This is the single most enforced part of HIPAA — and most people who run into trouble getting their own records don't realize there's a hard legal deadline attached.
What the Right of Access Actually Guarantees
Under the HIPAA Privacy Rule (45 CFR 164.524), you have the right to inspect and obtain a copy of your own protected health information held in a "designated record set" — this covers medical records, billing records, insurance enrollment records, and any other records used to make decisions about your care, in paper, electronic, or any other form the provider maintains it.
Covered entities — providers, health plans, and their business associates — must act on your request within 30 calendar days. A single 30-day extension is allowed, but only if the provider gives you written notice explaining the reason for the delay and the expected completion date. If you requested your records electronically and the provider can readily produce them that way, they're required to provide them in that format, not force you into paper or an in-person pickup. Fees, where charged at all, must be reasonable and cost-based — covering only labor, supplies, and postage — never a flat retrieval charge, and never conditioned on you first paying an outstanding bill.
Regulators Are Actively Enforcing This — Recent Cases Show It
The Department of Health and Human Services' Office for Civil Rights (OCR) has run a dedicated Right of Access Enforcement Initiative since 2019, and it remains one of its most active enforcement programs. In December 2025, OCR settled with Concentra, an occupational health provider, for $112,500 — its 54th enforcement action under this initiative — after the company failed to provide a patient's records within 30 days despite multiple requests; the records were ultimately produced more than a year after the original request. Settlements under this initiative have ranged from $3,500 for a solo dental practice up to $240,000 for a hospital system, and OCR has been explicit that neither staffing shortages nor IT limitations excuse noncompliance.
What Can Actually Justify a Denial
A provider can deny your access request only on specific, limited grounds defined in the rule — for example, certain psychotherapy notes, or information compiled for use in a legal proceeding. Most denial grounds also come with a right to have the denial reviewed. A provider simply not getting around to it, losing track of the request, or requiring you to appear in person to collect records is not a valid reason for delay or denial.
What This Means Practically
- Put your records request in writing and note the date — this starts the 30-day clock and gives you a clear record if it's missed.
- If you're told you must wait longer than 30 days, ask for the written extension notice the rule requires — a verbal "it'll be a while" isn't sufficient.
- Push back on any flat retrieval fee or a request tied to an outstanding bill — cost-based fees only, and access can't be held hostage to payment.
- If a provider misses the deadline or won't respond, you can file a complaint directly with OCR — this is exactly the kind of complaint the agency has shown it takes seriously.