HIPAA Right of Access Requests (45 CFR § 164.524): Respond Inside 30 Days

A HIPAA right of access request is the patient's federally-protected request for a copy of, or access to, the patient's protected health information in the designated record set. The federal mandate is 45 CFR § 164.524. The response window is 30 calendar days, extendable once by 30 days with written notice. OCR's Right of Access Initiative reached its 54th published action with the 2025 Concentra resolution.

What HHS actually requires

§ 164.524(a)(1) grants the patient (or personal representative) a right to inspect or obtain a copy of PHI in the designated record set. The window is 30 calendar days from receipt of the request per § 164.524(b)(2), with one 30-day extension permitted on written notice within the original window. Acceptable form: the patient's requested form and format if readily producible; otherwise a mutually agreed alternative.

Fees are capped at reasonable cost-based labor, supplies, postage, and pre-agreed summary costs under § 164.524(c)(4). The 2016 OCR guidance on the right of access details the per-record electronic flat-fee option ($6.50 ceiling), the labor-based methodology, and what cannot be charged (search, retrieval, system overhead).

OCR's Right of Access Initiative settlements through 2025 follow a consistent pattern. Published amounts range from King MD at $3,500 (one late response) at the low end to Memorial Hermann Health System at $240,000 — the largest listed ROA settlement — at the high end. Bayfront Health St. Petersburg ($85K, mother's request for fetal heart-monitor records denied), Beth Israel Lahey Health ($70K), University of Cincinnati Medical Center ($65K), and Diagnostic Medical Imaging Services ($23K) sit in the middle of the range. OCR's 2025 Concentra resolution was the 54th published Right of Access action. The settlement amount tracks the severity, not just whether it happened — OCR penalizes pattern more than incident.

The four entities every credible Right of Access procedure references: the HHS Office for Civil Rights (OCR), the OCR Right of Access Initiative, the 21st Century Cures Act Information Blocking Rule, and the ONC Information Blocking enforcement framework.

Template — section by section

``` HIPAA RIGHT OF ACCESS PROCEDURE [Practice Name] Effective: [DATE] Owner: Privacy Officer

1. PURPOSE

This procedure operationalizes 45 CFR § 164.524 — the patient's right to inspect or receive a copy of PHI in the designated record set — within the 30-day window and the cost-based fee limits.

1. SCOPE

Every request, regardless of channel, by a patient, a personal representative under § 164.502(g), or an entity holding a HIPAA- compliant authorization under § 164.508.

1. INTAKE — DAY 0

3.1 Time-stamp every request on arrival (any channel — phone, paper, email, portal, in-person) 3.2 Use the Right of Access Intake Form (Appendix A) 3.3 Confirm requester identity:

• Patient: government ID or established practice identity
• Personal rep: ID + documentation of representative status

(POA, guardian appointment, parent of minor)

• Authorization holder: signed § 164.508 authorization

3.4 Confirm scope: full DRS or specific records / date range 3.5 Confirm requested form and format (paper, PDF, CCDA, portal, email, CD/USB) 3.6 If requester wants unencrypted email, capture written acknowledgement of risk per § 164.524(c)(3) 3.7 Log the request in the Right of Access Tracker

1. PROCESSING — DAYS 1-25

4.1 Pull the designated record set per § 164.501 definition 4.2 Apply minimal review:

• Confirm not psychotherapy notes (separate carve-out

under § 164.524(a)(1)(i))

• Confirm no information compiled in reasonable

anticipation of litigation (§ 164.524(a)(1)(ii))

• Confirm no third-party endangerment ground under

§ 164.524(a)(3)(ii) — narrow grounds, requires licensed-professional review 4.3 Convert to requested form/format if readily producible 4.4 Calculate fee per § 164.524(c)(4) — labor + supplies + postage; per-page paper at $0.10-$0.25 ceiling; electronic delivery of electronic records typically modest or zero 4.5 Honor any state-law cap that is stricter 4.6 Deliver via patient-chosen channel

1. EXTENSION — INSIDE DAY 30

If full response is not possible within 30 days, the Privacy Officer sends the Extension Notice (Appendix C) before day 30, naming:

• The reason for the delay (specific, not boilerplate)
• The expected delivery date (within 30 additional days)

The extension is one-time only. Total response window is 60 days.

1. DENIAL — REVIEWABLE OR UNREVIEWABLE

6.1 Unreviewable denial grounds (§ 164.524(a)(2)):

• PHI is psychotherapy notes (§ 164.524(a)(1)(i))
• Compiled in reasonable anticipation of litigation

(§ 164.524(a)(1)(ii))

• Inmate copy denial under § 164.524(a)(2)(ii)
• Subject to research with patient consent suspending access

under § 164.524(a)(2)(iii)

• Subject to Privacy Act denial under § 164.524(a)(2)(iv)
• Information obtained from a confidential source under a

promise of confidentiality under § 164.524(a)(2)(v) 6.2 Reviewable denial grounds (§ 164.524(a)(3)):

• Endangerment to the patient or another person, requires

licensed-professional finding

• PHI references another person and access reasonably likely

to cause substantial harm to that person

• Personal rep access reasonably likely to cause substantial

harm to the patient 6.3 Every denial is in writing using the Denial Notice (Appendix D) and includes the right to have the denial reviewed by a licensed professional designated by the practice.

1. FEE TRANSPARENCY

The practice publishes a fee schedule on the website and provides it to the requester before producing the record where any fee will apply. No fee surprises after delivery.

1. RETENTION

Every Intake Form, every delivery confirmation, every Extension Notice, every Denial Notice, and every tracker entry is retained for six years from the date of creation per 45 CFR § 164.530(j)(2).

1. INFORMATION BLOCKING

The practice does not engage in any practice that is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information except where required by law or covered by an enumerated exception under 45 CFR Part 171.

Reviewed and approved: ___________________________ Privacy Officer Date: ________ ___________________________ Security Officer Date: ________ ___________________________ Practice Owner Date: ________ ```

Right of Access Intake Form (Appendix A)

``` HIPAA RIGHT OF ACCESS INTAKE Date and time received: ____________________ Intake # ________ Channel: □ phone □ paper □ email □ portal □ in-person

Requester: □ Patient □ Personal rep □ Authorized recipient Requester name: ____________________________ Patient name (if different): ____________________ Patient DOB / MRN: ____________________ Requester ID verified by: ____________________ Date: ________ Personal-rep documentation (if applicable): _____________________ Authorization on file (if applicable): __________________________

Records requested: □ Full designated record set □ Date range: ____________ to ____________ □ Specific records: ______________________________________ □ Other: ______________________________________

Requested form/format: □ Paper □ PDF □ CCDA/electronic □ Portal access □ Email (unencrypted — acknowledgement attached) □ CD / USB drive □ Other: ______________

Day-0 stamp: ____________________ Day-30 deadline: __________ Day-60 deadline (if extended): __________

Assigned to: ____________________ Privacy Officer signoff: ________ ```

Right of Access Tracker (Appendix B)

| Intake # | Day 0 | Day 30 due | Day 60 due | Patient | Scope | Format | Status | Fee | Delivered | Issues | |---|---|---|---|---|---|---|---|---|---|---| | 2026-001 | 2026-05-01 | 2026-05-31 | 2026-06-30 | <name> | full DRS | CCDA via portal | Delivered 2026-05-12 | $0 | 2026-05-12 | — | | 2026-002 | 2026-05-03 | 2026-06-02 | 2026-07-02 | <name> | 2024-2025 visits | PDF email | In progress | $6.50 | — | — | | 2026-003 | 2026-05-08 | 2026-06-07 | 2026-07-07 | <name> | full DRS | paper | Extended 2026-06-01 | est $34 | — | imaging archive pull | | 2026-004 | 2026-05-10 | 2026-06-09 | 2026-07-09 | <name> | imaging only | CD | Delivered 2026-05-22 | $5 | 2026-05-22 | — |

Extension Notice (Appendix C)

``` [Practice Letterhead] [Date]

[Patient Name] [Address]

Re: Your Health Information Access Request — Intake # ________ Originally received: [DATE]

Dear [Patient Name],

This letter is to inform you that we are extending the time to respond to your request for access to your protected health information by an additional thirty (30) days, as permitted by 45 CFR § 164.524(b)(2).

Reason for the extension: [Specific reason — e.g., "the requested records include imaging studies stored in an archived system that requires retrieval from off-site storage"]

Expected response date: [DATE — no later than 60 days from original receipt]

If you have any questions, please contact our Privacy Officer at [phone] or [email].

Sincerely,

[Privacy Officer Name] Privacy Officer [Practice Name] ```

Denial Notice (Appendix D)

``` [Practice Letterhead] [Date]

[Patient Name] [Address]

Re: Your Health Information Access Request — Intake # ________

Dear [Patient Name],

We have reviewed your request dated [DATE] for access to your protected health information. We are denying your request in whole / in part [strike one] for the following reason(s):

□ The records you requested are psychotherapy notes that are excluded from the right of access under 45 CFR § 164.524(a)(1)(i).

□ The records you requested were compiled in reasonable anticipation of litigation under § 164.524(a)(1)(ii).

□ A licensed health-care professional has determined that access is reasonably likely to endanger the life or physical safety of the patient or another person under § 164.524(a)(3)(i).

□ Other (specific): ______________________________________________________________

Your right to review: If the reason for denial is a reviewable ground under § 164.524(a)(3), you have the right to have the denial reviewed by a licensed health-care professional designated by us who did not participate in the original decision. HIPAA does not set a deadline for requesting that review; to start the process, contact our Privacy Officer in writing at the address below.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights at https://www.hhs.gov/ocr/complaints/index.html.

Sincerely,

[Privacy Officer Name] Privacy Officer [Practice Name] ```

How to deploy

The deployment sequence: ratify the procedure with the Privacy Officer, Security Officer, and practice owner; train every intake person (front desk, medical records, billing, scheduling) on the 30-day stamp and the intake form; publish the fee schedule on the website; load the tracker into the binder; designate a backup Privacy Officer so the window does not stall during PTO; book a quarterly tracker review on the calendar.

The single highest-leverage move is the time-stamp on the intake. Every OCR Right of Access settlement we have read involves a practice that could not prove when the request arrived. Without a documented Day 0, the practice cannot prove the response was timely. Stamp every request, on every channel, the moment it arrives.

Common gaps

The five most common defects from binder review:

1. No tracker. Individual requests are handled; there is no central log proving the 30-day window was met. OCR's investigators ask for the tracker.
2. Day 0 not documented. Request arrived by phone or in person; the date was never written down; the practice cannot prove timeliness.
3. Format defaulted to paper. Patient requested CCDA or PDF; staff produced paper because that is the practice norm. Information-blocking exposure plus Right of Access exposure.
4. Fee exceeds the § 164.524(c)(4) ceiling. Per-page paper fees over $0.25, or any electronic-delivery fee for electronic records that runs over the OCR-published flat-fee guidance.
5. Extension communicated verbally. No written Extension Notice issued inside the original 30 days; OCR treats this as a missed window.

Maintenance cadence

• Weekly: Privacy Officer reviews the tracker; any request approaching Day 25 is escalated.
• Monthly: tracker reconciled against EHR access-request logs (if EHR captures portal requests separately).
• Quarterly: sample five completed requests for documentation completeness; verify any extensions had written notice; verify fee math.
• Annually: procedure refresh; fee schedule refresh against current OCR guidance and state-law caps; staff retraining; review against the OCR Right of Access Initiative settlement docket for new patterns.
• On any complaint: full file review and remediation; document the closure in the tracker.

State preemption note: California Health & Safety Code § 123110 requires inspection within 5 working days and transmission of copies within 15 days, with a fee schedule capped at $0.25 per page. Texas HB 300 tightens the EHR-access window to 15 business days. Florida § 456.057 requires copies to be furnished "in a timely manner" and imposes per-page fee caps; the 30-day window is HIPAA's at § 164.524(b)(2), not Florida's. NY Public Health Law § 18 imposes a 10-day inspection window. Where state law is stricter on timeline or fee, state law controls per § 160.203.

How d3rx fits

The d3rx compliance binder generates the Right of Access procedure, the Intake Form, the Tracker, the Extension Notice, the Denial Notice, and the fee schedule with § 164.524, the OCR Right of Access Initiative settlement context, and the Cures Act Information Blocking framework cited inline. The Privacy Officer remains responsible for verifying requester identity, calculating fees, and signing every Denial or Extension Notice.