Individuals’ Right under HIPAA to Access their Health Information (HHS.gov)
HHS’s official guidance on the HIPAA Privacy Rule’s right of access (45 CFR § 164.524), with an extended FAQ: how patients request their health records, how and how quickly covered entities must provide them, what can be charged, and the limited grounds for denial.
License: Public domain — U.S. federal government work (17 U.S.C. § 105), the same basis as Summary of the HIPAA Privacy Rule (HHS.gov).
Key points
- A covered entity may require a written request and must verify the requester’s identity, but it may not impose measures that act as barriers or cause unreasonable delay. It can’t require patients to come in person to request a mailed copy, to use a web portal (not everyone has ready access to one), or to mail the request. HHS encourages offering several ways to request access.
- A patient portal used for access should already have proper authentication, which covers the identity-verification requirement for requests made through it.
- Records must be provided in the form and format the patient asks for if that is readily producible, or else in an agreed readable alternative. If the records are held electronically, the entity must be able to provide some electronic copy, and may fall back to paper only after the patient has turned down every electronic format it can produce. Electronic copies should be machine readable where possible.
- Whether a format or delivery method counts as “readily producible” is a question of the entity’s capability, not its willingness. An entity that can produce a requested format may not steer the patient to a different one just because it prefers it.
- Mail and email are expected to be available from every covered entity. A patient may choose unencrypted email; the entity must then briefly warn about the risk of interception in transit, confirm the patient still wants it, and comply if they do.
- A patient’s own portable media, such as a USB drive, can be declined if the covered entity’s security risk analysis finds connecting outside devices to its systems too risky, as long as it offers another electronic option. It can’t instead require the patient to buy media from it.
- A patient can direct their records to a third party (another provider, a personal health record, an app) through a written, signed request that clearly identifies the recipient and where to send the records. An electronic signature through a secure portal is acceptable, and the same timing, format, and fee rules apply. Disagreeing with the patient’s choice of recipient isn’t a valid reason to refuse.
- The 30-day deadline is an outer limit, and HHS encourages much faster access, including near-immediate access through portals. Only one extension of up to 30 more days is allowed, with written notice of the reason and new date given within the first 30 days. Where a request will take a long time, records can be released in pieces if the patient wants that.
- A covered entity may not require a reason for the request, and may not withhold records because the patient hasn’t paid a bill.
- A denial must be in writing and in plain language, stating the basis, any right to have it reviewed and how to ask for review, and how to complain to the entity or to HHS. Any records not covered by the denial must still be provided.
- Fees are limited to a reasonable, cost-based amount covering only copying labor, supplies, postage, and (if the patient agrees) preparing a summary. Verification, search and retrieval, and system costs can’t be charged.