The HIPAA right of access is an individual's right under 45 CFR 164.524 to inspect and obtain a copy of protected health information about the individual in a designated record set, subject to the limits in the paragraphs below. A release of information program is the set of procedures a covered entity uses to act on those requests in time. Integral Healthcare Solutions (IHS) drafts that program for covered entities whose requests arrive by several routes with no log.
IHS does not take possession of protected health information. IHS is a consulting firm, not a law firm, and this page is not legal advice.
Last updated: November 2026
What does 45 CFR 164.524 require?
We read the eCFR text as of October 29, 2026; page opened November 2, 2026: https://www.ecfr.gov/current/title-45/section-164.524.
| Paragraph | What it asks, in IHS's words | What answers it |
|---|---|---|
| 164.524(a)(1) | An individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as it is maintained there, except for psychotherapy notes and information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding, and subject to paragraphs (a)(2) and (a)(3). | Designated record set list |
| 164.524(b)(1) | The covered entity may require requests in writing, provided that it informs individuals of the requirement. | Request form and notice |
| 164.524(b)(2)(i) | Except as provided in paragraph (b)(2)(ii), act on the request no later than 30 days after receipt: if it grants the request in whole or in part, inform the individual of the acceptance and provide the access requested under paragraph (c); if it denies in whole or in part, provide a written denial under paragraph (d). | 30-day tracker |
| 164.524(b)(2)(ii) | If the covered entity is unable to act in time, one extension of no more than 30 days is available, only if the written-statement condition in paragraph (b)(2)(ii)(A) is met within the original time limit (FAQ below). | Extension notice template |
| 164.524(c)(1) to (c)(2)(iii) | Need only produce the same information once if held in more than one designated record set or location; give access in the form and format requested if readily producible, with fallbacks if not, including, when the individual asks for an electronic copy of information kept electronically in a designated record set, the electronic form and format requested if readily producible, or a readable electronic form agreed with the individual; provide a summary or explanation only on the individual's advance agreement to it and to any fees (paragraph (c)(2)(iii)). | Format check and summary consent steps |
| 164.524(c)(3)(ii) | A directive to send the copy to a person the individual designates; conditions in the FAQ below. | Third-party request checklist |
| 164.524(c)(4) | A reasonable, cost-based fee that includes only four listed cost items. The FAQ below lists them. | Fee-limit worksheet |
| 164.524(a)(2) and (a)(3) | Two lists of denial grounds: one without an opportunity for review, one that carries a right of review. The FAQ below describes both. | Denial grounds checklist |
| 164.524(a)(4) and (d)(4) | If access is denied on a ground permitted under paragraph (a)(3), the individual has the right to have the denial reviewed by a licensed health care professional designated by the covered entity as reviewing official who did not participate in the original decision (paragraph (d)(4): not directly involved in the denial); the covered entity must promptly refer the request, the official decides within a reasonable period of time, and the covered entity promptly gives written notice and acts on the determination. | Review procedure |
| 164.524(d)(1) to (3) | To the extent possible, give access to other requested information that is not subject to denial; give a written denial with the contents in the FAQ below; and if it does not maintain the information but knows where it is, tell the individual where to direct the request. | Denial letter template |
| 164.524(e) | Document the designated record sets subject to access and the titles of the persons or offices responsible for receiving and processing requests, and retain the documentation as 164.530(j) requires: paragraph (j)(2) of that section sets six years from creation or the date the documentation last was in effect, whichever is later. | Documentation file and request log |
The designated record set is defined in 45 CFR 164.501 (https://www.ecfr.gov/current/title-45/section-164.501, page opened November 2, 2026): a group of records maintained by or for a covered entity that is the medical records and billing records about individuals maintained by or for a covered health care provider; the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or used, in whole or in part, by or for the covered entity to make decisions about individuals.
Who needs a release of information program and what triggers it?
Whether you are a covered entity is for your counsel. In IHS's reading, these usually start a build:
- Requests arrive by several routes, so nobody can show when each was received; the 30-day period runs from receipt.
- The record sets and responsible offices that paragraph (e) says to document are not written down.
How IHS helps
IHS runs four steps: a gap assessment against each paragraph above; drafting of missing procedures; a mock review of your request log, with patient identifiers removed; and readiness support.
IHS drafts the intake procedure and form, 30-day tracker with extension notice template, third-party request checklist, fee-limit worksheet, denial letter and review procedure, request log, and record set and responsible-office documentation, with your privacy official.
You supply your designated record set definition, who processes requests, a licensed professional for reviewable denials, and counsel.
IHS drafts procedures and does not decide denials, set fees, release records, or communicate with OCR or patients for you.
IHS is led by Thomas G. Goddard, JD, PhD, former Chief Operating Officer and General Counsel of URAC; this program is in its compliance services line.
What to have ready
- Designated record sets patients can access, and titles of the offices that process requests (paragraph (e)).
- Whether you require written requests, and how you inform individuals (paragraph (b)(1)).
- How requests arrive and who records receipt dates (paragraph (b)(2)(i)).
- Extension notices sent and how you track the one extension (paragraph (b)(2)(ii)).
- Electronic forms and formats your systems can produce (paragraph (c)(2)(ii)).
- Your fee practice and its cost items (paragraph (c)(4)).
- Requests to send a copy to another person, with signed writings (paragraph (c)(3)(ii)).
- Recent written denials (paragraph (d)(2)).
- The licensed professional you would designate as reviewing official (paragraphs (a)(4) and (d)(4)).
The introductory call is free; IHS learns what you have there.
How does this differ from the information blocking rules?
This page covers an individual's right to a copy under one Privacy Rule section, 45 CFR 164.524. The information blocking rules are a separate regulation with their own page: information blocking compliance program. The complaint process that 164.524(d)(2)(iii) points to is on the HIPAA Privacy Rule compliance program page.
What does a HIPAA right of access program cost?
The regulation text we opened attaches no government fee to the program and states no dollar figure for copies. IHS does not publish a price for this work and scopes each engagement after a free introductory call.
In IHS's reading, scope moves with the number of request routes, records systems and vendors, and whether a request log exists.
What this is not
- It is not legal advice. IHS is a consulting firm, not a law firm. This page reads the federal text only; whether state law or later guidance changes a paragraph above is for your counsel.
- It is not a decision on any denial or on what to charge for a record. Those are yours.
- It is not a guarantee about any regulator's view. IHS does not communicate with OCR or patients for you.
Frequently asked questions
What is the HIPAA right of access?
It is an individual's right under 45 CFR 164.524(a)(1) to inspect and obtain a copy of protected health information about the individual in a designated record set, subject to the exceptions and limits in paragraphs (a)(1) to (a)(3).
How long do we have to respond to an access request?
Except as provided in paragraph (b)(2)(ii), a covered entity must act on a request for access no later than 30 days after receipt, by granting it, in whole or in part, and providing the access, or by providing a written denial, in whole or in part.
Can we extend the 30 days?
One extension, of no more than 30 days. Under paragraph (b)(2)(ii), if the covered entity is unable to act within the 30 days, it may extend the time only if, within the original time limit, it gives the individual a written statement of the reasons for the delay and the date by which it will complete its action. It may have only one such extension for a request for access.
What can we charge for a copy?
If the individual requests a copy or agrees to a summary or explanation, paragraph (c)(4) allows a reasonable, cost-based fee that includes only the cost of: labor for copying the protected health information requested, whether in paper or electronic form; supplies for the paper copy, or for electronic media if the individual requests the electronic copy on portable media; postage when the individual has requested mailing; and preparing an explanation or summary the individual agreed to.
When can we deny access?
Paragraph (a)(2) lets a covered entity deny access without review for information excepted by paragraph (a)(1); an inmate's request for a copy, when the covered entity is a correctional institution or a provider acting under its direction and obtaining the copy would jeopardize the health, safety, security, custody or rehabilitation of the individual or other inmates, or the safety of any officer, employee or other person at the institution or transporting the inmate; temporary suspension for as long as research that includes treatment is in progress, where the individual agreed when consenting to participate and was told access will be reinstated on completion of the research; Privacy Act records, where that law's requirements are met; and information obtained under a promise of confidentiality from someone other than a health care provider, where access would be reasonably likely to reveal the source. Paragraph (a)(3) lists three grounds that carry a right of review, each resting on a licensed health care professional's determination in the exercise of professional judgment: that access is reasonably likely to endanger the life or physical safety of the individual or another person; that information referring to another person (unless a health care provider) is reasonably likely to cause that person substantial harm if accessed; or, for a request by the individual's personal representative, that access is reasonably likely to cause substantial harm to the individual or another person. Applying a ground is for your licensed professional and counsel.
What must a denial letter contain?
Paragraph (d)(2) requires a timely, written denial in plain language that contains the basis for the denial; if applicable, a statement of the individual's review rights and how to exercise them; and a description of how to complain to the covered entity under 164.530(d) or to the Secretary under 160.306, including the name or title and telephone number of the contact person or office designated under 164.530(a)(1)(ii).
What if the patient asks us to send the records to someone else?
Under paragraph (c)(3)(ii), if the request directs the covered entity to transmit the copy directly to another person the individual designates, it must provide the copy to that person; the request must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy. Whether a court decision or later guidance affects that paragraph or (c)(4) is for your counsel.
Does IHS decide denials or release records for us?
No. IHS drafts the documents with your privacy official. Your staff release records, your licensed professional decides reviewable denials, and your counsel answers legal questions.