What HIPAA's Right of Access Actually Guarantees
Under 45 CFR § 164.524, HIPAA gives you a legally enforceable right to inspect and obtain a copy of your protected health information held in a "designated record set" by a covered healthcare provider or health plan — this includes medical records, billing records, and most other records used to make decisions about your care, with narrow exceptions (like psychotherapy notes kept separately from the rest of the record, and information compiled for legal proceedings).
The covered entity must act on your request no later than 30 calendar days after receiving it — not 30 business days — and can take one additional 30-day extension only if it gives you a written explanation of the delay and a specific date by which it will respond. Any fee charged for copies must be "reasonable" and cost-based (covering labor, supplies, and postage), not an arbitrary flat fee designed to discourage requests; some states set even stricter, provider-specific limits or shorter turnaround times than the federal floor. verify your specific state's records-access law, since several states are more protective than the federal minimum
This right belongs to you as a patient (or your personal representative) — HHS has specifically and repeatedly enforced against providers who ignore, delay, or overcharge for these requests. Since 2019, HHS OCR has run a dedicated "Right of Access Initiative," and enforcement has escalated since 2022, with settlements ranging from small practices to large health systems, including a $200,000 settlement with a major academic health center in 2025.
What Enforcement Actually Achieves
This is fundamentally an access right, not a money-damages claim
Successful OCR complaint
Can result in the provider being ordered to produce the records, a corrective action plan, and (for serious/repeat violations) a civil monetary penalty paid to the government — not to you.
Direct compliance after escalation
Many access delays resolve once a request is escalated in writing or a formal complaint is filed, without needing a full OCR investigation.
Correction/amendment right
A documented correction to your record, or a formal statement of disagreement attached to it, if the provider declines to change it.
Beyond HIPAA: Information Blocking and Electronic Access
A separate federal rule adds to this right for electronic health information: under the 21st Century Cures Act's information-blocking provisions (implemented by ONC regulations), healthcare providers, health IT developers, and health information networks are generally barred from practices that unreasonably interfere with your ability to access, exchange, or use your own electronic health information — with only specific, defined exceptions. This is enforced separately from the HIPAA Right of Access, by ONC/HHS, and can carry its own penalties for information-blocking violators.
HIPAA also gives you a right to request a correction or amendment to your record if you believe it's inaccurate or incomplete (45 CFR § 164.526). The covered entity can deny the amendment request in specific circumstances (for example, if it believes the record is accurate), but must explain the denial in writing and let you submit a statement of disagreement, which becomes part of your record going forward.
As with other HIPAA rights, there is no private right of action to sue directly for a Right of Access violation — your enforcement path is an HHS OCR complaint, generally within 180 days of when you knew about the violation (extendable for good cause). Some states' own medical-records-access statutes may provide additional, state-specific remedies beyond what HIPAA offers. verify your specific state
What the Right of Access Does Not Cover
Psychotherapy notes that a mental health professional keeps separately from the rest of your medical record are excluded from the standard Right of Access — this is a narrow, specific carve-out, not a general exemption for all mental health records.
Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative legal proceeding is also excluded, as are certain records subject to the Clinical Laboratory Improvement Amendments (CLIA) restrictions in specific circumstances.
A provider can deny access in a small number of specific situations without a right to further review (for example, certain correctional-institution or research-related contexts), and in a few other specific situations with a right to have the denial reviewed by a licensed healthcare professional not involved in the original decision.
How to Enforce Your Right of Access
Escalate in writing, and know the 30-day clock is real
Submit your request in writing
Use the provider's designated request form if one exists, but a clear written request works regardless — specify what records you want and how you want them delivered (paper, electronic, or a specific format).
Track the 30-day clock
Note the exact date you submitted the request. The provider must respond within 30 calendar days, or send you a written extension notice with a specific new date within that same window.
Push back on excessive fees
If you're quoted a fee that doesn't look cost-based (a large flat fee regardless of record volume, for example), ask for an itemized explanation and note that HIPAA requires a reasonable, cost-based fee.
Escalate in writing if the deadline passes
A follow-up letter referencing 45 CFR § 164.524 and the original request date often resolves delays without needing to file a formal complaint.
File an HHS OCR complaint if it still isn't resolved
Complaints can be filed online via the OCR Complaint Portal, generally within 180 days of when you knew about the issue (extendable for good cause).
Use the amendment process for inaccurate records
If your issue is about correcting the record rather than getting a copy, submit a written amendment request under 45 CFR § 164.526 and expect either a correction or a written denial you can respond to.
Documents to gather
- A copy of your written request and the date it was submitted
- Any response, extension notice, or fee quote from the provider
- Records already received, so you can identify specifically what's still missing
- Any prior correspondence about the request
- For a correction request: the specific inaccurate entry and your basis for disputing it
Timelines and Deadlines
The provider's deadline and your complaint deadline are two different clocks
Track both: how long the provider had to respond to your request, and how long you have to file a complaint if they didn't.
| Jurisdiction | Limitation Period |
|---|---|
| US — provider response to a records request | 30 calendar days, plus one possible 30-day extension with written notice |
| US — some states' own records-access laws | Can be shorter than the federal 30-day floor verify your specific state |
| US — HHS OCR complaint window | 180 days from when you knew of the violation (extendable for good cause) |
Realistic Outcomes and Caveats
Most access delays resolve after a clear written follow-up referencing the specific regulation and your original request date, without needing to escalate to HHS.
Formal OCR complaints for access violations are one of the more reliably enforced categories of HIPAA complaint, given the dedicated Right of Access Initiative — but the remedy is compliance and potential penalties against the provider, not a payment to you.
Correction/amendment requests are decided by the provider in the first instance; if denied, your practical remedy is typically a formal statement of disagreement attached to the record, not a guaranteed correction.
Common Pitfalls
Assuming "30 days" means business days
It means calendar days — track the actual date the request was received, not a rough estimate.
Paying an unexplained flat fee without asking questions
HIPAA requires a reasonable, cost-based fee — you're entitled to ask how a quoted fee was calculated.
Assuming a HIPAA complaint results in a payment to you
It doesn't — OCR enforcement produces compliance and potential penalties against the provider, not compensation to the patient.
Not distinguishing access requests from correction requests
These are two different rights (45 CFR § 164.524 vs. § 164.526) with different processes and different possible outcomes.
Forgetting psychotherapy notes are a narrow exception
Only notes kept separately by a mental health professional are excluded — the rest of your mental health record is generally still covered.
Organize Your Medical Records Request
Use the calculator to track your request date, the response deadline, and any correspondence before escalating.
Organize Your Medical Records Request
Use the calculator to track your request date, the response deadline, and any correspondence before escalating.
This stays in your private workspace until you choose a next step. It does not submit a claim on your behalf on its own.
Official and Legal References
Frequently Asked Questions
What people ask after a provider stalls on a records request
My doctor's office says it will take 90 days — is that legal?
Can they charge me $200 for a copy of my file?
Can I sue the provider directly for violating my Right of Access?
Organize Your Medical Records Request
Use the calculator to track your request date, the response deadline, and any correspondence before escalating.