How Long Does a Covered Entity Have to Respond to a HIPAA Records Request?

Under the HIPAA right of access, a covered entity must act on an individual's request for access to PHI no later than 30 days after receiving it. If it cannot act within that time, it may take one extension of up to 30 more days by giving the individual, within the first 30 days, a written statement of the reasons and the date by which it will complete action.

The right. 45 CFR 164.524 gives individuals a right to inspect and obtain a copy of PHI about them in a designated record set, with limited exceptions such as psychotherapy notes and information compiled in reasonable anticipation of legal proceedings.

Timing (164.524(b)(2)). The covered entity must act within 30 days of receipt. One extension of no more than 30 days is allowed if the covered entity gives the individual, within the original 30 days, a written statement of the reasons for the delay and the date by which it will act.

Form and format. The covered entity must provide access in the form and format requested if readily producible, including electronic copies of PHI maintained electronically (164.524(c)(2)).

Fees. For an individual's request for the individual's own records, the covered entity may charge only a reasonable, cost-based fee limited to labor for copying, supplies, postage, and, if agreed, preparing a summary or explanation (164.524(c)(4)). The 164.524(c)(4) patient-access fee limitation applies to an individual's request for the individual's own records, not a request to transmit records to a third party, as explained in HHS's notice following Ciox.

Third parties. HHS's notice following Ciox explains that the mandatory third-party directive is limited to requests for an electronic copy of an electronic health record. A qualifying written, signed directive must clearly identify the recipient and where the copy is to be sent. The codified text of 164.524(c)(3)(ii) still prints broader language, so it should be read together with the HHS notice.

Enforcement. OCR enforces the right of access through its Right of Access Initiative. Its August 27, 2026 Azul Vision announcement described that settlement as the initiative's 55th enforcement action.

Note. Learn Laws® is a training company, not a law firm. This FAQ summarizes federal rules for general information and is not legal advice. HHS and OCR do not endorse any private consultants' or education providers' seminars, materials or systems, and do not certify any persons or products as "HIPAA compliant."