Guide · HIPAA · Right of Access

The Patient Right of Access: Deadlines, Fees, and Why OCR Keeps Enforcing It

Thirty days, a cost-based fee, and a log of every request. What the federal rule requires, what Illinois adds, and where practices go wrong.

By Lincoln Square Law · 8-minute read

A patient’s request for a copy of their records is one of the most routine things a practice handles, and one of the most enforced. HIPAA gives individuals a legal right to see and obtain their protected health information, and OCR has spent years bringing cases against practices that delayed, overcharged, or ignored those requests. On August 27, 2026, OCR announced its fifty-fifth enforcement action under its Right of Access Initiative, against an eye care provider whose patient waited nearly two years for her records. Most of these cases involve small providers and a single patient. This guide explains what the rule requires, where practices go wrong, and how Illinois law adds to the federal requirements.

The right itself

An individual has a right to inspect and obtain a copy of their PHI in a designated record set for as long as the covered entity maintains it (45 C.F.R. 164.524(a)). The designated record set includes medical and billing records and any other records used to make decisions about the individual. The right belongs to the individual and to a personal representative, such as a parent of a minor or an agent under a health care power of attorney, subject to the rule’s limits.

The practice may require that requests be in writing, if it tells patients so in advance, and it may verify identity. Verification must not create unreasonable barriers. Requiring a patient to appear in person, to use a particular form that is hard to obtain, or to explain why they want the records can delay access in a way the rule does not allow.

The deadline

The covered entity must act on a request no later than thirty days after receiving it. If it cannot, it may extend once, by no more than thirty additional days, but only if it tells the individual in writing within the first thirty days why it needs more time and when it will respond (45 C.F.R. 164.524(b)(2)). Thirty days is an outer limit. Records that are readily available should be provided sooner.

The enforcement cases show how delays happen. A request arrives at the front desk and is not logged. It is forwarded to a records vendor that does not respond. A billing dispute becomes a reason to hold records. None of these is a defense. Every request should be logged with the date received, and someone should own the deadline.

Form and format

The copy must be provided in the form and format the individual requests, if it is readily producible in that form. If not, it must be provided in a readable alternative the practice and the individual agree on (45 C.F.R. 164.524(c)(2)). When records are kept electronically and the individual asks for an electronic copy, the practice must provide one in the electronic form requested if readily producible, or another agreed electronic format.

Individuals may ask to receive their records by unencrypted email. HHS guidance says that after giving a brief warning that unencrypted email carries some risk and confirming that the individual still wants it, the practice must comply. Refusing because the practice prefers a portal or encrypted email is not a basis to deny.

Sending records to someone else

An individual may direct the practice to send a copy to another person. The request must be in writing, signed, and clearly identify the recipient and where to send it (45 C.F.R. 164.524(c)(3)(ii)). In Ciox Health, LLC v. Azar, 435 F. Supp. 3d 30 (D.D.C. 2020), the federal court vacated parts of the rule. HHS’s notice on the decision explains the result. The right to direct a copy to a third party now applies only to a copy of an electronic health record, and the fee limits apply only to an individual’s request for their own records, not to a directive to send records to a third party. The individual’s own right of access and its fee limits are unaffected.

Fees

For an individual’s own request, the practice may charge only a reasonable, cost-based fee limited to labor for copying, supplies, postage when mailed, and preparing a summary or explanation if the individual agrees in advance (45 C.F.R. 164.524(c)(4)). Search and retrieval fees and per-page charges designed for other purposes are not allowed for an individual’s own request. Fee disputes are a frequent source of complaints, and a practice that charges a patient the rates it charges attorneys or insurers invites one.

When access can be denied

Denials are narrow. Some grounds cannot be reviewed, including psychotherapy notes and information compiled in reasonable anticipation of litigation (45 C.F.R. 164.524(a)(2)). Others may be reviewed, such as a licensed professional’s determination that access is reasonably likely to endanger the life or physical safety of the individual or another person (45 C.F.R. 164.524(a)(3)). A denial must be in writing, in plain language, state the basis, explain any review rights, and describe how to complain to the practice and to HHS (45 C.F.R. 164.524(d)). The practice must provide access to any information that is not subject to the denial.

When a records vendor handles requests

Many practices route access requests to a release-of-information company or rely on an EHR vendor to produce copies. That arrangement is permitted, but it does not move the obligation. The practice remains the covered entity responsible for the thirty-day deadline, the format, and the fee. A business associate agreement must require the vendor to make PHI available as needed for the practice to meet its access obligations (45 C.F.R. 164.504(e)(2)(ii)(E)), and the practice should know how the vendor measures its own turnaround.

Two practical points follow. First, the vendor’s fee schedule must distinguish between a patient’s own request and a request from a lawyer or insurer, because the cost-based limit applies to the first and not the second. Second, the practice should be able to see the status of any request the vendor holds. Several enforcement actions began with a patient who could not get an answer from anyone, and a practice that cannot tell OCR where a request stands is in a weak position before the investigation starts.

Illinois law

Illinois has its own records-access statute. A health care facility or practitioner must permit a patient or authorized person to examine and copy records, and must satisfy a written request within thirty days, or within sixty days if more time is needed (735 ILCS 5/8-2001). Records kept electronically must be provided electronically when requested. The statute sets copy charges that are adjusted annually, and it requires one free copy for certain benefit applications. Where state law and HIPAA both apply, the practice must meet whichever rule is more protective of the patient’s access, and in particular must not charge a patient more for their own records than HIPAA’s cost-based limit allows.

Building a compliant process

A few steps prevent almost every enforcement case:

• Log every request on the day it arrives, with the date, the requester, and the format requested.
• Assign an owner who tracks each request to completion, including requests handled by a records vendor.
• Write the fee schedule for individuals’ own requests using the cost-based limits, separately from charges for third parties.
• Train front-desk staff to recognize an access request, even when it is informal, and never to hold records over an unpaid balance.
• Review the log monthly, and escalate any request approaching the deadline.

Why it keeps being enforced

Access cases are simple to prove. The complaint states when the patient asked, and the practice either has a record of timely compliance or it does not. OCR has used these cases to make a point about patients’ control over their own information, and it has continued to bring them in 2026. The fix is inexpensive, and the process above costs less than a single investigation.