The clock
Act no later than 30 calendar days after receiving the request. HHS is explicit that this is an outer limit rather than a target, and that a practice able to respond sooner should.
A patient asked for their records. Here is what you owe them.
Section 164.524 gives every individual the right to inspect and obtain a copy of their protected health information in a designated record set. Thirty calendar days is the outer limit, not the target. You get one written extension. You may charge a reasonable, cost-based fee — and never for search and retrieval.
45 CFR §164.524 · current as of September 2026
The clock, and the one extension.
Most access failures are timing failures, and most timing failures come from treating thirty days as the schedule.
The extension
One extension of no more than 30 additional days, and only one per request. It requires written notice to the individual within the original period, stating the reason and the date you will deliver.
State law
A state may give patients faster access or greater rights, and where it does, it governs. A state rule that is slower or narrower does not relax the federal outer limit — HIPAA preempts a contrary state provision unless the state law is more stringent (§160.203(b)).
What you may charge.
What you may charge
A reasonable, cost-based fee limited to labor for copying, supplies, postage where the individual asks for mail, and preparing an explanation or summary if the individual agreed to one in advance.
What you may never charge
Search and retrieval. HHS states plainly that it has always been prohibited to pass those labor costs to the individual, and that confusion about what counts as search and retrieval is common enough to warrant its own guidance.
Where fees go wrong
Per-page state copying schedules are the usual trap. A state fee cap is a ceiling on what state law permits, not a federal entitlement to charge it, and a fee that deters access is the kind of thing enforcement notices.
When you may say no.
Rarely, and never quietly. The grounds are narrow and the form of the denial is itself regulated.
Unreviewable grounds
A narrow set — psychotherapy notes, information compiled in reasonable anticipation of litigation, and certain research, inmate, and Privacy Act situations. The individual has no right to have these reviewed.
Reviewable grounds
Chiefly where a licensed health care professional determines in the exercise of professional judgment that access is reasonably likely to endanger the life or physical safety of the individual or another person. A denial on these grounds carries a right to have it reviewed by another licensed professional who did not participate in it.
What a denial must do
Be timely, be in writing, be in plain language, state the basis, explain the review right where one exists, and describe how to complain. A denial is a formal act, not silence.
Common questions.
What is the designated record set?
The medical and billing records a provider maintains about an individual, plus any other records the entity uses in whole or in part to make decisions about that individual. It is defined by use rather than by system, so it can reach beyond the EHR — but not everything stored near a record becomes part of it merely by proximity.
Does the patient get the format they ask for?
If it is readily producible in that form and format, yes — including an electronic copy where the record is held electronically. If it is not readily producible, the practice provides a readable hard copy or another form and format the two of you agree on. The obligation is to the readily-producible standard, not to any particular medium a patient names.
Can a patient direct records to a third party?
A patient may direct a copy to a designated person or entity, in a signed writing that clearly identifies the recipient and where to send it. Note that the 2020 Ciox decision vacated the extension of the individual-rate fee limit to third-party directions of records in non-electronic form, so the fee analysis is not identical to a request the patient makes for themselves.
Is this the same as sending records to another doctor?
No, and conflating them causes real errors. A referral or care-coordination disclosure is a treatment disclosure the Privacy Rule permits without authorization, and minimum necessary does not apply to it. A right-of-access request is the individual exercising a right under §164.524, with its own clock, its own fee rules and its own denial grounds.
Who can exercise the right for someone else?
A personal representative — someone with authority under applicable law to act for the individual in health care decisions — exercises the right as the individual would. State law defines who that is, and it is not always who the family expects.
The request is yours to answer. The record of how you answered it can be ours.
Patient Protect does not receive access requests, hold your designated record set, or deliver records to patients — your EHR and your staff do that. What the platform keeps is the documentation an investigator asks for afterwards: your policies, your workforce training, and the dated record of the decisions you made.
Get your Patient Protect Score — free