What rights do patients have to access their own medical records under HIPAA? Answer in under 100 words. Cite only eCFR (www.ecfr.gov) sources.

Details / How it works

Right of access (45 CFR § 164.524(a)(1)). An individual (patient or legally authorized personal representative) has the right to inspect and obtain a copy of PHI about the individual in a designated record set, including medical and billing records, for as long as the PHI is maintained.

Form and format (§ 164.524(c)(2)). The covered entity must provide access in the form and format requested by the individual if readily producible; if the PHI is maintained electronically and the individual requests an electronic copy, the covered entity must provide it in the electronic form and format requested, or in another readable electronic form and format agreed upon. A summary or explanation may be provided in lieu of full access if the individual agrees in advance and agrees to any applicable fees.

Time limits (§ 164.524(b)(2)). The covered entity must act on the request no later than 30 days after receipt, granting or providing a written denial. A one-time extension of up to 30 days is permitted if the covered entity provides, within the original time limit, a written statement of the reasons for the delay and the date by which action will be completed.

Third-party delivery (§ 164.524(c)(3)(ii)). If the individual directs the covered entity in writing to transmit the copy directly to a designated person (e.g., a family member, attorney, or third party), the covered entity must do so.

Fees (§ 164.524(c)(4)). The covered entity may impose a reasonable, cost-based fee limited to labor for copying, supplies for paper or electronic media, postage (if mailed), and preparation of any agreed-upon summary or explanation.

Numbers & thresholds

Exceptions & edge cases

Unreviewable grounds for denial (§ 164.524(a)(2)). A covered entity may deny access without offering review when: (i) the PHI is psychotherapy notes or litigation materials excepted by § 164.524(a)(1); (ii) a correctional institution (or a provider acting under its direction) denies an inmate's request for a copy where obtaining it would jeopardize health, safety, security, custody, or rehabilitation of the individual or others, or the safety of staff/transporters; (iii) the PHI was created or obtained in the course of research that includes treatment, and access was temporarily suspended with the individual's prior consent; (iv) the PHI is subject to the Privacy Act of 1974, 5 U.S.C. § 552a, and denial under that law would be required; or (v) the PHI was obtained from a non-health-care provider under a promise of confidentiality and access would reasonably likely reveal the source.

Reviewable grounds for denial (§ 164.524(a)(3)–(4)). A covered entity may deny access with review rights where a licensed health care professional determines, in the exercise of professional judgment, that the access is reasonably likely to endanger the life or physical safety of the individual or another person, cause substantial harm to a person referenced in the PHI (other than a health care provider), or cause substantial harm where the requester is the individual's personal representative. The individual is entitled to have the denial reviewed by a designated licensed health care professional who was not directly involved in the original decision (§ 164.524(d)(4)).

Denial procedures (§ 164.524(d)). If access is denied in whole or in part, the covered entity must, to the extent possible, give access to any other PHI requested, and provide a timely, written, plain-language denial stating the basis, the individual's review rights (where applicable), and how to complain to the covered entity (per § 164.530(d)) or to the Secretary of HHS (per 45 CFR § 160.306), including the name/title and telephone number of the designated contact person or office.

Required-disclosure anchor (§ 164.502(a)(2)(i)). A covered entity is required to disclose PHI to an individual when requested under § 164.524, reinforcing the access right as a mandatory disclosure obligation, not merely a permissive one.