Part 2 patient inspection and copy opportunity

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.23(a) expressly includes an opportunity for the patient to inspect and copy records that the Part 2 program maintains about them. The regulation permits both modes without requiring Part 2 consent. HIPAA-covered programs should separately apply the access requirements in 45 CFR 164.524, and state law may supply additional rights or constraints.

Inspection and copies are distinct services

42 CFR 2.23 names both inspection and copying as examples of patient access. Record whether the patient wants on-site or remote inspection, paper or electronic copies, particular records, a summary where separately permitted, or help understanding the material.

Design a safe inspection

Verify identity and authority, prepare the responsive set, protect other people's information under applicable law, provide a private accessible space or secure viewer, control temporary notes and downloads, support communication, and record questions or follow-up.

Complete the copy workflow

Use the current final-rule context alongside other access law. Track format, secure channel, recipient, encryption decision, file integrity, failed delivery, receipt, fee basis, deadline, partial response, denial, appeal, and closure.

Clarify which access experience the patient wants

Offer a clear choice among inspection, copies, or both when applicable. Record the requested records, date range, on-site or remote preference, paper or electronic form, delivery channel, accessibility and language needs, representative, and help the patient requests. Explain the process without steering the patient toward the option that is easiest for the program.

Treat a request to inspect now and obtain copies later as one coordinated matter with distinct completion events. Keep the original receipt date and all governing deadlines visible.

Prepare a complete and safe inspection

Search and reconcile the maintained record set before the appointment or secure-viewer session. Confirm identity and authority, review exclusions under applicable law, protect information about other people, and provide an accessible private setting. Assign trained staff who can facilitate navigation without altering records or offering unsupported clinical or legal interpretations.

Control screenshots, downloads, printing, temporary files, shared screens, nearby conversations, visitor access, and session timeouts according to the patient's rights and the approved method. Record material viewed, start and end times, assistance, interruptions, requested follow-up, and any incident.

Produce copies that are usable and faithful

Confirm format, date range, record categories, readable order, file naming, searchability when available, and accessibility. Validate page counts or file manifests, attachments, images, links, exports, encryption, passwords, and malware controls. Do not omit legacy or vendor records merely because they require a different export.

Apply the governing fee, timing, extension, denial, and review rules. Provide advance fee information when required and avoid per-page or retrieval charges that the controlling law disallows. Document any summary offered or accepted instead of a copy.

Manage delivery and failed delivery

Verify the destination immediately before release. Use the patient-selected or otherwise approved channel, separate passwords when appropriate, and retain transmission and receipt evidence. If mail returns, a portal account changes, an email fails, or a download expires, protect the copy and contact the patient through an approved route.

Never redirect the copy to a family member, provider, lawyer, or app without analyzing the requested third-party disclosure. A self-access request does not create unlimited recipient authority.

Close open issues and measure service

Track partial production, unavailable material, disputed exclusions, amendments, complaints, repeated requests, clinical questions, and accessibility remediation to disposition. Keep provenance for the continuing criminal-use restriction in section 2.23(b).

Audit mature requests using the original due date. Measure completed inspection, delivered copies, incomplete searches, supported fees, denials, incidents, and patient-reported usability rather than counting a prepared export as completion.

Use complaints and follow-up questions to identify records that patients could not locate, open, read, or understand and repair the delivery process.

Example

Ten inspection-and-copy episodes mature. Eight have scope, identity, accessible inspection, copy format, secure delivery, receipt, and closure; two lack proof of delivery. Completion is 8 of 10 episodes.

Inspection-and-copy checklist

• record requested records, modes, form, channel, dates, authority, and accessibility needs;
• search and reconcile the complete maintained record set before access;
• provide a private, controlled, accessible inspection with documented assistance;
• validate copy content, format, attachments, readability, security, fees, and deadlines;
• verify delivery, resolve failures, and keep third-party disclosures on their own route; and
• close partial, denied, corrected, disputed, and incident items with evidence.

Inspection and copying are related but distinct services. Completion should be provable for each mode the patient requested.