A patient walks up to the front desk of a three-physician practice and asks for a copy of her records because she is moving out of state. The receptionist hands her a release form, tells her records requests take four to six weeks, and mentions a $1 per page fee "per our policy." The patient has 220 pages. She leaves without signing, calls the practice twice over the next month, and then files a complaint with the Office for Civil Rights. Nobody at the practice did anything they thought was wrong.
Three things in that exchange were wrong. The timeline was longer than the rule allows without a written extension notice. The fee was not tied to the actual cost of making the copy. And the form was an authorization for disclosure to a third party, which is not what the patient asked for. A patient asking for her own records is exercising the HIPAA right of access, and that right has its own rules, its own clock and its own fee limits.
This article covers those rules as an operating procedure for an independent practice: what counts as an access request, the 30-day clock and the one extension, the fee you may charge, how attorney requests differ, what to do with portal and app requests, and where the Office for Civil Rights (OCR) has been putting its enforcement effort.
Key takeaways
- Under 45 CFR 164.524, a patient or personal representative may inspect and obtain a copy of the designated record set, and the practice must act within 30 calendar days, with one 30-day extension if written notice goes out within the first 30 days.
- The only fee for a patient's own copy is a reasonable cost-based fee for copying labor, supplies, postage and an agreed summary; retrieval and verification labor cannot be charged, and OCR permits a flat fee of up to $6.50 for electronic copies.
- Since the January 2020 Ciox ruling, the HIPAA fee limit applies to the patient's own copy, and third-party directives cover electronic records held in an EHR.
- Requests from attorneys and insurers under a HIPAA authorization are disclosures, not access, and state law usually sets their fees.
- OCR's Right of Access Initiative, running since 2019, has produced more than 50 enforcement actions, most against providers who simply took too long.
What is an access request, and what is not
The right of access belongs to the individual and covers the designated record set: the medical and billing records the practice uses to make decisions about the patient, including clinical notes, results, medication and problem lists and the billing history. It does not include psychotherapy notes kept separate from the chart, information compiled for litigation, or internal quality and peer review materials. The request can come from the patient, from a parent for a minor child in most circumstances, or from a personal representative such as a health care power of attorney or the executor of a deceased patient's estate.
The practice may require the request in writing and may offer its form, but it cannot make the form a barrier: no notarization, no in-person-only rule, no requirement to explain why, and no refusal over an unpaid balance. Identity verification is required and is satisfied by a photo ID or the steps you use to confirm a caller before discussing results; a message through the authenticated portal is already verified.
| Who is asking | Legal basis | Clock | Fee rule |
|---|---|---|---|
| Patient, for their own copy (paper, electronic, portal, email) | Right of access, 45 CFR 164.524 | 30 days, one 30-day extension with written notice | Reasonable cost-based fee only; flat $6.50 option for electronic copies; state caps apply if lower |
| Patient, directing an electronic copy from the EHR to a third party (a new physician, an app) | Right of access, third-party directive (electronic PHI in an EHR) | 30 days, one extension | HIPAA fee limit applies to the patient's own copy; check state law for directives after the 2020 Ciox ruling |
| Attorney, life insurer, employer, with the patient's signed authorization | Disclosure under 45 CFR 164.508 | No HIPAA deadline; state law may set one | State law fee schedule (often per page plus a retrieval fee) |
| Health plan for payment or quality activities (HEDIS, audits) | Treatment, payment or operations; no authorization needed | Contract terms | Usually none; check the payer contract |
| Subpoena or court order | 45 CFR 164.512(e) | As stated in the order | State law |
The 30-day clock, and the one extension
The practice must act on the request no later than 30 calendar days after receiving it: provide the copy, arrange inspection, or issue a written denial. If it cannot meet 30 days, it may take one extension of up to 30 more days, but only if it sends the patient a written statement of the reason and the completion date inside the original 30 days. There is no second extension. A practice that hands records over on day 58 with no notice on file is out of compliance even though the records arrived.
The clock starts when the request is received by anyone at the practice, not when it reaches the records clerk, and it does not pause while you wait for a copying vendor. If a release-of-information vendor handles your requests, the vendor is your business associate and its delays are your delays. HHS proposed in January 2021 to shorten the deadline to 15 days; as of this writing that proposal has not been finalized, and several states already set shorter deadlines that govern where they apply.
What you may charge, with a worked example
For a patient's own copy, HIPAA allows a reasonable, cost-based fee made up of four things: the labor to copy the records, the supplies (paper, toner, a USB drive or CD), postage when the patient asks for mail, and the labor to prepare a summary if the patient agrees to one instead of the full record. It does not allow charges for locating or retrieving the record, reviewing the request, verifying identity, or a per-page rate set by tradition. OCR describes three ways to set the fee: actual cost per request, a schedule of average costs, or a flat fee of no more than $6.50 for electronic copies of electronically held records.
Take the 220-page request from the opening. Copying 220 pages takes roughly 25 minutes of a records clerk's time; at $22 an hour that is $9.17 in labor. Paper and toner at five cents a page is $11.00. Mailing a two-pound package is about $9.00. The cost-based fee is about $29, against the $220 the "policy" would have charged, and the practice must quote the approximate fee in advance if the patient asks. If the same patient wants the records through the portal or as an encrypted PDF, the practice can charge the flat $6.50 or nothing; most practices we work with charge nothing because collecting $6.50 costs more than $6.50. Many states cap fees below the HIPAA limit, and the lower cap wins.
Third parties, attorneys and the Ciox ruling
Two kinds of "send my records to someone else" look alike and are treated differently. When a patient signs a clear written direction to send an electronic copy of EHR records to a specific person (a new physician, a personal health app), that is a third-party directive under the right of access, with the 30-day clock. When a law firm sends a HIPAA authorization signed by the patient asking for the chart for a personal injury case, that is a disclosure under an authorization, and state law fees and timelines apply.
The federal court decision in Ciox Health v. Azar on January 23, 2020 drew the line. It vacated OCR's 2016 guidance that had applied the patient fee limit to third-party directives and limited the directive itself to electronic PHI held in an EHR; OCR confirmed the change days later. The practical result: the cost-based limit applies to a patient's own copy, state law fees may apply to records the patient directs elsewhere, and law firm requests under an authorization were never subject to the HIPAA cap. The safest posture for a small practice is to treat any request that comes from the patient personally under the cost-based rule and reserve the state schedule for attorneys and insurers.
Portals, apps and information blocking
Providing access through the patient portal satisfies the rule when the patient agrees to receive records that way, and most portals now release notes and results automatically. Two cautions. A practice cannot require portal use; a patient who wants paper gets paper. And a request that arrives as a portal message is a request with a clock on it, so the message queue needs an owner.
The ONC information blocking rules, in effect for providers since April 5, 2021 and covering all electronic health information since October 6, 2022, sit alongside HIPAA: delaying results or notes without a recognized exception can be information blocking, and CMS finalized disincentives for providers in June 2024. When a patient asks you to send records to a smartphone app, you may warn that the app is not covered by HIPAA, but you may not refuse because you dislike the app.
Where OCR has been looking
OCR announced its Right of Access Initiative in 2019; the first settlement, with Bayfront Health St. Petersburg for $85,000 in September 2019, involved a mother waiting nine months for fetal heart monitor records. Since then the initiative has produced more than 50 enforcement actions with a consistent pattern: one patient, one request, months of silence, a complaint. In March 2025 OCR imposed a $200,000 civil money penalty on Oregon Health and Science University for a request that took more than two years. Most settled cases involved small practices and clinics, with settlements in the tens of thousands of dollars plus a corrective action plan and two years of monitoring.
What OCR asks for in an investigation is the request log: date received, what was requested, verification, date fulfilled or denied, fee charged, and any extension notice. A practice that keeps that log can usually resolve a complaint with a letter. It is also a document we ask for in a practice audit, because the disorganization that loses records requests usually loses payer correspondence too.
Questions we hear
Can we hold records until the patient pays their balance?
No. An unpaid bill is not a permitted ground for denying or delaying access. You may require the cost-based copy fee before release, but the fee cannot be a lever for the account balance.
The patient wants the records in a format we do not have. What do we owe?
The form and format the patient requests if the records are readily producible that way; otherwise a readable hard copy or another format you agree on. If your EHR exports PDF but not a proprietary format, PDF is fine. If the patient wants a CD and you can burn one, the disc is a chargeable supply.
Do we have to release a deceased patient's records to the family?
To the personal representative (the executor or whoever state law authorizes to act for the estate) under the right of access. To other family members, HIPAA permits disclosure of information relevant to their involvement in care unless the patient objected while alive. When the request comes from a relative who is not the representative, ask counsel before releasing the full chart.
What to do this week
- Create a records request log with the fields OCR asks for: date received, requester, what was requested, verification method, fee, date fulfilled or denied, extension notice date.
- Separate your two forms: a patient access request form and a third-party authorization form, and train the front desk on which one to hand over.
- Write the fee method down, with the labor rate, supply cost and postage you actually incur, and confirm it is at or below your state's cap.
- Route portal messages that ask for records into the same log and give the queue one owner.
- Pull every open request older than 20 days and either fulfill it or send the written extension notice before day 30.
- If a release-of-information vendor handles requests, get its turnaround report for the last quarter and check it against 30 days; a clear records request page on your practice website also cuts the phone calls.
