HIPAA access request

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Define the request and authority

Record the individual, requester authority, record categories, date range, inspection or copy choice, format, delivery route, recipient, and received date. 45 CFR 164.524 reaches PHI in designated record sets and identifies psychotherapy notes and litigation-preparation material outside the access right. State law may provide additional access.

Track the response clock

The covered entity generally must act within 30 days of receipt. It may use one extension of no more than 30 days if, within the first period, it gives a written reason and the date it will complete action. Track receipt, scope clarification, acceptance or denial, extension notice, production, delivery, and closure as separate events.

Provide the requested access

Use the requested form and format when readily producible, or agree on another readable form and format. Discuss convenient inspection, copies, transmission to a clearly identified third party under the rule, and permitted cost-based fees. HHS access guidance provides detailed operational guidance.

Keep every request in the denominator

A fictional practice receives fifteen requests due this month. Twelve are fulfilled, one receives a valid denial, one has a timely extension, and one is overdue. Timely action is 14 of 15 requests because the valid denial and extension both count as action. The overdue request remains visible.

Recognize the request wherever it arrives

Train clinical, front-desk, billing, portal, privacy, and vendor teams to recognize plain-language requests for records. A person need not cite HIPAA or use the practice's preferred form. Route the received date, original wording, contact method, and known scope to one accountable queue without waiting for the privacy office to open it.

Verify identity and requester authority using reasonable methods that do not create an unnecessary barrier. Distinguish the individual, personal representative, parent or guardian, estate representative, and another person receiving a directed copy. Record the authority source and scope. Apply confidential communication preferences to every follow-up.

If clarification is needed, ask only what is necessary to locate the records, select inspection or copy, understand format, or identify the destination. Keep the original receipt date and document the clarification period rather than resetting the clock.

Search the complete designated record set

Maintain a record map covering clinical, billing, case-management, authorization, communication, portal, archived, acquired, and business-associate sources used to make decisions about individuals. Generate one search task per due source with owner, date range, export method, result, and evidence.

Reconcile duplicates without dropping unique attachments, amendments, message threads, graphs, or metadata needed for interpretation. If the practice does not maintain requested PHI but knows another holder, tell the individual where to direct that part of the request.

Psychotherapy notes and litigation-preparation material have specific treatment under the access rule. Other sensitive, disputed, embarrassing, or inconvenient records are not automatically excluded. Route any denial through the exact reviewable or nonreviewable process and provide the accessible remainder.

Agree on inspection, form, and delivery

Offer inspection or a copy as the rule provides. When an electronic format is readily producible, supply the requested form and format; otherwise agree on a readable alternative. Test accessibility, file integrity, attachments, page counts, and recipient usability.

For a copy directed to another person, verify the current rule after the HHS guidance's court-order notice, the signed direction when applicable, the person and destination, fee treatment, and secure transmission. The individual may also obtain a copy and send it independently.

Calculate only a permitted cost-based fee. Provide advance notice for a material charge and agree in advance to any summary or explanation and its fee. A fee discussion or unpaid unrelated bill should not become an access barrier.

Control the clock and final disposition

Track receipt, identity and authority, clarification, sources due, search completion, format agreement, fee estimate, denial analysis, extension notice, production, delivery, failure, and closure. Use one extension only when the rule permits and send its written reason and completion date before the initial deadline.

Closure requires every requested source to be delivered, inspected, denied properly, redirected to a known holder, or otherwise resolved. Preserve the production manifest, files or exact content delivered, delivery evidence, notices, fees, and questions.

Access request checklist

• original request and received date preserved
• requester identity and authority verified reasonably
• every designated record set and business associate searched
• requested period, format, delivery, and recipient confirmed
• exclusions and denials limited to exact rule grounds
• accessible remainder produced on time
• fee limited to supported categories
• extension, if any, timely and used only once
• files reconciled, readable, accessible, and securely delivered
• final manifest and disposition retained

Useful measures include requests acknowledged, sources searched, records delivered, timely actions, valid extensions, correct denials, usable files, and failed deliveries corrected. Report open requests by age, remaining source, owner, and legal dependency.