21:I[274158,["/_next/static/chunks/3uhvnxt2vt_hx.js","/_next/static/chunks/31sbwq4d7qvwb.js","/_next/static/chunks/3a5w9ad7hq1je.js","/_next/static/chunks/2u6gyfrtlwtzs.js","/_next/static/chunks/2smfgp9tli88a.js","/_next/static/chunks/446l1nv3j5ucj.js","/_next/static/chunks/0dhn7k_wy7988.js","/_next/static/chunks/0n50a6x3wwebg.js","/_next/static/chunks/0euult3n5f42y.js","/_next/static/chunks/04e7e6ppoj5bv.js","/_next/static/chunks/2ffsoi5ktdxw5.js","/_next/static/chunks/3vphuqjx6m185.js","/_next/static/chunks/2c0gyiz0ve5-b.js","/_next/static/chunks/07qh0wz8bl7y1.js","/_next/static/chunks/27y-_1zgwe2ic.js","/_next/static/chunks/1r1yfo4-cs-0o.js","/_next/static/chunks/3awmlzhk1cpzf.js","/_next/static/chunks/2of3krkrt5bki.js","/_next/static/chunks/0wmhxz4qtl2-j.js","/_next/static/chunks/0xg8q5sefaqie.js"],"default"] 24:I[27201,["/_next/static/chunks/3uhvnxt2vt_hx.js","/_next/static/chunks/31sbwq4d7qvwb.js","/_next/static/chunks/3a5w9ad7hq1je.js","/_next/static/chunks/2u6gyfrtlwtzs.js","/_next/static/chunks/2smfgp9tli88a.js","/_next/static/chunks/446l1nv3j5ucj.js","/_next/static/chunks/0dhn7k_wy7988.js","/_next/static/chunks/0n50a6x3wwebg.js","/_next/static/chunks/0euult3n5f42y.js","/_next/static/chunks/04e7e6ppoj5bv.js","/_next/static/chunks/2ffsoi5ktdxw5.js","/_next/static/chunks/3vphuqjx6m185.js","/_next/static/chunks/2c0gyiz0ve5-b.js","/_next/static/chunks/07qh0wz8bl7y1.js","/_next/static/chunks/27y-_1zgwe2ic.js","/_next/static/chunks/1r1yfo4-cs-0o.js"],"IconMark"] 22:T3028,# Get Records in 30 Days: U.S. HIPAA Right of Access, 2026 Update ![Patient requesting access to medical records](https://media.babylovegrowth.ai/blog-images/organization-26020/1790827636871_Patient-requesting-access-to-medical-records.jpeg) Under HIPAA, you have a legal right to inspect and obtain copies of your medical and billing records held by covered entities, normally within [30 calendar days](https://www.hhs.gov/hipaa/for-professionals/faq/how-timely-must-a-covered-entity-be/index.html). Providers can charge only limited, cost-based fees for copying and mailing, never for searching or retrieving your file. If a request is delayed or refused without a valid reason, you can ask for a written explanation and escalate to the Office for Civil Rights. *** > **TL;DR:** > > - Providers must respond to access requests within 30 days, allowing only a single 30-day extension with prior written notice and a valid reason. > - Only costs related to copying, mailing, or providing a summary are allowable fees; search and retrieval are always free. > - Patients should specify they want records in electronic format or portal download first to avoid mailing delays and extra fees. > - Denials based on exceptions like psychotherapy notes or legal proceedings are usually not reviewable, while others can be challenged and reconsidered. > - Filing complaints with the Office for Civil Rights is advised if providers delay or improperly refuse access, with all correspondence kept as a paper trail. *** ## Table of Contents - [1. What your right of access actually covers](#what-your-right-of-access-actually-covers) - [2. How long you have to wait and what providers can charge](#how-long-you-have-to-wait-and-what-providers-can-charge) - [3. How to request your records step by step](#how-to-request-your-records-step-by-step) - [4. When a denial is legitimate and when it isn't](#when-a-denial-is-legitimate-and-when-it-isnt) - [5. What to do if your request is delayed or denied](#what-to-do-if-your-request-is-delayed-or-denied) - [6. How digital tools speed up exercising this right](#how-digital-tools-speed-up-exercising-this-right) - [Why checking your own records matters more than people think](#why-checking-your-own-records-matters-more-than-people-think) - [Where to verify this information](#where-to-verify-this-information) - [Sources](#sources) - [FAQ](#faq) ## 1. What your right of access actually covers Your right of access applies to what HIPAA calls a "designated record set." That is the collection of records a provider or health plan uses to make decisions about your care or payment, and it is broader than most people expect. - Medical records: visit notes, lab results, imaging reports, treatment plans. - Billing and claims records: invoices, insurance claims, payment history. - Enrollment and case management files held by your health plan. Some records sit outside this right. Psychotherapy notes kept separate from the rest of your chart are excluded, as are certain documents prepared for a lawsuit. Both carve-outs come straight from HHS guidance on the scope of access, which also spells out that business associates (billing companies, lab vendors, and other contractors handling your PHI on a provider's behalf) must honor the same right when they hold your records. Knowing this list matters because a front-desk staffer who tells you "we don't have that" may simply be looking in the wrong place. Ask specifically for the designated record set, not just "my chart." ## 2. How long you have to wait and what providers can charge **30 calendar days** is the legal ceiling for a response, not a suggestion. HHS is explicit that this clock starts the day a covered entity receives your request, and a single 30-day extension is allowed only if the provider gives you written notice, with a reason and a new delivery date, before the first deadline passes. Fees are just as tightly bound. HHS guidance on access and fees lays out exactly what is allowed: - Labor for copying records, whether paper or electronic. - Supplies like paper, a flash drive, or a mailed CD. - Postage, if you asked for records by mail. - A fee for a summary, but only if you specifically request one instead of the full record. What providers cannot charge for: searching for your file, retrieving it from storage, or letting you inspect it in person. Portals and electronic delivery often cost nothing at all, since there is no copying labor involved. If you are quoted a flat fee that sounds like it covers "processing" or "administrative time," ask what it is based on. HHS has said plainly that entities should forgo fees where possible when cost becomes a barrier to access. ## 3. How to request your records step by step Most requests move faster than people expect once you know the sequence. 1. Decide what you actually want: to inspect records in person, get copies, or have them sent to another provider or app. 2. Pick your format. Ask for electronic delivery, PDF, or a portal export if the provider supports it. HHS guidance says entities should produce records in your requested format when it is readily producible. 3. Check the patient portal first. Many systems now let you download records instantly without filing paperwork at all. 4. If there's no portal access to what you need, submit a signed written request with your full name, date of birth, the specific records and date range, and where to send them. 5. To direct records to a third party, a family member, a new specialist, or a personal health app, include a clear, signed instruction naming the recipient. A typed signature on a PDF or an electronic signature through a secure form is generally accepted. **Pro Tip:** *Ask for an electronic export or portal download first. It usually skips the mailing delay entirely and avoids copying fees altogether.* Tools built for this kind of transfer, like [FHIR and SMART Health Links](https://medfiles.ai/en/articles/medical-record-sharing-online), can move your records between systems without you ever printing a page. ## 4. When a denial is legitimate and when it isn't Not every "no" is a violation, but some are. HIPAA allows a narrow set of exceptions. - Psychotherapy notes kept separately from the main record can be withheld. - Information compiled specifically for a civil, criminal, or administrative legal proceeding is excluded. - Records involved in certain ongoing research studies may be temporarily restricted, with conditions. A denial that falls into one of these categories is typically unreviewable. One that doesn't, such as a provider simply refusing to send records to the address or recipient you specified, is a reviewable denial, and you have the right to ask for that decision to be reconsidered. You can also submit a written statement of disagreement to be added to your file if a denial stands. ## 5. What to do if your request is delayed or denied Keep a paper trail from the first request onward. It makes every later step faster. 1. If the provider invokes the 30-day extension, ask for the written notice stating the reason and the new delivery date, since HIPAA requires both. 2. If the deadline passes with no response, request a written explanation and ask to speak with the privacy officer or compliance contact. 3. Ask the covered entity for an internal review if you believe the denial was improper, and keep copies of every request, denial, and reply. 4. If the issue isn't resolved, file a complaint with the HHS Office for Civil Rights, including the dates of your original request, any written denials, and copies of your correspondence. Some states also accept complaints through their own health privacy offices. ## 6. How digital tools speed up exercising this right Manual requests involve phone calls, fax numbers, and waiting. [ONC's own guidance](https://healthit.gov/get-it-check-it-use-it/get-it/) points patients toward portals and apps precisely because they cut that friction, letting you pull records the moment they're available instead of waiting out a 30-day window. A HIPAA-ready personal record platform extends that convenience past a single provider's portal. - End-to-end encryption keeps your files unreadable to anyone without your permission. - Audit logs show exactly who viewed or received your records and when. - Granular sharing controls let you send one document to one recipient instead of your whole file. - A [secure sharing](https://medfiles.ai/en/secure-sharing) setup means you decide, each time, who gets access. MedFiles.ai builds on [HIPAA-ready infrastructure](https://medfiles.ai/en/security) so that once you've exercised your right of access and pulled records from a provider, you have one place to store, organize, and send them again without starting from scratch at the next appointment. ## Why checking your own records matters more than people think ![Why checking your own records matters more than people think — overview diagram](https://media.babylovegrowth.ai/blog-images/organization-26020/1790827692489_Why-checking-your-own-records-matters-more-than-people-think-overview-diagram.jpeg) Most patients only look at their records when something has already gone wrong: a denied claim, a medication mix-up, a specialist asking for history nobody can find. That's backward. The right of access is most valuable before trouble starts, not after. Reviewing your file regularly catches errors while they're still easy to fix: a wrong allergy listed, a medication you stopped months ago still on the active list, a diagnosis code that doesn't match what your doctor actually told you. Each of those can change how the next provider treats you. A quick check, and a safe way to share what you find, does more for your care than most people assume. > *— Team* ## Where to verify this information For the official rules behind everything above, go straight to the source. HHS's consumer page on the right to access summarizes your rights plainly, while the full regulation at 45 CFR § 164.524 spells out the legal text. For the 2026 reproductive health privacy update, see HHS's final rule fact sheet. ## FAQ ### What is the new HIPAA rule in 2026? HHS finalized a modified Notice of Privacy Practices requirement strengthening protections for reproductive health information, with compliance required by February 16, 2026. It does not change your core right of access, but it does tighten how reproductive health records can be disclosed without your permission. ### What are the main patient rights under HIPAA? HHS lists several core rights: the right to access and copy your records, the right to request amendments, the right to an accounting of certain disclosures, the right to receive a Notice of Privacy Practices, and the right to file a complaint if those rights are denied. These apply across covered entities like doctors, hospitals, and health plans. ### How long does a provider have to respond to a records request? A covered entity must act within 30 calendar days of receiving your request. One extension of up to 30 additional days is allowed, but only with written notice explaining the delay and giving a new date. ### Can a provider refuse to send my records electronically? No, not if the format is readily producible. HHS guidance states that covered entities should provide records in the format you request when they are able to, which includes electronic copies through a portal or secure file. ### What should I do if I'm charged a fee I think is unfair? Ask the provider to break down the charge. HHS fee guidance permits charges only for copying labor, supplies, and postage, never for searching, retrieving, or letting you inspect your file. If the fee doesn't match that list, you can challenge it or file a complaint with the Office for Civil Rights. ## Recommended - [6-Step Plan to Combine Medical Records for Patients, Preserve Metadata](https://medfiles.ai/en/articles/combine-medical-records) - [For Patients: Share Medical Records Online Fast With FHIR, SMART Links](https://medfiles.ai/en/articles/medical-record-sharing-online) - [Security & Privacy](https://medfiles.ai/en/security) - [Healthcare Portals for Patients: Pick a HIPAA-Ready PHR](https://medfiles.ai/en/articles/healthcare-portals)23:T3f9f,

Get Records in 30 Days: U.S. HIPAA Right of Access, 2026 Update

Patient requesting access to medical records

Under HIPAA, you have a legal right to inspect and obtain copies of your medical and billing records held by covered entities, normally within 30 calendar days. Providers can charge only limited, cost-based fees for copying and mailing, never for searching or retrieving your file. If a request is delayed or refused without a valid reason, you can ask for a written explanation and escalate to the Office for Civil Rights.

TL;DR:

Providers must respond to access requests within 30 days, allowing only a single 30-day extension with prior written notice and a valid reason.

Only costs related to copying, mailing, or providing a summary are allowable fees; search and retrieval are always free.

Patients should specify they want records in electronic format or portal download first to avoid mailing delays and extra fees.

Denials based on exceptions like psychotherapy notes or legal proceedings are usually not reviewable, while others can be challenged and reconsidered.

Filing complaints with the Office for Civil Rights is advised if providers delay or improperly refuse access, with all correspondence kept as a paper trail.

Medfiles

Keep Your Medical Records Ready

MedFiles.ai helps you securely organize, access, and share medical documents when you need them for care, travel, or emergencies.

Explore MedFiles.ai

1. What your right of access actually covers
2. How long you have to wait and what providers can charge
3. How to request your records step by step
4. When a denial is legitimate and when it isn’t
5. What to do if your request is delayed or denied
6. How digital tools speed up exercising this right
Why checking your own records matters more than people think
Where to verify this information
Sources
FAQ

1. What your right of access actually covers

Your right of access applies to what HIPAA calls a “designated record set.” That is the collection of records a provider or health plan uses to make decisions about your care or payment, and it is broader than most people expect.

Medical records: visit notes, lab results, imaging reports, treatment plans.
Billing and claims records: invoices, insurance claims, payment history.
Enrollment and case management files held by your health plan.

Some records sit outside this right. Psychotherapy notes kept separate from the rest of your chart are excluded, as are certain documents prepared for a lawsuit. Both carve-outs come straight from HHS guidance on the scope of access, which also spells out that business associates (billing companies, lab vendors, and other contractors handling your PHI on a provider’s behalf) must honor the same right when they hold your records.

Knowing this list matters because a front-desk staffer who tells you “we don’t have that” may simply be looking in the wrong place. Ask specifically for the designated record set, not just “my chart.”

2. How long you have to wait and what providers can charge

30 calendar days is the legal ceiling for a response, not a suggestion. HHS is explicit that this clock starts the day a covered entity receives your request, and a single 30-day extension is allowed only if the provider gives you written notice, with a reason and a new delivery date, before the first deadline passes.

Fees are just as tightly bound. HHS guidance on access and fees lays out exactly what is allowed:

Labor for copying records, whether paper or electronic.
Supplies like paper, a flash drive, or a mailed CD.
Postage, if you asked for records by mail.
A fee for a summary, but only if you specifically request one instead of the full record.

What providers cannot charge for: searching for your file, retrieving it from storage, or letting you inspect it in person. Portals and electronic delivery often cost nothing at all, since there is no copying labor involved. If you are quoted a flat fee that sounds like it covers “processing” or “administrative time,” ask what it is based on. HHS has said plainly that entities should forgo fees where possible when cost becomes a barrier to access.

3. How to request your records step by step

Most requests move faster than people expect once you know the sequence.

Decide what you actually want: to inspect records in person, get copies, or have them sent to another provider or app.
Pick your format. Ask for electronic delivery, PDF, or a portal export if the provider supports it. HHS guidance says entities should produce records in your requested format when it is readily producible.
Check the patient portal first. Many systems now let you download records instantly without filing paperwork at all.
If there’s no portal access to what you need, submit a signed written request with your full name, date of birth, the specific records and date range, and where to send them.
To direct records to a third party, a family member, a new specialist, or a personal health app, include a clear, signed instruction naming the recipient. A typed signature on a PDF or an electronic signature through a secure form is generally accepted.

Pro Tip: Ask for an electronic export or portal download first. It usually skips the mailing delay entirely and avoids copying fees altogether.

Tools built for this kind of transfer, like FHIR and SMART Health Links, can move your records between systems without you ever printing a page.

4. When a denial is legitimate and when it isn’t

Not every “no” is a violation, but some are. HIPAA allows a narrow set of exceptions.

Psychotherapy notes kept separately from the main record can be withheld.
Information compiled specifically for a civil, criminal, or administrative legal proceeding is excluded.
Records involved in certain ongoing research studies may be temporarily restricted, with conditions.

A denial that falls into one of these categories is typically unreviewable. One that doesn’t, such as a provider simply refusing to send records to the address or recipient you specified, is a reviewable denial, and you have the right to ask for that decision to be reconsidered. You can also submit a written statement of disagreement to be added to your file if a denial stands.

5. What to do if your request is delayed or denied

Keep a paper trail from the first request onward. It makes every later step faster.

If the provider invokes the 30-day extension, ask for the written notice stating the reason and the new delivery date, since HIPAA requires both.
If the deadline passes with no response, request a written explanation and ask to speak with the privacy officer or compliance contact.
Ask the covered entity for an internal review if you believe the denial was improper, and keep copies of every request, denial, and reply.
If the issue isn’t resolved, file a complaint with the HHS Office for Civil Rights, including the dates of your original request, any written denials, and copies of your correspondence. Some states also accept complaints through their own health privacy offices.

6. How digital tools speed up exercising this right

Manual requests involve phone calls, fax numbers, and waiting. ONC’s own guidance points patients toward portals and apps precisely because they cut that friction, letting you pull records the moment they’re available instead of waiting out a 30-day window.

A HIPAA-ready personal record platform extends that convenience past a single provider’s portal.

End-to-end encryption keeps your files unreadable to anyone without your permission.
Audit logs show exactly who viewed or received your records and when.
Granular sharing controls let you send one document to one recipient instead of your whole file.
A secure sharing setup means you decide, each time, who gets access.

MedFiles.ai builds on HIPAA-ready infrastructure so that once you’ve exercised your right of access and pulled records from a provider, you have one place to store, organize, and send them again without starting from scratch at the next appointment.

Why checking your own records matters more than people think

Why checking your own records matters more than people think — overview diagram

Most patients only look at their records when something has already gone wrong: a denied claim, a medication mix-up, a specialist asking for history nobody can find. That’s backward. The right of access is most valuable before trouble starts, not after.

Reviewing your file regularly catches errors while they’re still easy to fix: a wrong allergy listed, a medication you stopped months ago still on the active list, a diagnosis code that doesn’t match what your doctor actually told you. Each of those can change how the next provider treats you. A quick check, and a safe way to share what you find, does more for your care than most people assume.

— Team

Where to verify this information

For the official rules behind everything above, go straight to the source. HHS’s consumer page on the right to access summarizes your rights plainly, while the full regulation at 45 CFR § 164.524 spells out the legal text. For the 2026 reproductive health privacy update, see HHS’s final rule fact sheet.

FAQ

What is the new HIPAA rule in 2026?

HHS finalized a modified Notice of Privacy Practices requirement strengthening protections for reproductive health information, with compliance required by February 16, 2026. It does not change your core right of access, but it does tighten how reproductive health records can be disclosed without your permission.

What are the main patient rights under HIPAA?

HHS lists several core rights: the right to access and copy your records, the right to request amendments, the right to an accounting of certain disclosures, the right to receive a Notice of Privacy Practices, and the right to file a complaint if those rights are denied. These apply across covered entities like doctors, hospitals, and health plans.

How long does a provider have to respond to a records request?

A covered entity must act within 30 calendar days of receiving your request. One extension of up to 30 additional days is allowed, but only with written notice explaining the delay and giving a new date.

Can a provider refuse to send my records electronically?

No, not if the format is readily producible. HHS guidance states that covered entities should provide records in the format you request when they are able to, which includes electronic copies through a portal or secure file.

What should I do if I’m charged a fee I think is unfair?

Ask the provider to break down the charge. HHS fee guidance permits charges only for copying labor, supplies, and postage, never for searching, retrieving, or letting you inspect your file. If the fee doesn’t match that list, you can challenge it or file a complaint with the Office for Civil Rights.

6:[null,null,["$","$L21",null,{"article":{"id":919716,"title":"Get Records in 30 Days: U.S. HIPAA Right of Access, 2026 Update","slug":"hipaa-right-of-access","languageCode":"en","content_markdown":"$22","content_html":"$23","meta_description":"U.S. patients: Use your HIPAA right to get medical and billing records in 30 days, dispute unfair fees, and learn what the 2026 reproductive privacy...","excerpt":"Get Records in 30 Days: U. S.","hero_image_url":"https://media.babylovegrowth.ai/blog-images/organization-26020/1790827636871_Patient-requesting-access-to-medical-records.jpeg","orgWebsite":"https://medfiles.ai","created_at":"2026-10-01T04:08:58.161Z","updated_at":"2026-10-01T04:09:59.505Z","published_at":"2026-10-01T04:08:58.161Z","published":false,"published_url":"","seedKeyword":"hipaa right of access","keywords":["how to access medical files","accessing protected health information","HIPAA compliance guidelines","patient data rights","patient access rights","HIPAA patient rights","hipaa right of access","patient data access","medical information access","HIPAA compliance questions","health record request process","HIPAA access requests","right to access medical records","requesting health information","hipaa request medical records","health information access","hipaa access to medical records","HIPAA privacy rules"],"jsonLd":null,"faqJsonLd":null}}]] 9:null e:[["$","title","0",{"children":"Get Records in 30 Days: U.S. HIPAA Right of Access, 2026 Update | MedFiles.ai"}],["$","meta","1",{"name":"description","content":"U.S. patients: Use your HIPAA right to get medical and billing records in 30 days, dispute unfair fees, and learn what the 2026 reproductive privacy..."}],["$","meta","2",{"name":"keywords","content":"medical history,digital health,medical documents,telemedicine,clinical records,personal health,historial médico,salud digital"}],["$","link","3",{"rel":"canonical","href":"https://medfiles.ai/fr/articles/hipaa-right-of-access"}],["$","link","4",{"rel":"alternate","hrefLang":"es","href":"https://medfiles.ai/es/articles/hipaa-right-of-access"}],["$","link","5",{"rel":"alternate","hrefLang":"en","href":"https://medfiles.ai/en/articles/hipaa-right-of-access"}],["$","link","6",{"rel":"alternate","hrefLang":"pt","href":"https://medfiles.ai/pt/articles/hipaa-right-of-access"}],["$","link","7",{"rel":"alternate","hrefLang":"fr","href":"https://medfiles.ai/fr/articles/hipaa-right-of-access"}],["$","link","8",{"rel":"alternate","hrefLang":"ca","href":"https://medfiles.ai/ca/articles/hipaa-right-of-access"}],["$","link","9",{"rel":"alternate","hrefLang":"x-default","href":"https://medfiles.ai/en/articles/hipaa-right-of-access"}],["$","meta","10",{"property":"og:title","content":"Get Records in 30 Days: U.S. HIPAA Right of Access, 2026 Update"}],["$","meta","11",{"property":"og:description","content":"U.S. patients: Use your HIPAA right to get medical and billing records in 30 days, dispute unfair fees, and learn what the 2026 reproductive privacy..."}],["$","meta","12",{"property":"og:site_name","content":"MedFiles.ai"}],["$","meta","13",{"property":"og:image","content":"https://media.babylovegrowth.ai/blog-images/organization-26020/1790827636871_Patient-requesting-access-to-medical-records.jpeg"}],["$","meta","14",{"property":"og:image:alt","content":"Get Records in 30 Days: U.S. HIPAA Right of Access, 2026 Update"}],["$","meta","15",{"property":"og:type","content":"article"}],["$","meta","16",{"property":"article:published_time","content":"2026-10-01T04:08:58.161Z"}],["$","meta","17",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","18",{"name":"twitter:title","content":"Get Records in 30 Days: U.S. HIPAA Right of Access, 2026 Update"}],["$","meta","19",{"name":"twitter:description","content":"U.S. patients: Use your HIPAA right to get medical and billing records in 30 days, dispute unfair fees, and learn what the 2026 reproductive privacy..."}],["$","meta","20",{"name":"twitter:image","content":"https://media.babylovegrowth.ai/blog-images/organization-26020/1790827636871_Patient-requesting-access-to-medical-records.jpeg"}],["$","link","21",{"rel":"shortcut icon","href":"/favicon.ico"}],["$","link","22",{"rel":"icon","href":"/favicon.ico","sizes":"48x48"}],["$","link","23",{"rel":"icon","href":"/favicon.png","type":"image/png","sizes":"any"}],["$","link","24",{"rel":"icon","href":"/favicon.png","type":"image/png","sizes":"32x32"}],["$","link","25",{"rel":"icon","href":"/favicon.png","type":"image/png","sizes":"16x16"}],["$","link","26",{"rel":"apple-touch-icon","href":"/apple-touch-icon.png","sizes":"180x180","type":"image/png"}],["$","$L24","27",{}]]