Comparison · Privacy

Patient Right of Access vs HIPAA Authorization

Right of Access is the patient's direct request for their own record — must be honored within 30 days. A HIPAA Authorization is the form a patient signs to allow disclosure to a third party.

Last reviewed May 24, 2026

Side by side

Option A

Right of Access

Individual's right to inspect and obtain a copy of PHI about themselves in a designated record set, in the form and format requested.

45 CFR 164.524
  • 45 CFR 164.524.
  • Must respond within 30 days (one 30-day extension permitted).
  • Fee is limited to reasonable cost-based fee — labor for copy + supplies + postage.
Option B

HIPAA Authorization

A patient-signed form permitting a covered entity to use or disclose PHI to a third party for purposes outside the permitted treatment, payment, or operations uses.

45 CFR 164.508
  • 45 CFR 164.508.
  • Must include specific elements: description, purpose, expiration, signature, etc.
  • Required for marketing, sale of PHI, and most non-TPO disclosures.
Who initiates
Right of AccessPatient (or personal representative)
AuthorizationPatient signs to authorize a third-party disclosure
Where the record goes
Right of AccessTo the patient or their designee
AuthorizationTo the specified third party
Required response time
Right of Access30 days (one 30-day extension)
AuthorizationNo fixed response window — disclosure is permissive
Fees
Right of AccessReasonable cost-based fee only
AuthorizationStandard practice fee schedule (may differ)

When to use Right of Access

  • Patient asks for a copy of their own chart, lab results, or imaging.
  • Patient asks the practice to send their record directly to a third party they identify — still Right of Access under HHS guidance.

When to use HIPAA Authorization

  • An attorney requests records on behalf of a patient (typically with Authorization signed by the patient).
  • A life-insurance underwriter requests records — Authorization required.
  • A research project requires PHI outside an IRB waiver — Authorization required.

Common mistakes

  • Charging more than the cost-based fee on a Right of Access request — OCR has settled multiple enforcement actions on this.
  • Refusing a Right of Access in the requested format when feasible (e.g., a patient asks for CSV and the EHR can export it).
  • Using an Authorization form when Right of Access applies — the patient has a stronger entitlement under 164.524.

Sources

Related

More Privacy comparisons
Glossary
Regulations
Take it into the workspace

Track records requests in the SRA readiness check

Open sra studio →
Authored by D3rx

D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.

Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.

See reviewer status →Editorial standards →How we research →

This comparison is a research aid for billing and compliance staff. It does not provide legal, medical, or financial advice and does not replace counsel. References cited link to primary sources at CMS, HHS, OCR, eCFR, NIST, and the relevant payer or state regulator. Last reviewed May 24, 2026.