Getting Your Records From a Private Provider Under HIPAA

The rule is 45 CFR 164.524, and its opening sentence carries the whole right: an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set. A designated record set is the medical and billing material a provider uses to make decisions about you. Two exceptions sit in the same paragraph, for psychotherapy notes and for information compiled in reasonable anticipation of a legal proceeding.

HHS says the same thing in shorter words on its page for patients: the Privacy Rule gives you, with few exceptions, the right to inspect, review, and receive a copy of your medical records and billing records held by covered health plans and providers. The same page states a rule most people have never heard. A provider cannot deny you a copy of your records because you have not paid for the services you have received.

The clock runs 30 days and it starts on receipt, not on the day you wrote the letter or the day you dropped it in the mail. What the provider owes inside those 30 days is an action, and the regulation defines the word: the covered entity must act on a request for access no later than 30 days after receipt of the request, and acting means either granting the request and providing the access, or issuing a written denial. A phone call saying the request is in the queue is neither one of those.

One extension exists and it is fenced in. The provider may extend the time by no more than 30 days, and only if, inside the original window, it gives you a written statement of the reasons for the delay and the date by which it will complete its action on the request. That written statement is the whole condition, so an extension nobody told you about in writing is not an extension the rule recognizes. The rule then closes the door on repeats: the covered entity may have only one such extension of time for action on a request for access.

Day 31 with no records, no denial and no delay letter is a deadline that has already passed, and the useful response is another letter rather than another wait. A short dated follow-up that names the date of the original request, says no action under 164.524(b)(2) has been taken, and asks for the records or a written denial does two things at once: it tells whoever opens it that you know the rule, and it puts your own dated copy in the file. If a delay letter did arrive on time, 60 days from receipt is the outside figure and the letter itself names the completion date the provider chose. Where that goes if nothing moves is the complaint route further down this page.

This is where the money goes wrong, and the rule is short enough to memorize. A covered entity may impose a reasonable, cost-based fee, provided that the fee includes only the cost of: labor for copying the protected health information, whether in paper or electronic form; supplies for creating the paper copy or electronic media if you asked for the copy on portable media; postage, when you asked for it to be mailed; and preparing an explanation or summary, if you agreed to one.

That list is closed, and OCR is explicit about what falls outside it. Labor for copying does not include reviewing the request for access, or searching for and retrieving the information, which OCR defines as locating and reviewing the material in the record and segregating or otherwise preparing what is responsive. Costs for updating or maintaining systems and data, capital for data storage, and the labor of making sure the release complies with HIPAA are all outside the permitted fee, and OCR says that holds even if state law authorizes them.

Two numbers come from the same OCR guidance. Per page fees are not permitted for paper or electronic copies of information maintained electronically, because a per-page charge stopped reflecting the actual work once records went digital. And a provider that would rather not calculate costs at all may charge a flat fee for all requests for electronic copies of electronically maintained records, provided the fee does not exceed $6.50, inclusive of all labor, supplies, and any applicable postage.

There is no mandatory federal form. 45 CFR 164.524 does not name one anywhere in its text. What the rule permits is narrower than most front desks assume: the covered entity may require individuals to make requests for access in writing, provided that it informs individuals of such a requirement. Writing, not a particular sheet of paper.

Most offices keep a records request form, and using it is often the fastest path because it lands directly with whoever pulls charts. A signed letter that identifies you and clearly identifies the records you want is a request for access under the same rule.

One document gets confused with this constantly. An authorization under 45 CFR 164.508 is how you permit a provider to disclose your information to someone else, and it has its own required elements. Asking for your own copy is not an authorization, and a right-of-access request should not be handled as one.

Format is the first thing to name in the request, because the rule follows what you asked for. The provider must give you access in the form and format you requested if the records are readily producible that way, and if they are not, then in readable hard copy or another form you and the provider agree on. Records kept electronically are usually producible electronically, which is why an emailed or downloadable file is a normal thing to ask for.

Directing a copy to a third party is where the ground moved. The regulation still says that if your request directs the covered entity to transmit the copy directly to another person you designate, it must provide the copy to that person, and that your request has to be in writing, signed by you, and clearly identify the designated person and where to send the copy. But a federal court vacated part of that provision in January 2020, and HHS's own notice states the result. The third-party directive is limited to requests for a copy of an electronic health record in an electronic format, and the fee limitation applies only to a request for access to your own records, not to a request to transmit records to a third party.

The plain reading is unglamorous. Asking for your own copy keeps the fee limit. Asking the provider to send it onward to someone else may not.

Complaints go to the HHS Office for Civil Rights, which enforces the Privacy Rule. OCR investigates health information privacy complaints against covered entities, meaning health plans, clearinghouses, and providers that conduct certain transactions electronically, and against their business associates. That last category matters here, because the copy services many practices hire to fulfill records requests are business associates. Anyone can file, online or in writing.

A cheaper step comes before any of that, and it costs one sentence. Put the rule inside the request. A written request that cites 45 CFR 164.524(c)(4) and names the four allowable categories, labor for copying, supplies, postage, and an agreed summary, puts the limit in front of whoever is quoting the price from a state fee schedule.