HIPAA Right of Access (45 CFR 164.524)
Individuals have a right to inspect and obtain copies of their PHI in a designated record set, in the form and format requested when readily producible, within 30 days.
Primary source
45 CFR 164.524 — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
Additional sources
45 CFR 164.524 gives individuals the right to inspect and obtain a copy of PHI held in a designated record set. The standard requires action within 30 calendar days (a single 30-day extension is permitted with written notice), in the form and format the individual requests if readily producible, and at a fee limited to a reasonable, cost-based amount.
The OCR Right of Access Initiative has produced more than 50 enforcement actions since 2019, almost all for delays, denials, or excessive fees. Settlements have ranged from low five figures to over $200,000. The most common failure mode in cited cases is the 30-day deadline.
Practices must publish the request mechanism in the Notice of Privacy Practices, train workforce on intake, document the request and response date, and confirm transmission via the individual's chosen method (including unencrypted email if the individual has been warned of the risk and still elects it, per OCR guidance). Denials are limited to the narrow grounds in 164.524(a)(2)-(3).
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Accounting of Disclosures (45 CFR 164.528)Individuals may request an accounting of disclosures of their PHI made by a covered entity in the prior six years, with a defined list of exclusions.
- RegulationHIPAA Privacy Rule: General Rules for Uses and Disclosures (45 CFR 164.502)The general rules covered entities follow for any use or disclosure of protected health information, including the minimum necessary standard and treatment, payment, and operations exceptions.
- RegulationHIPAA Restriction Requests and Confidential Communications (45 CFR 164.522)Individuals may request restrictions on use or disclosure of PHI and may request communications by alternative means or at alternative locations.
- ComplianceAccounting of Disclosures (45 CFR § 164.528): Tracker + ProcedureA 2026 HIPAA Accounting of Disclosures procedure citing 45 CFR § 164.528 — the six-year lookback, what to log, exclusions, and a copy-ready tracker template.
- SRAHIPAA Patient Right of Access: A Small-Practice WalkthroughHow 45 CFR 164.524 governs patient access to their records, the 30-day rule and 30-day extension, the limited fees a practice may charge, and the OCR Right of Access Initiative.
- ComplianceHIPAA Right of Access Requests (45 CFR § 164.524): Respond Inside 30 DaysA 2026 HIPAA right-of-access procedure citing 45 CFR § 164.524, the 30-day window, OCR Right of Access Initiative settlements ($3,500–$240,000 through 2025), and the patient response packet.
- GlossaryAccounting of DisclosuresThe HIPAA right of an individual to receive a list of disclosures of their PHI made by a covered entity over the prior six years.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.