The client wants everything: access rights and the narrow exceptions

What "the whole file" actually means

When a client asks for everything, the request reaches your designated record set: the records you use to make decisions about them — intake and history, assessments, treatment plans, progress notes, testing data, medication records if you keep them, billing, and correspondence. HIPAA's right of access lets a client inspect and obtain a copy of that set, and it is deliberately broad 1Ref 1HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.The HIPAA right of access — the 30-day timeline with one extension, the reasonable cost-based fee, form and format, and denial grounds with review, plus the exclusion of psychotherapy notes from the access right.. The Privacy Rule frames access as an individual right, not a favor you grant 2Ref 2HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That access is an individual right under the Privacy Rule and that the designated record set governs what a practice must produce..

The set is defined by function, not by which folder a page sits in. If a document informs your clinical decisions, it is almost certainly inside the request — even a stray email. A short list of material falls outside it, and for a solo therapist two items usually matter: your separately kept psychotherapy notes, and information compiled in anticipation of a lawsuit.

The one lock you keep: psychotherapy notes

Psychotherapy notes are the exception that trips people up. HIPAA defines them narrowly: your private notes analyzing or documenting the contents of a counseling session, recorded and kept separate from the rest of the chart. Kept that way, they are the one part of the record the access right does not reach, and disclosing them almost always requires the client's written authorization rather than a records request 3Ref 3HHS Office for Civil Rights (2026).Does HIPAA provide extra protections for mental health information compared with other health information?.That psychotherapy notes are kept separate from the rest of the record and their disclosure generally requires the client's written authorization..

The whole protection rides on the word separate. If your session analysis lives inside the same progress note as symptoms, diagnosis, treatment plan, and functional status, none of it qualifies — you have written one record, and the entire thing is reachable. Treating psychotherapy notes as a deliberate second file, not a label applied after a request arrives, is what keeps the lock intact. Everything a payer legitimately needs — dates, diagnoses, session length, progress toward goals — belongs in the progress note, outside the lock.

The clock and the fee you may charge

You have thirty days to act on a records request, with a single 30-day extension if you tell the client in writing why and when the record will arrive 1Ref 1HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.The HIPAA right of access — the 30-day timeline with one extension, the reasonable cost-based fee, form and format, and denial grounds with review, plus the exclusion of psychotherapy notes from the access right.. You may charge a reasonable, cost-based fee — the labor of copying, the media, and postage — but not a per-page search charge or the cost of your own time. For most electronic charts the defensible amount is small, and many practices simply provide the record at no charge.

The cost-based fee may include:

• Labor for copying the record, whether paper or electronic
• Supplies such as a USB drive or paper, if the client wants that format
• Postage, when the client asks for the record mailed
• The cost of preparing a summary, but only if the client agrees to a summary and its fee in advance

What it may not include: a fee for the time you spend searching for, retrieving, or reviewing the record. Those are the costs the access rule specifically bars you from passing on.

When you may narrow or deny access

Denial is tightly boxed. You may hold back psychotherapy notes and litigation material because they are not in the access set to begin with. Beyond that, a licensed professional may deny access only on specific grounds — most relevantly, a reasonable belief that access is reasonably likely to endanger the life or physical safety of the client or another person — and even then the client can ask a second licensed professional to review the denial 1Ref 1HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.The HIPAA right of access — the 30-day timeline with one extension, the reasonable cost-based fee, form and format, and denial grounds with review, plus the exclusion of psychotherapy notes from the access right..

What is not a lawful reason: that the content is emotionally difficult, that you disagree with how the client will use it, or that a balance is unpaid. Sensitive is not the same as dangerous. When you do withhold part of a record, release everything you can and deny only the narrow portion, with the reason documented in the file.

Format, delivery, and the information-blocking trap

Give the client the record in the form and format they ask for when you can readily produce it — a PDF, a secure download, a paper copy — and by the delivery method they request, including unencrypted email once you have warned them of the risk and they still choose it. The 21st Century Cures Act adds a second duty: its information blocking rules bar a clinician from unreasonably interfering with access to electronic health information, subject to eight defined exceptions 4Ref 4Office of the National Coordinator / ASTP (2026).Information Blocking.That the 21st Century Cures Act bars clinicians from unreasonably interfering with access to electronic health information, subject to eight defined exceptions..

The practical trap is a habit of delay or a blanket policy of withholding that looks reasonable in the moment but has no exception behind it. The eight exceptions — including a privacy exception and a preventing-harm exception — are specific and documented, not a general discretion. The psychotherapy-notes carve-out still stands; information blocking does not force those notes open. What it does not tolerate is friction applied to the ordinary record.

Who is actually allowed to ask

The right belongs to the client and to their personal representative — someone with legal authority to act for them, such as a parent for a young child, a guardian, or an executor. HIPAA generally treats that person as the individual, so their request carries the same force, though state law decides who qualifies and a few endangerment exceptions let you withhold 5Ref 5HHS Office for Civil Rights (2026).Personal Representatives.That a personal representative with legal authority is treated as the individual for access, with state law defining who qualifies and limited endangerment exceptions.. Verify the legal authority before releasing; a spouse or an adult child is not automatically a representative.

Before any of this applies, the covered-entity test decides whether HIPAA governs you at all, and your notice of privacy practices — the npp — should already tell clients how to make a request. Keep this access lane distinct from two neighbors: break-glass disclosures to family in an emergency run on different permissions, and what payers and the chart exchange for billing is its own minimum-necessary question, not a client-access one.