Rights & records
HIPAA right of access to medical records
How patients — and people they authorize — get copies of their records, and what timelines and fees apply.
Key points
- Individuals have a right to access their protected health information in a designated record set, including in electronic form when readily producible.
- Covered entities must generally act within 30 calendar days, with one possible 30-day extension with written notice.
- Fees, if charged, must be reasonable and cost-based.
- A patient can direct a covered entity to send a copy to a third party they designate, in writing.
- Separate authorization rules apply when a third party, such as an advocate, requests records on their own behalf.
In practice
- Have the client make the request or direct records to you — keep a copy of the signed direction.
- Log request date, method and response in the record index template.
- Complaints about denied access can be filed with the HHS Office for Civil Rights.
Official sources
- HHS — Individuals' right of access (guidance) (opens in a new tab)
- HHS — Your medical records (consumers) (opens in a new tab)
Educational summary, not legal advice. Deadlines depend on the notice, plan type and state.
Sources checked November 7, 2026. Rules change — confirm with the official source before acting.