Guide

The right of access: 30 days federal, faster in many states

Summary

HIPAA gives you 30 days from the request to provide a patient their records, with one 30-day extension if you notify them in writing of the reason. That is a federal floor, not the whole answer: many states require faster production, and where a state deadline is shorter it controls. Start the clock the day the request arrives, and calendar the deadline immediately rather than trusting memory.

By Gale Editorial · Updated 2026-07-26. Every figure cited to a dated source. How we write.

How fast must I produce records? 30 days federal, often faster by state

When a patient asks for their records, HIPAA's right of access gives you 30 days to provide them, with one 30-day extension available if you give the patient a written reason within the first window 1. Read that as a ceiling, not a target — and not the only rule that applies. Because records timelines vary by state, many states set a shorter deadline than 30 days, and where a state law is stricter it governs your practice.

The operative provision is 45 CFR 164.524, which frames access as a patient right rather than a favor: they may inspect or obtain copies, and you provide them absent a narrow exception 2. Say the state-law point to yourself first, before you lean on the federal 30 days, because a practice that quietly uses the federal ceiling in a state with a two-week rule is late under state law even while it feels compliant.

When the clock starts and how the one extension works

The clock starts the day you receive the request, not the day you get around to it, and it runs on calendar days. If you cannot produce the records within 30 days, you may take one extension of up to 30 more days — but only if you notify the patient in writing within the original window and give the reason and the date you will deliver 1. There is no second extension.

This is not a soft deadline. OCR has run an enforcement initiative specifically on the right of access and has penalized practices, including small ones, for failing to provide records on time 5. The defense is boring and reliable: calendar the deadline the day the request arrives, and treat the extension as a rare exception you document rather than a routine buffer you assume.

What you can charge: the cost-based fee limit

You may charge a reasonable, cost-based fee for copies — and only that. The access fee may cover the labor of copying the records, the cost of supplies or media, and postage if the patient asked for mail; it may not be a per-page profit center and may not include the cost of searching for and retrieving the record 1. Some states cap copy fees below what HIPAA would allow, and the lower limit controls.

A few moves keep you clean here. Offer the patient a flat, cost-based option and tell them the amount before you start. Do not condition release on payment of an old balance — the access right is not a collection lever. And if your state's copy fees are lower or its rules more specific than the federal cost-based standard, follow the state figure rather than the federal one.

Form, format, and what is excluded

Provide the records in the form and format the patient requests when you can readily produce them that way; if they ask for an electronic copy of records you maintain electronically, you generally must send an electronic copy, not paper 1. The patient can also direct you to send the copy to a third party they name. The one significant carve-out is psychotherapy notes — the clinician's separately kept process notes — which are excluded from the access right 1.

Be precise about what psychotherapy notes actually means: it is the narrow category of separately maintained session notes, not the medical record, and not the information a patient is otherwise entitled to. Test results, medications, and the SOAP note in the chart are all part of the accessible record. If you are unsure whether something qualifies for the exclusion, the safer default is that it is accessible.

Who is allowed to make the request

The requester is normally the patient, but a personal representative — someone with legal authority to act for the patient — stands in the patient's shoes for access purposes, and you treat their request as the patient's own 3. Before you release anything to a representative, verify the authority: proof of the legal relationship comes before the records, not after.

Minors are the classic complication. HIPAA generally defers to state law on who controls a minor's record and whether a parent is the personal representative, and state law can carve out categories — reproductive, mental health, substance use — where the minor controls access 3. So a parent asking for it is not automatically a yes; the personal representative question is answered by your state's rule, and you confirm that before you produce a minor's chart.

A patient request is not a subpoena — don't confuse the two

A patient's access request and a subpoena are different animals, and confusing them causes both over- and under-disclosure. An access request comes from the patient and runs on the 30-day right of access. The subpoena is a demand in litigation, and HIPAA treats a court order differently from a subpoena that arrives without one — a court order lets you disclose what the order specifies, while a bare subpoena requires satisfactory assurances of notice to the patient or a protective order before you respond 4.

The practical rule: when a lawyer or court sends the subpoena, do not process it on the access-request track, and do not treat the 30-day clock as its deadline. Read what kind of process it actually is, confirm the assurances or the order, and disclose only what is authorized — no more, and nothing the process does not reach.

Retention: you can only produce what you still have

You can only produce what you still have, so retention sets the outer edge of the access right. HIPAA's own six-year requirement is often misread here: HIPAA's six years covers policies and compliance documentation, not the clinical record itself — how long you must keep patient records is set by state law and, for some fields, professional guidelines 2. In behavioral health the common norm runs longer for minors, extending years past the age of majority.

Two practical consequences follow. First, know your state's retention period before you dispose of anything, because a records request for a chart you shredded early is a problem you created. Second, when you do destroy records, shredding or equivalent secure destruction is the standard — a chart in the recycling bin is a disclosure. Building the retention schedule and the disposal method together keeps both the access right and the privacy obligation satisfiable.

Common questions

The obligation follows you, not the software. If a prior EHR or a records-storage vendor holds the chart, you remain responsible for producing it within the deadline, and that vendor is almost certainly a business associate you should have an agreement with. Build access to archived records into any system transition, because pointing at an old platform is not a defense to a late or missed request.

No. The HIPAA right of access is not a collection lever, and you cannot condition release of a patient's records on payment of an outstanding balance. You may charge a reasonable, cost-based copy fee for the access itself, and you may pursue the old balance through normal billing. But the records go out on the access timeline regardless of what the patient owes on their account.

The clock starts when you receive the request, so define clearly how a request reaches you — a form, an email address, a portal message — and date-stamp it on arrival. Ambiguity about the start date is what turns a comfortable window into a missed one. A simple intake log, with the request date and the deadline calculated on the spot, removes the guesswork later.

It depends on how the request comes. If the patient signs an authorization or directs you to send records to their lawyer, you send them like any access request. If instead a subpoena arrives, that is litigation process, not a patient access request, and you follow the subpoena rules — verifying notice to the patient or a protective order — rather than the 30-day access clock.

Look up your state's medical-records statute or licensing board rule; that is where a shorter deadline lives. HIPAA's 30 days is a federal floor, and where your state requires faster production, the state number controls and is the one you must meet. Because this genuinely varies, confirm your state's figure once and build it into your records-request process rather than defaulting to 30.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

  1. 1.HHS Office for Civil Rights (2026). Individuals' Right under HIPAA to Access their Health Information. U.S. Department of Health and Human Services. linkPatients may access records within 30 days with one 30-day extension, for a reasonable cost-based fee, in the form and format requested; psychotherapy notes are excluded.
  2. 2.Office of the Federal Register (2026). 45 CFR Part 164 — Security and Privacy. eCFR. link ✓Section 164.524 is the operative access provision, and section 164.316's six-year retention covers policies and documentation rather than the clinical record.
  3. 3.HHS Office for Civil Rights (2026). Personal Representatives. U.S. Department of Health and Human Services. linkA personal representative is treated as the individual for access, and HIPAA defers to state law on who controls a minor's record.
  4. 4.HHS Office for Civil Rights (2026). Court Orders and Subpoenas. U.S. Department of Health and Human Services. linkA court order authorizes disclosure of what it specifies, while a bare subpoena requires satisfactory assurances of notice or a protective order before responding.
  5. 5.HHS Office for Civil Rights (2026). HIPAA Compliance and Enforcement. U.S. Department of Health and Human Services. linkOCR's Right of Access enforcement initiative has penalized practices, including small ones, for failing to provide records within the required time.

https://www.gale.care/for-providers/hip-right-of-access-timelines · 5 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers

Findability, by specialty

How practices like yours get found in local search and AI answers — the honest playbook, per specialty.

SEO for private practices · SEO for AI search / answer engines (all verticals)