified copying labor, supplies, postage when requested, and preparation of an agreed summary or explanation. Searching for and retrieving records is not among the costs HHS lists as chargeable under the HIPAA access provision.
Patients following government-service news coverage should remember that state record-access laws may create additional rights or restrictions beyond the federal baseline.
Can a Provider Deny Access?
HIPAA recognizes limited grounds for denying access. Some denials are reviewable, and a covered entity that denies a request must provide the required written explanation describing the basis and applicable complaint or review rights.
A provider generally cannot demand that a patient justify why the records are wanted and then deny access merely because it dislikes the reason.
Common Record-Request Mistakes
Patients sometimes request only a vaguely described “medical file” when they actually need imaging, billing records, laboratory data, or records covering a particular date range. A precise request can reduce confusion.
Another mistake is assuming HIPAA requires every health-related business or application to provide records under the same rules. HIPAA applies to defined covered entities and business associates, not automatically to every organization holding health-related information.
When Should You Escalate an Access Problem?
Keep copies of the original request, delivery confirmation, responses, invoices, and denial letters. If a covered entity fails to respond or imposes restrictions that appear inconsistent with HIPAA, its privacy officer or HHS Office for Civil Rights may provide complaint channels.
HHS maintains detailed official guidance on the HIPAA right of access.
Frequently Asked Questions
Can patients obtain old medical records?
Generally, HIPAA access rights can apply to records maintained in a designated record set regardless of when they were created, subject to applicable exceptions and retention practices.
Can a provider charge for searching for records?
HHS states that the HIPAA cost-based copy fee does not include costs for searching for and retrieving the requested protected health information.
Can a patient request electronic records?
Yes. HIPAA generally supports obtaining electronic copies when the information is readily producible in the requested electronic form and format.
Keep the Request Specific and Documented
A clear written request identifying the records, dates, and preferred format can make access easier to track. If access is denied or substantially delayed, read the written explanation carefully and compare it with both federal HIPAA rules and applicable state law. Documentation becomes especially important if a complaint or legal dispute follows.
This article provides general legal information and is not a substitute for advice from a qualified attorney about a specific situation.
Leave a Reply