3.2 Individual Right of Access: Timelines, Digital Formats, and Fee Limitations

Individual Right of Access: Timelines, Digital Formats, and Fee Limitations

AHIMA CHPS Blueprint Focus: The Individual Right of Access under 45 CFR § 164.524 is one of the most aggressively enforced provisions in healthcare privacy law. The HHS Office for Civil Rights (OCR) HIPAA Right of Access Initiative has levied dozens of financial settlements and corrective action plans against organizations failing to meet statutory deadlines, demanding excessive fees, or creating impermissible barriers. Candidates must master access timelines, digital format mandates, allowable cost-based fee calculations, third-party directives, and denial protocols.

---

1. Scope of Access and the Designated Record Set

Under 45 CFR § 164.524(a)(1), an individual has a fundamental legal right to inspect and obtain a copy of protected health information (PHI) about the individual in a Designated Record Set (DRS) for as long as the information is maintained in the record set.

Defining the Designated Record Set (45 CFR § 164.501)

A Designated Record Set encompasses:

1. The medical and clinical records maintained by or for a covered healthcare provider.
2. The billing and insurance payment records maintained by or for a covered healthcare provider.
3. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan.
4. Any records used, in whole or in part, by or for the covered entity to make clinical, financial, or administrative decisions about individuals.

Explicit Statutory Carve-Outs

Two specific classes of health data are entirely excluded from the right of access under § 164.524(a)(1):

• Psychotherapy Notes: Notes recorded by a mental health professional documenting private counseling sessions, maintained separately from the rest of the individual's medical record (45 CFR § 164.501).
• Legal Anticipation Records: Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding (attorney-client privilege and attorney work-product).

---

2. Timelines and Extension Requirements

The statutory timeline for fulfilling an access request is rigid and strictly monitored by federal regulators.

Day 0                          Day 30                                         Day 60
  |------------------------------|----------------------------------------------|
  [Request Received]       [Statutory Deadline]                           [Hard Cap Extension]
         |                               \
         |-- Fulfill Request Fully        \-- UNABLE TO FULFILL ON TIME?
         |                                     |
         +-- Deliver Copies / Portal Access    +-- Send Written Notice BEFORE Day 30
                                               +-- State Specific Reason for Delay
                                               +-- Provide Firm Date of Delivery (≤ Day 60)
                                               +-- NO SECOND EXTENSION PERMITTED

The 30-Calendar-Day Clock

Under 45 CFR § 164.524(b)(2)(i), the covered entity must act on an access request within 30 calendar days after receipt of the request. Acting on the request means:

1. Informing the individual of acceptance and providing the requested access, or
2. Providing a formal written denial explaining the legal basis and review rights.

[!IMPORTANT] Calendar Days, Not Business Days: The 30-day clock is counted in calendar days, not business days. The clock starts on the date the covered entity receives the request—even if received by the wrong internal department (e.g., frontline clinic rather than HIM). Furthermore, the clock does not pause while an entity waits for fee payment, unless the entity has an established, published policy requiring fee pre-payment prior to record reproduction.

The Single 30-Calendar-Day Extension

Under 45 CFR § 164.524(b)(2)(ii), if the covered entity is unable to take action within the initial 30 calendar days, it may obtain a single extension of up to 30 calendar days, provided that:

1. The entity provides the individual, prior to the expiration of the original 30 days, with a formal written statement.
2. The written statement articulates the specific, legitimate reasons for the delay (e.g., records archived offsite in physical storage or in legacy EHR systems requiring technical extraction).
3. The statement provides the exact date by which the covered entity will complete its action.
4. Zero Subsequent Extensions: The covered entity is permitted only one extension per request. By calendar day 60, the request must be fully resolved. Any further delay constitutes a per se violation of the Privacy Rule.

---

3. Form, Format, and Modern Digital Access Standards

Under 45 CFR § 164.524(c)(2), the covered entity must provide the individual with access to the PHI in the form and format requested by the individual, if the data is readily producible in that form or format.

Electronic Health Records (ePHI)

Under the HITECH Act amendments (45 CFR § 164.524(c)(2)(ii)), if the covered entity maintains the requested PHI electronically in one or more Designated Record Sets, the entity must provide the individual with an electronic copy in the electronic form and format requested by the individual, if readily producible.

• Readily Producible Formats: Common, readily producible electronic formats include machine-readable PDFs, secure patient portal exports, or standardized digital exports. If the individual requests an encrypted USB flash drive or CD and the entity has the technical capability to write to media, it must accommodate the request.
• Unencrypted Email Delivery: If an individual requests that their records be transmitted via unencrypted email, the covered entity must comply, provided it first informs the individual of the security risks (e.g., interception, unauthorized access in transit) and the individual confirms their preference in writing.
• Alternative Mutual Agreement: If the PHI is not readily producible in the requested format, the entity must produce a readable hard copy or another mutually agreed-upon format.

Prohibition on Unreasonable Administrative Barriers

OCR guidance explicitly states that covered entities may not erect unreasonable administrative hurdles that delay access:

• Entities cannot require individuals to physically travel to the facility or submit requests in person.
• Entities cannot require individuals to use traditional postal mail if electronic submission is feasible.
• Entities cannot force an individual to create an account on a proprietary web portal if the individual requests direct email or physical media delivery.

Third-Party Directives (Patient-Directed Transmissions)

Under 45 CFR § 164.524(c)(3)(ii), if an individual requests that a copy of their PHI be transmitted directly to a designated third party (such as a family member, researcher, or mobile health application), the covered entity must comply, provided the request is:

1. In writing,
2. Signed by the individual, and
3. Clearly identifies the designated person and where to send the copy.

Note on Legal Precedent (Ciox Health v. Azar): In 2020, a federal district court held that the statutory fee limitation under HIPAA applies only to records requested by the individual for themselves, or electronic records directed to third parties under the HITECH statutory text, invalidating HHS's attempt to apply the fee caps across all third-party directives involving non-electronic formats.

---

4. Allowable Cost-Based Fees vs. Prohibited Charges

One of the primary enforcement focal points of the OCR HIPAA Right of Access Initiative is the imposition of unlawful fees. Covered entities are strictly limited under 45 CFR § 164.524(c)(4) in what they may charge individuals.

Fee Calculation Methodologies

HHS OCR guidance permits covered entities to calculate fees using one of three approved methodologies:

1. Actual Labor and Supply Cost: Calculating the actual direct labor costs (clerical time to photocopy paper or load ePHI onto media) plus actual supply costs.
2. Average Cost Schedule: Developing a standardized schedule of costs based on average labor and supply expenses for standard requests.
3. Flat Fee for Electronic Records: Charging a flat fee not to exceed $6.50 for electronic copies of records maintained electronically. (Note: $6.50 is not a universal cap; entities may charge more if actual cost calculations demonstrably justify it, but charging $6.50 requires no detailed mathematical justification).

---

5. Denials of Access: Unreviewable vs. Reviewable

When a covered entity refuses an access request, the denial is governed by strict procedural safeguards under 45 CFR § 164.524(a)(2)-(4).

Unreviewable Grounds for Denial (45 CFR § 164.524(a)(2))

Under these statutory categories, the covered entity may deny access, and the individual has no legal right to an independent review:

1. Psychotherapy Notes: The request seeks psychotherapy notes maintained separately from the clinical chart.
2. Legal Proceeding Work Product: The information was compiled in reasonable anticipation of a civil, criminal, or administrative action.
3. Correctional Inmate Health/Safety: An inmate requests access, and the correctional institution determines that granting access would jeopardize the health, safety, security, or custody of the inmate, other inmates, or correctional staff.
4. Research Protocol Hold: The individual consented to a clinical trial where access was temporarily suspended during the trial, provided the individual was informed in advance that access would be reinstated upon study completion.
5. CLIA and Privacy Act Preemption: Records subject to the Clinical Laboratory Improvement Amendments of 1988 (CLIA) or the federal Privacy Act of 1974 where access is restricted by statute.
6. Confidential Third-Party Source: The PHI was obtained from someone other than a healthcare provider under a promise of confidentiality, and access would reasonably likely reveal the source.

Reviewable Grounds for Denial (45 CFR § 164.524(a)(3))

Under these categories, the individual has an absolute statutory right to have the denial reviewed by an independent licensed healthcare professional:

1. Danger to Life or Physical Safety: A licensed healthcare professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to endanger the life or physical safety of the individual or another person.

   [!WARNING] Emotional Distress Is Not Grounds for Denial: Emotional upset, embarrassment, anxiety, or psychological distress alone does not legally justify denial. The statutory threshold explicitly requires danger to life or physical safety.

2. Substantial Harm Regarding Third Parties: The PHI makes reference to another person (who is not a healthcare provider) and a licensed healthcare professional determines that access is reasonably likely to cause substantial physical, emotional, or psychological harm to that other person.
3. Personal Representative Endangerment: The request is made by a patient's personal representative (e.g., parent, healthcare proxy), and a licensed healthcare professional determines that providing access to the personal representative is reasonably likely to cause substantial harm to the individual or another person.

Procedural Review Requirements (45 CFR § 164.524(d))

If a reviewable denial is issued:

• The entity must deliver a written denial within 30 days written in plain language, explaining the basis, the right to review, and instructions on how to file a complaint with the entity and HHS OCR.
• If the individual requests a review, the entity must designate a licensed healthcare professional who did not participate in the original decision to deny access to act as the reviewing official.
• The reviewing official must determine within a reasonable time whether to uphold or reverse the denial, and their clinical decision is strictly binding on the covered entity.

---

Exam Tips and Candidate Traps

[!TIP] The $6.50 Fee Myth: Candidates often mistakenly assume that $6.50 is the maximum legal fee that can ever be charged for medical records. Under OCR guidance, $6.50 is simply a safe-harbor flat rate that an entity can charge for electronic records without showing detailed receipts. An entity may charge more if it calculates actual allowable labor and supply costs, but it can never charge retrieval or search fees.

[!IMPORTANT] Psychotherapy Notes vs. Mental Health Records: Psychotherapy notes (session notes kept separate by a therapist) can be denied without any review right. However, general psychiatric records, medication logs, discharge summaries, and psychiatric evaluations in the main Designated Record Set cannot be denied under the psychotherapy notes exception; they can only be withheld if a licensed clinician determines access poses a danger to life or physical safety (a reviewable denial).