30 days. Under the HIPAA Privacy Rule, 45 CFR 164.524, a covered entity must act on a request for access "no later than 30 days after receipt of the request." If it can't, it may extend the time "by no more than 30 days," with "a written statement of the reasons for the delay and the date by which the covered entity will complete its action," and "The covered entity may have only one such extension of time for action on a request for access."
some states set shorter deadlines or fee limits; check your state.
The right itself
Here's what the patient is asking for:
45 CFR 164.524(a)(1): an individual has a right of access "to inspect and obtain a copy of protected health information about the individual in a designated record set"
That right comes with exceptions written into the rule, such as psychotherapy notes, so check the regulation's exceptions before you treat any part of a record as in or out.
The 30-day clock
45 CFR 164.524(b)(2)(i): the covered entity must act on a request for access "no later than 30 days after receipt of the request"
The clock runs from receipt of the request. Within that time, the regulation says one of two things happens:
| decision | what the regulation says to do |
|---|---|
| Request granted (in whole or in part) | "provide the access requested" |
| Request denied (in whole or in part) | "provide the individual with a written denial" |
One extension, up to 30 more days
If the first 30 days won't be enough, the regulation allows an extension, with conditions:
- How long: "by no more than 30 days."
- What you send: "a written statement of the reasons for the delay and the date by which the covered entity will complete its action." Per (b)(2)(ii)(A), that statement goes out within the original time limit.
- How many: "The covered entity may have only one such extension of time for action on a request for access."
Fees: what the regulation allows
If you charge, the regulation limits what the fee can include:
45 CFR 164.524(c)(4): "a reasonable, cost-based fee, provided that the fee includes only the cost of"
In summary, the items it lists are:
- labor for copying
- supplies for creating the paper copy or electronic media (if the individual asks for the electronic copy on portable media)
- postage, when the individual has asked for the copy (or a summary or explanation) to be mailed
- preparing an explanation or summary, if the individual agreed to one
some states set shorter deadlines or fee limits; check your state.
A front-desk habit
This is a practical suggestion, not regulatory text: log the date each request comes in, and track it like any other queue. The 30 days run from receipt, so the received date is the one to capture.
This is the federal HIPAA rule. When in doubt, check the source and your compliance lead. Not legal advice.
FAQ
How many days do you have to respond to a HIPAA request for access?
45 CFR 164.524: act on a request for access "no later than 30 days after receipt of the request."
Can the 30-day deadline be extended?
Once. The regulation allows an extension "by no more than 30 days," with "a written statement of the reasons for the delay and the date by which the covered entity will complete its action." "The covered entity may have only one such extension of time for action on a request for access."
What do you have to do if you deny a records request?
45 CFR 164.524: if the request is denied, in whole or in part, "provide the individual with a written denial."
What can a practice charge for copies of records?
45 CFR 164.524(c)(4): "a reasonable, cost-based fee, provided that the fee includes only the cost of" labor for copying, supplies, postage when mailed, and preparing an explanation or summary if the individual agreed to one. some states set shorter deadlines or fee limits; check your state.
Related resources
Know what's moving, what's stuck, what happens next. Start with one queue.
This page is run by RxRev.
Source: 45 CFR 164.524, Access of individuals to protected health information (current eCFR). Text checked October 7, 2026.