How to File a HIPAA Complaint Over Denied Records

How do you file a HIPAA complaint when you are denied your records?

If a provider or health plan denies you access to your medical records, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights — OCR — the federal office that enforces HIPAA. HIPAA gives you enforceable rights over your protected health information, including the right to get a copy, and OCR is where you go when that right is ignored 1Ref 1U.S. Department of Health and Human Services, Office for Civil Rights (2024).HIPAA for Individuals.That HIPAA gives individuals enforceable rights over their protected health information, including the right to access records, which is the basis for filing a complaint when that right is denied.. The complaint is free, you do not need a lawyer, and a provider is prohibited from retaliating against you for filing one.

OCR enforces your HIPAA access right, and filing a complaint costs nothing.

What counts as an improper denial

Not every no is a violation, so it helps to know the standard. A covered entity must give you access to your designated record set — generally within 30 days of your request, in the form and format you ask for when that is readily producible, and for a fee that is reasonable and cost-based 2Ref 2U.S. Department of Health and Human Services, Office for Civil Rights (2024).Individuals' Right under HIPAA to Access their Health Information.The standard a covered entity must meet — access to the designated record set, generally within 30 days, in the form requested when producible, for a reasonable cost-based fee — which defines what an improper denial looks like.. Measured against that, several responses are red flags:

• No response at all within the timeframe, or a vague, indefinite delay.
• A fee that looks far above the cost of copying, or a demand for payment before any record is released.
• Refusing to send electronic copies that could be produced, or requiring you to appear in person for no reason.
• Conditioning access on why you want the records.

Some denials are lawful, though. A provider can withhold a narrow set of material — psychotherapy notes and information compiled for a legal proceeding are the classic examples — so refused medical records are not automatically a HIPAA violation. Knowing the difference between a lawful exception and an improper denial tells you whether a complaint is the right tool.

Before you file: put the request in writing and set the deadline

A complaint is far stronger when you can show exactly what you asked for and what happened. Before escalating, make the request unmistakable and dated. Send it in writing, keep a copy, and note the date a response is due so a missed deadline is documented rather than argued about.

Build the record you will need:

• A dated written request naming the specific records and the format you want.
• Any reply — a fee estimate, a partial release, or a denial letter with its stated reason.
• Notes of phone calls: who you spoke with, when, and what they said.

If you are exercising your hipaa right of access this way and the goal is care — say, medical records for second opinion — it is fine to tell the office that, but you are never required to justify the request. The paper trail is what turns a frustrating runaround into a complaint OCR can act on.

How to file the complaint with OCR

OCR takes complaints online through its complaint portal and by mail or fax. You do not need special legal language — you name the provider or plan, describe what you requested and when, and explain how the response fell short. File promptly: there is a filing deadline that runs from when you knew of the problem, so a long wait can cost you the complaint.

Include the essentials:

• Who withheld the records — the provider, facility, or health plan.
• What you asked for, in what format, and the date you asked.
• What they did or failed to do, with copies of your request and any denial.

OCR reviews complaints, and retaliation for filing one is prohibited. Keep your own copy of everything you submit, because the same file supports any follow-up.

Information blocking: a second complaint channel

When the obstruction is electronic, there is a second, separate route. The 21st Century Cures Act requires that you be able to get your electronic health information at no cost, and it prohibits health IT actors from obstructing that access 3Ref 3Office of the National Coordinator for Health Information Technology (ONC) (2020).ONC's Cures Act Final Rule.That patients can access their electronic health information at no cost and that health IT actors may not lawfully obstruct that access.. That obstruction has a legal name — information blocking — defined under the Cures Act at 45 CFR Part 171, with ONC and the HHS Office of Inspector General overseeing and enforcing the rules 4Ref 4Office of the National Coordinator for Health Information Technology (ONC/ASTP) (2024).Information Blocking.The definition of information blocking under the 21st Century Cures Act at 45 CFR Part 171, and that ONC and HHS OIG oversee and enforce these rules, making an information-blocking report a second complaint channel..

So if the failure is a blocked patient portal access, a refusal to export your data, or an electronic-records vendor standing in the way, you can report information blocking through ONC's channel in addition to, or instead of, an OCR HIPAA complaint. The ONC information blocking rule reaches the health IT side of the problem that a HIPAA access complaint alone does not.

What to expect, and what you can still do while you wait

An OCR review does not usually end in a penalty. Most access complaints resolve with the provider being required to release the records and fix the practice that caused the delay; penalties are reserved for serious or repeated violations. That is a good outcome — the point is to get your records, and pressure from a federal complaint often produces them.

While a complaint is pending, keep moving:

• Check whether the records are already sitting in your patient portal, even if a full request stalled.
• Get individual pieces directly from their source — for instance, obtain your pathology report from the lab that produced it, or imaging from the imaging center.
• If you are trying to move care forward, you can start to get a second opinion with whatever records you already hold and add the rest when they arrive.
• If the record you finally receive contains an error, correcting it is a separate process — a records amendment — not part of the access complaint.