Patient’s Guide to HIPAA – Basic Rights: How Do I Make a Request for Access?




You are reading the Patient’s Guide to HIPAA, FAQ 22

HIPAA Guide Quick Links:



FAQ 22 : How Do I Make a Request for Access?

Start by reviewing the covered entity’s copy of the notice of privacy practices. Remember that every covered entity must provide a copy of its notice to anyone who asks for one. In addition, a copy should be available on the website of each covered entity (if the covered entity has a website).

The notice of privacy practices describes your right to inspect and to obtain a copy of your record. It should also tell you the local procedure for making a request. You will likely be asked to write a letter or fill out a form in order to make your request for access. A covered entity can insist on a written request and may ask you for identification. Asking for an ID is reasonable because you don’t want someone else to get your records without your consent. However, avoid letting a covered entity make a copy of your driver’s license. Someone with access to your health records may use that copy to make you a victim of identity theft.

When you make a request, the covered entity must act on your request within 30 days. Don’t count on an instant response. The entity can take an additional 30 days to respond if it provides you with a written explanation of the delay. If you need the records more urgently, say so. It might help, but the rule allows the covered entity to wait 30 days or more no matter what. Your doctor might be responsive to your need for fast access, but bigger institutions have procedures and may not be inclined to do anything but the minimum required of them.



Roadmap: Patient’s Guide to HIPAA: Part 2: Basic Patient Rights: Right to Inspect and Copy Your Record (FAQ 22 of 65)

Jump to list of FAQs 1-65 | See all of Part 2