Right of access to health records

Access reaches a designated record set

The manifest starter HHS access FAQ explains that access covers PHI in designated record sets maintained by or for a covered provider or health plan. These can include medical, billing, claims, enrollment, case-management, and other records used to make decisions about individuals.

ABA examples may include assessments, treatment plans, progress notes, service records, billing records, consent forms, and other decision records. A portal display may represent only part of the designated record set.

Some information is excluded

HIPAA excludes psychotherapy notes as specially defined and information compiled in reasonable anticipation of or for legal proceedings. Other limited grounds for denial exist, with review rights for some denials.

Avoid turning an exception into a blanket “clinical notes are excluded” rule. Identify the exact record, legal basis, decision-maker, written response, and any review process.

The ordinary HIPAA clock is 30 days

The detailed HHS access guidance says a covered entity must act on a request no later than 30 calendar days after receipt. The agency calls that an outer limit and encourages faster access when possible.

One extension of up to 30 additional calendar days is available when the entity sends a written explanation and completion date within the initial period. Business-associate retrieval does not restart the clock. Shorter state deadlines may control.

Form, format, and delivery matter

When readily producible, provide the copy in the requested form and format. If it is not readily producible, agree on a readable alternative. Unencrypted email may be available after the covered entity explains the security risk and the individual still prefers that method, subject to current guidance and facts.

Verify the requester, recipient, destination, scope, and delivery instruction. Secure handling should support access rather than create artificial barriers.

Fees have limits

HIPAA permits a reasonable, cost-based fee for certain copying labor, supplies, postage, and an agreed summary or explanation. HHS says the fee cannot include verification, search and retrieval, record maintenance, infrastructure, or other unlisted costs.

Give advance notice of an approximate fee when practical. A provider cannot deny access because the person has an unpaid bill for healthcare services.

Verify personal-representative authority

The HHS personal-representative guidance explains that applicable law determines who acts for another person and the scope of authority. Minor-specific rules and an abuse, neglect, or endangerment exception can affect recognition.

A family member or involved caregiver is not automatically entitled to the entire record. Verify authority for the access request while considering any other lawful communication route separately.

Access and release are different paths

The individual may request their own copy. HIPAA also provides a route for directing an electronic copy in an electronic health record to a designated person under current rule conditions. A provider-to-provider disclosure for treatment or a HIPAA authorization can follow another path.

Ask what outcome the requester wants, then route the request correctly. Families should not lose time because they used “release,” “records,” or “portal” instead of a legal term.

A fictional portal example

North Star ABA receives ten mature access requests during a quarter. Six are completed by their applicable target date, two remain open with documented extensions, and two are overdue. On-time completion is 6 of 10, or 60%. The extended requests remain in the original cohort and are reported separately.

After assigning one owner and adding records held by its billing vendor to the inventory, the next eight mature requests are completed on time in 8 of 8 cases. This measures timing. It does not show that every produced record, format, fee, denial, or representative decision was correct.

Questions families can ask

Ask how to submit a request, when the clock starts, which records are in the designated record set, what format is available, and whether a fee applies. Keep proof of submission and a copy of any extension or denial.

If part of the request is denied, ask for the precise basis and any review right. If a portal is incomplete, state the additional records sought rather than assuming the portal equals the full record.

Ask whether a business associate holds any requested records and how the covered entity will retrieve them within the same response clock. Request an itemized explanation of any proposed fee before agreeing to a summary or alternate format.

Close the request only after verifying scope, identity or representative authority, format, delivery, fee, timing, and any exclusion or denial notice. Keep extensions and partial productions visible in the original cohort until every requested component has a disposition.