The HIPAA Right of Access is both the Privacy Rule’s most patient-facing provision and OCR’s most-settled enforcement category. Fifty-six Right of Access settlements have been announced since the Initiative launched in 2019. Every one of them was preventable with a process that fits on one page.
What the Right of Access covers
Under §164.524, individuals have the right to inspect and obtain a copy of their own PHI in the designated record set — the records a covered entity uses to make decisions about them. That generally includes medical and billing records, enrolment and payment records for health plans, and case management files.
The right extends to the form and format the individual requests, including electronic copies and portable media, so long as the record is readily producible that way. It extends to a designated third party — most commonly another provider or a family member — when the individual asks in writing.
A few scope specifics worth remembering:
- Psychotherapy notes (specific to §164.501) are exempt; most other mental-health records are not.
- Information compiled for use in civil, criminal, or administrative proceedings is exempt.
- “Designated record set” is defined at §164.501. If a record is used to make decisions about the individual, it is in scope — not just the EHR.
For plain-language context on the Privacy Rule as a whole, see our HIPAA Privacy Rule guide.
Deadlines and fees
The 30-day clock. Covered entities must act on the request within thirty calendar days of receipt. A single 30-day extension is allowed, provided the individual is told in writing within the first thirty days why and when they will have the records. “Act on” means produce the records, or deny with a written explanation per §164.524(d).
The fee rules. You may charge a reasonable, cost-based fee limited to:
- Labour for copying the record (paper or electronic).
- Supplies for creating the paper copy or electronic media (if applicable).
- Postage, if the individual asks the records to be mailed.
- Preparation of a summary or explanation if the individual agrees in writing.
OCR’s 2016 guidance was explicit: for an electronic copy of an electronic record, you may charge labour and supply costs, but not for retrieval, search, or legal review. A per-page fee bearing no relation to actual labour cost is a settled finding. Several state laws cap fees further; the lower cap applies.
Verification before, delivery after. Covered entities must verify the identity and authority of the person requesting records. Verification does not toll the clock — the thirty days still start at receipt.
The 2026 cases
Two Right of Access settlements shaped the 2026 docket.
8 October 2026 (announced) — Shen Smiles PC, $140,000. OCR’s fifty-sixth Right of Access enforcement action. A dental practice; a patient complaint about failure to provide a copy of records. Resolution: a settlement payment and a corrective action plan.
27 August 2026 — Azul Vision (Right of Access). Another small-provider Right of Access action, resolved with a settlement and a corrective action plan. Specific dollar figure on the HHS resolution agreements page.
Both are typical of the 56. The organisations are rarely large health systems — those tend to appear in Risk Analysis Initiative or ransomware cases. The Right of Access cases are overwhelmingly small practices, small specialty clinics, and single-provider offices where a single ignored or late request becomes the finding.
Why small practices keep getting caught
Three operational patterns explain nearly every Right of Access settlement.
No defined owner. A request arrives by email, voicemail, or front-desk conversation. Nobody owns it; the clock starts and nobody is watching. In large organisations the owner is a Privacy Officer or HIM team; in small practices the role is implicit, which means absent.
Fees that bear no relation to cost. Flat per-page fees that are the same for a one-page record and a one-hundred-page record; electronic-copy fees that charge “search time”; refusal to provide records until a prepayment clears. All three are findings.
Delays treated as denials. The clock does not stop because the patient is slow to clarify, because the fax number did not work, or because the records are in offsite storage. A delay without a written extension inside the first thirty days is a violation.
A request-handling process that fits on one page
The small-practice process that avoids a Right of Access settlement has the same four pieces every time.
1. Intake. Every channel (phone, email, mail, patient portal, walk-in) routes requests to one owner, with a date-received timestamp. Nothing goes to a provider’s personal inbox.
2. Verification. Identity and authority verified against documented steps. If a third party is designated, the authorisation is in writing per §164.524(c)(3). Verification does not stop the clock.
3. Fulfilment. The record is prepared in the format requested, with a cost-based fee quoted against OCR’s 2016 guidance. If an extension is needed, the written notice goes out before day 30.
4. Dated audit trail. Receipt, verification, fulfilment, delivery, fee charged — all dated, all retained. The audit trail is the artefact that answers an OCR letter.
See Patient Rights for the platform workflow that models all four, including the 30-day clock and fee calculator.
What to do this week if the pattern looks familiar
Pick three:
- Name one owner for incoming records requests. Document the role in writing.
- Pull the last twelve months of records requests and date-match receipt to fulfilment. Any gap longer than thirty days with no written extension is a known risk.
- Compare your current fee schedule against the OCR 2016 guidance. If the per-page fee is $1.00 flat regardless of record size, it is probably wrong.
- Add Right of Access to the next workforce training cycle. The front-desk person who receives the request matters more than the Privacy Officer who did not.
Our HIPAA glossary covers the designated record set definition in more detail, and our Privacy Rule guide walks the broader patient-rights surface.
The bottom line
The Right of Access Initiative keeps producing settlements because the operational failure mode is small and common: an owner-less request, a clock no one was watching. The fix is also small: route every request to a named owner, measure receipt-to-fulfilment, charge cost-based fees, and keep the dated audit trail. Four hours of process design is cheaper than any of the 56 settlements that preceded this post.
If you want to know whether your Right of Access workflow would hold up, the free HIPAA readiness assessment includes it in the scoring.