October 27, 2025
Imagine a scenario that’s played out at your practice a million times: a patient calls and asks for a copy of their medical records. Simple, right?
Believe it or not, what seems like a routine request can quickly become a compliance risk if your employees misunderstand timelines, allowable fees, or who’s allowed to access certain information.
With over 50 penalties and millions of dollars in fees issued by the Office for Civil Rights due to Right of Access violations, your practice has a responsibility to understand its role when handling patient requests. By acknowledging your practice’s duties and properly training your staff, you can empower your team to deliver documents in a timely manner that still protects sensitive data.
Right of Access 101
Right of Access, established in the HIPAA Privacy Rule, gives patients the right to receive their records within 30 days of the initial request. Depending on the state, the number of days your practice has to fulfill requests may even be less. For example, California legislation requires that patient requests be upheld within 15 days.
This timeline is strict and can only be extended once for an additional 30 days. So, once you receive a request, it’s go time.
Before the staff gathers anything, the first question is, how should these records be sent out?
Even if the request comes through a secure portal, your staff must encrypt any Protected Health Information (PHI) sent electronically. Certified mail is recommended for safe and trackable delivery if the patient requests a physical copy.
Now, what can you charge to deliver these records? Patients have a right to their health records, and any associated costs must be minimal to remain HIPAA compliant. According to the OCR, a flat fee of $6.50 for all requests for copies of PHI maintained electronically.
Additionally, ensure that thorough documentation, like a current HIPAA consent form, is in place if the requester is not the patient themselves.
Keeping Your Practice Compliant
So, think back to the scenario we mentioned earlier. Only now, you don’t have to stress! Your team is trained and aware of their responsibility to fulfill patients’ requests. Your patients get what they want, and even better, your practice avoids thousands of dollars in fines and reputational damage.
Quickly and compliantly addressing patient requests promotes patient satisfaction and can help your practice avoid thousands of dollars in fines and reputational damage.
The proper software solution centralizes all documentation, policies, forms, and training related to Right of Access. This cloud-based hub provides easy access for everyone in your practice, giving staff the tools they need to be successful.
To learn more about Right of Access in your practice, meet with a compliance expert today.
