The most enforced right in HIPAA is also the cheapest one to get wrong.

The right, and why it is unlike the rest of the Privacy Rule

Most of the Privacy Rule tells a covered entity what it may not do. 45 CFR 164.502(a) is a prohibition with exceptions cut into it. The individual right of access at 45 CFR 164.524 runs the other direction. It is an affirmative obligation with a date attached to it, and the obligation belongs to the individual rather than to a regulator, which is why it produces complaints at a rate nothing else in the rule matches.

The scope is set by two defined terms. An individual has a right to inspect and obtain a copy of protected health information about them in a designated record set, for as long as that information is maintained. Designated record set is the phrase that does the work. It covers the medical records and billing records a provider maintains about individuals, the enrollment, payment, claims adjudication, and case management records a health plan maintains, and any other records used in whole or in part by or for the entity to make decisions about individuals. That last clause is broad, and it catches material that records departments often treat as internal. Two categories are carved out: psychotherapy notes as defined at 164.501, and information compiled in reasonable anticipation of or for use in a civil, criminal, or administrative action or proceeding.

Notice what is not a condition. There is no requirement that the individual explain why they want the records, no requirement that they be a current patient, no requirement that their account be settled, and no requirement that they sign an authorization. An authorization under 164.508 is the instrument a third party needs. An individual asking for their own chart needs nothing but a request.

The clock: thirty days, one extension, and a notice that has to actually go out

45 CFR 164.524(b)(2)(i) requires the covered entity to act on the request no later than 30 days after receipt. Acting means either providing the access or issuing a compliant written denial. Paragraph (b)(2)(ii) allows the entity to extend once, by no more than 30 days, and only if within the original period it provides the individual with a written statement of the reasons for the delay and the date by which it will complete its action on the request. One extension. Not one per request type, not one per department.

Three practical points follow from that text. The first is that these are calendar days running from receipt, and the rule contains no weekend or holiday adjustment. A request received on a Friday before a holiday week has the same 30 days as one received on a Monday. The second is that the extension is a conditional grant, not a default. Organizations frequently describe themselves as having 60 days. They do not. They have 30 days, plus a further 30 they can only claim by sending a specific written notice inside the first period, and an extension notice sent on day 34 is not an extension. It is documentation of a missed deadline.

The third is the one most likely to change behavior. The 30 days is an outer limit, not a target. HHS guidance is direct that covered entities are expected to respond as promptly as they are able, and in the modern case, where a patient asks for an electronic copy of records that already sit in an electronic health record with a patient portal attached, the gap between what the rule permits and what the technology allows is wide enough to be difficult to defend. A practice that takes 55 days to export a PDF is compliant on paper and looks obstructive on a complaint form.

The fee: four components, and the ones that are missing

45 CFR 164.524(c)(4) permits a reasonable, cost-based fee, and it enumerates what may go into it. There are four items. Labor for copying the protected health information requested, whether in paper or electronic form. Supplies for creating the paper copy or electronic media, if the individual requested the copy on portable media. Postage, when the individual has requested that the copy be mailed. And the cost of preparing an explanation or summary of the protected health information, if the individual agreed in advance to receive a summary instead of the records and agreed to the fee for it.

The list is closed, and what it leaves out is where the money usually is. Labor for searching for and retrieving the records is not chargeable. Neither is the cost of storing or maintaining the records or the system they live in, the licensing cost of the EHR, the time spent verifying identity, or the time a clinician spends reviewing the file to decide whether a denial ground applies. Those are costs of being a covered entity, not costs of making a copy. The mental model that helps here is narrow: you may charge for the act of copying and for the physical things the copy travels on, and for nothing that happens before or around it.

A second omission is worth stating separately. Inspection is free. The fee provision covers copies, so when an individual asks only to come in and review their record, there is no permitted charge, including for the staff member who sits with them.

HHS guidance describes three permitted ways to compute the fee. The first is actual cost, calculated for the specific request, which requires you to be able to show the copying labor and the supplies that went into it. The second is a schedule of average costs, developed for standard types of requests, which is administratively simpler and carries one important restriction: it may not be a per page fee where the records are maintained electronically. The third is a flat fee of no more than $6.50, available for electronic copies of protected health information maintained electronically, inclusive of all labor, supplies, and postage.

That third option generated a durable myth, and OCR published a clarification to kill it. The $6.50 figure is not a cap on what a covered entity may charge for copies of protected health information. It is a ceiling on one optional method, offered to entities that would rather not do the arithmetic. An entity using actual or average costs is governed by the reasonable, cost-based standard, which for a large paper chart may exceed $6.50 and for a portal export should be well under it.

Ciox, and the piece of the rule that is no longer there

The HITECH Act gave individuals a statutory right to direct a covered entity to transmit a copy of their records to a designated third party. Congress wrote that right narrowly: it reached a copy of an electronic health record with respect to protected health information of the individual in electronic format. The 2013 Omnibus Rule extended the directive to all protected health information in a designated record set, in any format. A 2016 OCR guidance document then extended the patient rate fee limit to those third-party directives.

In Ciox Health, LLC v. Azar, 435 F. Supp. 3d 30 (D.D.C. 2020), the court vacated both. It held that HHS could not use general rulemaking authority to enlarge the limited third-party directive Congress had enacted, and that the 2016 change to the patient rate was in substance a legislative rule adopted without notice and comment. OCR issued a notice at the end of January 2020 stating that the fee limitation set out at 45 CFR 164.524(c)(4) applies only to an individual's request for access to their own records, and does not apply to an individual's request to transmit records to a third party.

Sorting requests into three buckets keeps this manageable. When the individual asks for a copy for themselves, in any format, the full access right and the full fee limit apply. When the individual directs an electronic copy of EHR data to a third party, the statutory directive survives and you must transmit it, while OCR's post-Ciox position is that the fee limitation does not extend there. When the individual directs paper copies to an attorney, or a law firm sends its own request on a signed authorization, you are outside 164.524 for fee purposes and your state's medical records fee schedule is usually what governs.

A caution about bucket two and three. Many organizations continue to apply the patient rate to individual-directed transmissions as a matter of policy, and there are good reasons for that beyond the regulation. State law may cap the fee independently, and charging a patient a materially higher price because they asked you to send their records to their lawyer rather than to their kitchen table is a position that reads badly in a complaint, a deposition, or a review. The tool flags the distinction so you can decide deliberately rather than by default.

Denial: a closed list, and the reasons that are not on it

45 CFR 164.524(a)(2) lists five grounds for denial that carry no right of review, and they are all narrow. The information falls in the psychotherapy notes or legal proceedings carve-outs. An inmate of a correctional institution requests a copy and the copy would jeopardize the health, safety, security, custody, or rehabilitation of the inmate or of others. The information was created in the course of research that includes treatment, the individual agreed to a temporary suspension of access when consenting, and the research is not complete. Certain Privacy Act situations. Or the information came from someone other than a health care provider under a promise of confidentiality and access would be reasonably likely to reveal the source.

Paragraph (a)(3) adds three reviewable grounds, and each requires an individualized professional judgment rather than a policy: a licensed health care professional determines that access is reasonably likely to endanger the life or physical safety of the individual or another person; the information references another person who is not a provider and access is reasonably likely to cause that person substantial harm; or the request comes from a personal representative and access is reasonably likely to cause substantial harm to the individual or another person. Where one of these is used, the individual may demand review by a licensed health care professional designated by the entity who was not directly involved in the denial, and the entity is bound by that reviewer's determination.

Everything else is not a denial ground. An unpaid balance is not. A refusal to state a purpose is not. An unsigned authorization is not, because no authorization is required. A worry that the individual will use the records in litigation is not, and the legal proceedings carve-out is narrower than it sounds: it covers material compiled in anticipation of a proceeding, not the underlying clinical record that would exist regardless.

When you do deny, 164.524(d) sets the form. Timely, written, in plain language, stating the basis. A description of review rights where they exist and how to exercise them. A description of how to complain to the covered entity, including the name or title and telephone number of the contact person or office, and how to complain to the Secretary. Partial denials still require you to release everything else after excluding the denied portion. And under (d)(3), if you do not hold the information but know who does, you have to tell the individual where to direct the request.

The format right, which is the one that gets skipped

45 CFR 164.524(c)(2) requires access in the form and format requested by the individual, if it is readily producible in that form and format. Only when it is not readily producible does the rule fall back to a readable hard copy or such other form and format as agreed to by the covered entity and the individual. For electronic records where the individual asks for an electronic copy, the same structure applies at (c)(2)(ii) with electronic formats.

The word that matters in both fallbacks is agreed. When you cannot meet the request, the rule directs you into a conversation with the individual, not into a unilateral substitution. Handing over a paper packet to someone who asked for a PDF is a failure of the format right even though the underlying records were released, and it is a failure that shows up in complaints because the individual usually asked for the electronic version for a reason.

This is also the seam where the access right meets the information blocking regulations at 45 CFR part 171. Those rules ask whether a practice is likely to interfere with the access, exchange, or use of electronic health information, with defined exceptions that must be met in full. A response that lands inside the HIPAA deadline can still be an interference if the delay or the format substitution was not reasonable and necessary. Two regimes, one records desk, and the more demanding one sets your operating standard.

Why OCR keeps enforcing this specific right

OCR launched its Right of Access Initiative in 2019, and it has produced more enforcement actions than any other announced initiative in HIPAA's history, passing 50 settlements and civil monetary penalties. A March 2025 action imposed a $200,000 civil monetary penalty involving a failure to provide timely access to a personal representative, and a subsequent settlement resolved for $112,500.

The pattern in these cases is remarkably consistent, and it is not about sophisticated privacy failures. Someone asks for records. Nothing happens. They ask again. They file a complaint with OCR. OCR contacts the entity, the records are produced, and the enforcement action follows anyway because the records arrived only after the federal government got involved. The underlying failure is almost always operational: a request that reached the wrong inbox, a staff member who assumed an authorization was needed, a vendor relationship where nobody owned the clock, a personal representative whose documented authority was not recognized.

That is also why the fix is unglamorous. Log every access request the day it arrives, with the received date, because that date is the only input to the deadline and reconstructing it later is guesswork. Give one named person the queue. Write the fee method down and apply it consistently, or waive fees for individual requests entirely, which many organizations have concluded is cheaper than the staff time spent administering six dollar charges. Tell people the approximate fee up front, which OCR's guidance directs. Train the front desk to recognize an access request when it does not arrive on your form, because that is where the misrouting begins. And when a personal representative appears, decide their authority under state law rather than under office habit.

What is coming, and what to do about it now

HHS proposed a substantial set of Privacy Rule changes in a notice of proposed rulemaking published January 21, 2021, including shortening the access response period from 30 days with a 30 day extension to 15 days with a 15 day extension, along with changes to identity verification standards, the right to take notes or photographs of records during an inspection, and the scope of the electronic third-party directive. That proposal has not been finalized. Public reporting indicates the final rule went to the Office of Management and Budget on April 4, 2026 and is awaiting review.

Nothing about that changes today's obligation, and you should not build a program on a proposed rule. What it does change is how much slack a slow process has. An organization that currently fills routine requests in three to five days will not notice if the deadline halves. One that habitually runs to day 55 will be non-compliant on the day a final rule takes effect, without having changed anything. The cheapest preparation available is to stop treating the outer limit as the target, which is also the change most likely to keep you out of a complaint file in the meantime.

Primary sources

• 45 CFR 164.524, Access of individuals to protected health information
• HHS Office for Civil Rights, Individuals' Right under HIPAA to Access their Health Information
• Ciox Health, LLC v. Azar, 435 F. Supp. 3d 30 (D.D.C. 2020)
• Proposed Modifications to the HIPAA Privacy Rule, 86 Fed. Reg. 6446 (Jan. 21, 2021)
• HHS Office for Civil Rights, Resolution Agreements and Civil Money Penalties