HIPAA Right of Access: How to Handle Patient Requests Under 45 CFR 164.524

Short answer: The HIPAA right of access, set out in 45 CFR 164.524, lets individuals inspect and get a copy of their PHI in a covered entity's designated record set. You must act within 30 calendar days, with one 30-day extension, provide the requested electronic format if readily producible, charge only a reasonable cost-based fee and deny only on narrow listed grounds.

Related guides:

• HIPAA Privacy Rule
• GDPR right of access
• What is considered PHI under HIPAA?

Key takeaways

• Scope is the designated record set. Records used to make decisions about individuals, including those a business associate keeps for you, are in scope.
• Thirty days is the outer limit. One 30-day extension is allowed only with a written notice sent inside the first 30 days.
• Fees are narrow. Copying labor, supplies and postage may be charged. Search, retrieval and verification may not.
• Denials are rare by design. Most grounds are listed exceptions, and the harm-based grounds carry a right to review.
• Business associates are on the clock too. Time spent routing a request through a vendor counts against the covered entity's deadline.

What does the HIPAA right of access cover, and who can ask?

The right covers PHI in a designated record set, and it can be exercised by the individual, by a personal representative, or by the individual directing a copy to someone else.

A designated record set, defined in 45 CFR 164.501, is the group of records maintained by or for a covered entity that are used, in whole or in part, to make decisions about individuals. HHS's FAQ on what individuals can access lists medical and billing records, payment and claims records, health plan enrollment records and case management records. It also lists what sits outside the right:

• Psychotherapy notes kept separately from the medical record.
• Information compiled for a legal proceeding, although the underlying PHI stays accessible.
• Records not used for decisions about individuals, such as quality improvement, patient safety, peer review and provider performance files.

You do not have to create new information, such as analyses, to answer a request. For a HealthTech product, map which tables, documents and exports feed clinical or payment decisions; those are your designated record set. If you are unsure what counts as PHI in the first place, start with our PHI guide.

Who can request:

Requester	What applies
The individual	The core right in 45 CFR 164.524
Personal representative	Per the HHS Privacy Rule summary, someone legally authorized to make health care decisions for the individual, generally treated as the individual, unless you reasonably believe there is abuse, neglect or endangerment
Third party named by the individual	The individual's request must be in writing, signed, and clearly identify the recipient and where to send the PHI, per HHS's third-party directive FAQ

Third-party directives have a court-ordered limit. HHS's notice on Ciox Health v. Azar explains that the directive was vacated to the extent it reached beyond requests for a copy of an electronic health record in electronic format, and that the fee limits now cover only the individual's own requests.

How long do you have to respond?

You must act no later than 30 calendar days after receiving the request, with one extension of up to 30 more days.

HHS's timeliness FAQ sets out the rules:

1. Day 0: the clock starts when the request is received, including by a business associate acting for you.
2. By day 30: grant access, deny in writing, or send a written extension notice giving the reasons for the delay and the date you will complete the request.
3. By day 60: the extended request must be completed.

Retrieving PHI from a business associate, negotiating the format and pulling archived records do not pause the clock. HHS calls these deadlines outer limits and expects many entities to respond much sooner, releasing records in portions if the individual wants that.

What format must you use, and what can you charge?

Provide PHI in the form and format requested if it is readily producible, and charge no more than a reasonable, cost-based fee.

Form and format. HHS's electronic copy FAQ says that if you hold PHI electronically, individuals generally have a right to an electronic copy in the format they ask for if you can readily produce it, or else in an agreed readable electronic format. Paper satisfies the request only if the individual declines every electronic format you can readily produce.

Delivery method. If an individual asks for their PHI by unencrypted email, HHS's transmission FAQ says you should warn them about the risk in transit, confirm they still want it, and then send it. You cannot force them to accept an unsecure channel.

Fees. HHS's fee FAQ separates allowed and disallowed costs:

May include	May not include
Labor to create and deliver the copy once PHI is compiled	Reviewing the request
Supplies such as a USB drive, if the individual asks for portable media	Searching for, retrieving and segregating PHI
Labor to prepare a summary, if agreed in advance	Systems, storage and HIPAA compliance costs such as verification
Postage, if mailing is requested	Other costs, even if state law allows them

HHS's fee calculation FAQ describes three methods: actual costs, a schedule of average costs, or a flat fee for electronic copies of electronically maintained PHI that cannot exceed $6.50 including labor, supplies and postage. HHS considers per-page fees unreasonable for electronic PHI and encourages free copies where possible. Both fee FAQs note they apply only to the extent consistent with the Ciox order.

When can you deny a request?

You can deny only on grounds listed in 164.524, and denials based on potential harm give the individual a right to have the decision reviewed.

The HHS Privacy Rule summary and HHS's denial FAQ group the grounds this way:

Type	Examples of grounds	Review right?
Unreviewable	Psychotherapy notes; information compiled for legal proceedings; certain inmate requests; research information the individual agreed not to access; Privacy Act records; information obtained from someone else under a promise of confidentiality	No
Reviewable	A licensed health care professional determines access is reasonably likely to endanger the life or physical safety of the individual or another person, or could cause substantial harm to another person	Yes, by a licensed professional who was not involved in the original denial

HHS says the endangerment ground is narrow and should apply only in extremely rare cases. Concern that a patient might be upset or confused by their records is not enough. A denial must be written in plain language, sent within the same 30 or 60 days, state the basis, explain any review rights and explain how to complain to you or to HHS OCR. You must still give access to the rest of the requested PHI.

What do business associates have to do?

A business associate must support access to PHI it holds in a designated record set, in the way the BAA specifies, and within the covered entity's deadline.

HHS's business associate FAQ says the right extends to PHI a business associate maintains on behalf of a covered entity. The covered entity stays responsible for the response. The BAA decides whether the vendor answers individuals directly or passes PHI back for the covered entity to provide. The 30 or 60 day limit still applies, even when the request first lands with the business associate, and the fee limits apply to PHI the vendor holds.

For a HealthTech SaaS company, that means:

• Agree in each BAA who responds, how requests are forwarded and how fast. In our experience, customers expect a few business days for an export so they keep time for their own review.
• Build a self-service or admin export that produces a patient's records in common machine-readable and human-readable formats.
• Route any request that reaches your support team to the customer the same day, with a timestamp.

Our business associate agreement guide covers the wider contract terms.

How to respond to a medical records request under HIPAA: step by step

Run every request through one tracked workflow, from intake to closure, so you can show OCR what happened and when.

1. Intake and timestamp. Log the date received from any channel, including portal, email, fax and requests to a vendor. Day 0 starts here.
2. Verify the requester. Confirm identity, or the authority of a personal representative, in a way that does not create needless barriers.
3. Classify the request. Is it the individual's own copy, an inspection, or a third-party directive? Check the Ciox limits for directives.
4. Scope the designated record set. Pull records from every system in your inventory, including business associates.
5. Check denial grounds. Separate any psychotherapy notes or litigation material. Send harm concerns to a licensed professional and record the determination.
6. Produce in the requested form and format. Offer an agreed alternative if the format is not readily producible.
7. Calculate any fee. Use actual, average or flat-fee methods and tell the individual the approximate fee in advance.
8. Deliver and close. Send by the chosen channel, warning about unencrypted email if relevant, and file the request, response, any extension or denial notice and the dates.

If work is still outstanding near day 30, send the written extension notice.

How does OCR enforce access, and where does information blocking fit?

OCR enforces the right through its Right of Access Enforcement Initiative, and HealthTech teams that qualify as actors must also consider the ONC information blocking rules.

OCR announced the first settlement under the initiative in September 2019, involving a hospital that failed to give a mother timely access to records. In an August 27, 2026 announcement, OCR described its settlement with Azul Vision as the 55th enforcement action in the initiative, after a patient waited about two years for records. Both cases turned on delay, which is why the timeline step matters most.

Information blocking is a separate regime. The ONC information blocking rules in 45 CFR part 171 apply to actors: health care providers, developers of certified health IT, and health information networks or exchanges. ONC's business associate FAQ says a business associate may or may not be an actor depending on those definitions, and that HIPAA status does not exempt it. If you are an actor, slow-walking an access request can raise both HIPAA and information blocking questions.

Compared with Europe, the HIPAA right is narrower in scope but similar in spirit. The GDPR covers all personal data, and its Recital 59 expects responses within one month and access free of charge. Our GDPR right of access guide covers that side.

How SecureSlate helps

SecureSlate helps HealthTech teams run the right of access as a governed, evidenced process. Multi-framework control mapping ties your HIPAA access policy to related SOC 2, ISO 27001, HITRUST and GDPR controls, and custom controls let you add steps such as request intake, extension notices and denial reviews. Audit management keeps request records and evidence in one place, and risk management tracks gaps such as systems missing from your designated record set inventory. Vendor risk management tracks the business associates that hold PHI for you, while agentless read-only cloud integrations and access reviews help confirm who can reach patient data.

FAQ

What is the HIPAA right of access?

It is the right in 45 CFR 164.524 for individuals to inspect and obtain a copy of their PHI in a designated record set held by a covered entity or by a business associate on its behalf, subject to narrow exceptions.

How long does a provider have to respond to a medical records request?

No later than 30 calendar days after receipt. One extension of up to 30 more days is allowed if the individual gets a written notice within the first 30 days stating the reasons and the expected completion date.

Can we charge patients for copies of their records?

Only a reasonable, cost-based fee covering copying labor, supplies and postage, or a flat fee of up to $6.50 for electronic copies of electronic records. Search and retrieval costs are not allowed, and HHS encourages free copies.

Does the right of access apply to business associates?

Yes, for PHI a business associate maintains in a designated record set for a covered entity. The covered entity remains responsible, and the BAA sets whether the vendor responds directly or through the covered entity.

Disclaimer (legal note)

This article is for general information only and is not legal, regulatory or professional advice. Requirements vary by framework, industry and jurisdiction. Consult qualified advisors for your specific obligations.