HIPAA Medical Records Access Request

Instructions for Use

Under HIPAA's Privacy Rule (45 CFR 164.524), individuals have the right to access, inspect, and obtain copies of their protected health information (PHI) maintained in a designated record set. This template facilitates exercising that federally guaranteed right.

Key Points:
- Covered entities must respond within 30 calendar days (may extend by 30 days with written notice)
- Fees are limited to reasonable, cost-based amounts for copying, supplies, and postage only
- Labor costs for search and retrieval generally cannot be charged
- You may request records in your preferred format (electronic or paper)

Patient Information

Healthcare Provider/Entity Information

Request for Access to Medical Records

Date of Request: ______________________________________________

Dear Health Information Management Department:

Pursuant to my rights under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, specifically 45 CFR 164.524, I hereby request access to my protected health information as described below.

Section 1: Records Requested

Scope of Request

☐ Complete Medical Record - All records in the designated record set

☐ Specific Records Only (Check all that apply):

☐ Office/clinic visit notes
☐ Hospital admission/discharge summaries
☐ Emergency room records
☐ Surgical/operative reports
☐ Anesthesia records
☐ Laboratory test results
☐ Pathology reports
☐ Radiology/imaging reports
☐ Radiology/imaging films/digital images
☐ Medication/prescription records
☐ Nursing notes
☐ Progress notes
☐ Consultation reports
☐ Physical therapy/rehabilitation records
☐ Mental health/psychiatric records
☐ Substance abuse treatment records
☐ Immunization records
☐ Allergy information
☐ Problem list
☐ Billing records and itemized statements
☐ Insurance claims/Explanation of Benefits
☐ Prior authorization records
☐ Referral records
☐ Correspondence
☐ Other (specify): __________________________________________

Date Range of Records Requested

☐ All records on file
☐ Records from specific date range:

From: ______________________ To: ______________________

Treatment Episodes/Conditions (if specific records sought)

_______________________________________________________________________________

_______________________________________________________________________________

Section 2: Format Requested

Under 45 CFR 164.524(c)(2), I have the right to receive my records in the form and format I request if readily producible.

Preferred Format:

☐ Electronic format (specify):
☐ CD/DVD
☐ USB flash drive (I will provide)
☐ Secure email to: __________________________________________
☐ Patient portal access
☐ PDF format
☐ Other electronic format: __________________________________________

☐ Paper copies (mailed to address above)

☐ Inspect in person (no copies needed at this time)

For imaging studies (X-rays, MRIs, CT scans):

☐ Digital format (DICOM preferred)
☐ Physical films/hard copies
☐ Access through imaging viewer

Section 3: Delivery Instructions

☐ Pick up in person - I will present valid photo identification

☐ Mail to address listed above

☐ Mail to alternate address:

_______________________________________________________________________________

☐ Secure electronic transmission to:

_______________________________________________________________________________

☐ Direct to third party (complete Section 4 below)

Section 4: Third-Party Recipient (If Applicable)

If you want records sent directly to another person or entity:

Purpose of Disclosure (optional):

☐ Continuity of care/treatment
☐ Personal records
☐ Legal matter
☐ Insurance purposes
☐ Disability determination
☐ Other: __________________________________________

Section 5: Fee Acknowledgment

I understand that under 45 CFR 164.524(c)(4), you may charge a reasonable, cost-based fee limited to:

• Cost of copying (including supplies and labor for copying)
• Postage, if records are mailed
• Cost of preparing an explanation or summary (if I request and agree to it)

You may NOT charge for:
- Search and retrieval time
- Costs not permitted under HIPAA, even if authorized by state law
- Per-page fees exceeding actual cost

☐ Please provide a fee estimate before processing this request

☐ I authorize fees up to: $ ______________

☐ Contact me if fees will exceed: $ ______________

Section 6: Response Timeline Requirements

Per 45 CFR 164.524(b)(2), you must act on this request no later than 30 calendar days after receipt. "Acting" means either:

1. Providing the requested access; or
2. Providing written denial with reasons and appeal information

If you cannot comply within 30 days, you must:
- Provide written notice of reasons for delay
- Provide the date by which you will complete action
- Extension cannot exceed an additional 30 calendar days

Date Request Received by Provider: ______________________________________________

30-Day Deadline: ______________________________________________

Maximum Extended Deadline (if applicable): ______________________________________________

Section 7: Patient Certification and Signature

I certify that:
- I am the patient named above, or I am legally authorized to act on the patient's behalf
- The information I have provided is accurate
- I understand I may be charged reasonable, cost-based fees
- I understand this authorization does not expire unless I revoke it in writing

If signing as authorized representative:

Proof of authority attached: ☐ Yes

Signature

Patient/Authorized Representative Signature: ______________________________________________

Printed Name: ______________________________________________

Date: ______________________________________________

Important Information About Your Rights

What is a Designated Record Set?

Under HIPAA, you have access to records in the "designated record set," which includes:
- Medical records and billing records
- Enrollment, payment, claims, and case management records
- Any records used to make decisions about you

Exceptions to Access Rights

You do NOT have a right to access:
- Psychotherapy notes (maintained separately from medical record)
- Information compiled for legal proceedings
- Laboratory results subject to CLIA when direct access is prohibited
- Records from correctional institutions where access would jeopardize safety
- Research records while research is in progress (if you agreed to suspension)

If Your Request is Denied

The provider must:
- Provide written denial stating the basis
- Explain your right to have the denial reviewed
- Describe how to request a review
- Explain your right to file a complaint with HHS OCR

For "reviewable" denials (licensed professional determined access would endanger you or others):
- You may request review by another licensed professional not involved in original denial
- Provider must designate a reviewing official
- Review must be completed promptly
- Provider must comply with reviewing official's determination

Filing a Complaint

If your rights are violated, you may file a complaint with:
- HHS Office for Civil Rights: https://www.hhs.gov/hipaa/filing-a-complaint/
- Complaint must be filed within 180 days of violation

Provider Acknowledgment (For Office Use)

Resources

• HHS Guidance on Access Rights: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/
• 45 CFR 164.524 (Full Text): https://www.ecfr.gov/current/title-45/section-164.524
• OCR Complaint Portal: https://ocrportal.hhs.gov/

This template is provided for informational purposes only and does not constitute legal advice. Consult with a healthcare attorney for specific legal guidance.