Nonreviewable access denial

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

The category has narrow grounds

45 CFR 164.524 lists the unreviewable grounds. They cover psychotherapy notes or litigation-preparation material excluded from the access right; specified correctional-institution circumstances; an agreed temporary suspension during certain treatment research; certain Privacy Act records; and PHI obtained from someone other than a provider under a promise of confidentiality when access would likely reveal the source.

Classify the exact record and ground. A practice should not label every difficult, sensitive, or disputed request unreviewable.

Reviewable denials follow another path

The same rule separately identifies reviewable grounds involving a licensed professional's judgment about likely endangerment or substantial harm. Those denials carry review by a licensed professional designated by the covered entity who did not participate in the original decision. HHS's Privacy Rule overview provides the federal framework, while the operative section controls this classification. A system should store the denial category, decision-maker, evidence, date, and available review path separately.

Written notice and partial access still matter

A timely written denial must state the basis in plain language, include review rights when applicable, and explain how to complain to the covered entity or HHS. The entity must provide other requested PHI after excluding material it may deny, to the extent possible. If it does not maintain the requested PHI and knows where it is maintained, it must tell the individual where to direct the request.

A denial workflow needs evidence

A fictional practice receives six record requests. One contains material that qualifies for an unreviewable ground, one receives a reviewable denial, and four are granted. Report each state separately. The single nonreviewable denial is 1 of 6 requests, while written-notice completeness is measured across every request that was denied.

Match the record to one listed ground

Start with the requested PHI and the exact rule text. Psychotherapy notes and information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding are excluded from the access right. The correctional, research-suspension, Privacy Act, and confidential-source grounds each have their own facts and conditions.

Do not infer the category from a folder name. A legal department file can contain underlying clinical records that remain accessible elsewhere. An ABA psychotherapy or behavioral note is not automatically a HIPAA psychotherapy note. A quality, incident, peer-review, or draft label also does not create a listed denial ground by itself.

Record the source, author, purpose, maintenance location, designated-record-set status, exact denial paragraph, evidence, decision owner, and dates. Route uncertain classifications to qualified privacy and legal review before withholding information.

Keep the reviewable path distinct

Physical-safety or substantial-harm judgments described in the reviewable category cannot be converted into nonreviewable denials because a faster workflow is convenient. They require licensed professional judgment and an opportunity for independent review. General embarrassment, misunderstanding, criticism, or emotional upset does not create a new unreviewable category.

Use structured decision fields that prevent staff from choosing “nonreviewable” without selecting a rule ground and attaching supporting evidence. The system can route and validate required fields, but legal classification remains an accountable human decision.

Produce the accessible remainder

Search all designated record sets, identify denied material precisely, and provide other responsive PHI to the extent possible. If the practice does not maintain requested PHI but knows the holder, direct the individual there. Preserve the search, segregation, export, format, delivery, and missing-source evidence.

Send the written denial within the access timeframe. Use plain language, state the actual basis, omit review rights that do not apply to the unreviewable ground, and include the covered-entity and HHS complaint routes with the required contact information. A person may still challenge the classification through a complaint or other applicable right.

Apply the person's confidential communication request and accessible format to the denial itself. A correct legal decision sent to an unsafe address is an implementation failure.

Use a case-level quality check

Before release, a second authorized reviewer should verify:

• requester identity and authority
• every designated record set searched
• exact PHI and rule ground at issue
• evidence satisfying every condition of that ground
• distinction from a reviewable denial
• partial access and alternate-holder routing
• written-notice content and delivery method
• state-law or contract rights that are more protective
• complaint route, retention, and audit evidence

Track requests with complete searches, denied items mapped to a valid ground, accessible portions delivered, notices complete, and second reviews performed. Report misclassification, overbroad withholding, overdue production, and unsafe delivery as separate defects.

A practical comparison

Suppose a request includes 80 pages of ordinary medical and billing records, five pages of psychotherapy notes meeting the rule definition, and ten pages prepared for a legal proceeding. If the two exclusions apply, the practice should not deny the entire 95-page request. It should complete the search, provide the accessible 80 pages, describe the denied categories in the written notice, and preserve the classification evidence.

If another page instead raises a licensed professional's physical-safety concern, that page belongs in the reviewable analysis. Keeping the categories separate protects both the individual's access right and the qualified review process.