Section: Health privacy · Last updated: October 27, 2026
This guide is based on the text of 45 CFR 164.524 (access of individuals to protected health information), the definitions in 45 CFR 164.501 and the complaint rules in 45 CFR 160.306, as published in the Electronic Code of Federal Regulations (eCFR) version of October 1, 2026. It is general information, not legal advice.
Under the HIPAA Privacy Rule, you have a right to see and get a copy of the health information that doctors, hospitals and health plans keep about you. The rule sets a deadline for the answer, limits what you can be charged, and says what a refusal must contain. This guide walks through each part using the wording of the regulation.
1. The rule at a glance
| Question | What 45 CFR 164.524 says |
|---|---|
| What you can ask for | To inspect, to get a copy, or both, of your information in a “designated record set” |
| How to ask | The provider or plan may require a written request, if it tells you so |
| Deadline to act | No later than 30 days after receiving the request |
| Extension | One extension of no more than 30 days, with a written reason and a completion date sent within the first 30 days |
| Format | The form and format you request, if readily producible; electronic records must be given electronically if you ask |
| Fee | A reasonable, cost-based fee limited to labor for copying, supplies, postage and an agreed summary |
| If refused | A written denial in plain language with the reason, review rights where they apply, and how to complain |
2. Which records are covered
The right applies to information in a designated record set. Section 164.501 defines this as the medical records and billing records a health care provider keeps about you; the enrollment, payment, claims and case or medical management records a health plan keeps; and any other records used, in whole or in part, to make decisions about you.
Two kinds of information are excluded from the right of access:
- Psychotherapy notes. These are a mental health professional’s notes on the contents of a counseling session that are kept separate from the rest of the medical record. The definition excludes prescriptions, session times, treatment types and frequency, test results, and summaries of diagnosis, symptoms, treatment plan, prognosis and progress. Those items stay in the regular record.
- Information compiled for a legal case. Material put together in reasonable anticipation of, or for use in, a civil, criminal or administrative proceeding.
If the same information sits in more than one record set or location, the provider only has to produce it once.
3. The 30-day clock
- Day 0. The provider or plan receives your request. Keep a copy or a dated record of when you sent it.
- By day 30. It must either grant the request and provide access, or send a written denial. If it grants part of the request, it must provide that part.
- If it needs more time. Within the same 30 days it must send you a written statement giving the reason for the delay and the date it will finish. The extension can be no more than 30 more days, and only one extension is allowed per request.
So the longest the regulation allows, with a proper written extension, is 60 days from receipt. A provider that sends nothing by day 30 has not used the extension the rule describes.
4. Format and delivery
- Your format first. The copy must be in the form and format you request if it is readily producible that way. If not, it must be a readable hard copy or another format you both agree on.
- Electronic records. If the records are kept electronically and you ask for an electronic copy, you must get an electronic copy, in the format you asked for if readily producible, or another readable electronic format you agree on.
- Summary instead of records. The provider may give a summary or explanation instead, but only if you agree to it in advance, and agree in advance to any fee for it.
- Mailing and inspection. The provider must arrange a convenient time and place to inspect or collect the copy, or mail it if you ask.
- Sending it to someone else. You can direct the provider to send the copy to another person. That request must be in writing, signed by you, and clearly name the person and where to send it.
5. What you can be charged
When you request a copy, or agree to a summary, the regulation allows a reasonable, cost-based fee that includes only the following:
| Allowed cost | Condition in the rule |
|---|---|
| Labor for copying | Paper or electronic copies |
| Supplies | Paper, or portable media if you asked for the electronic copy on portable media |
| Postage | Only when you asked for the copy or summary to be mailed |
| Preparing a summary or explanation | Only if you agreed to the summary in advance |
Costs that are not on the list, such as searching for records, are not among the items the fee may include. The regulation does not set a dollar amount; it limits which costs can be counted. Copies sent to a third party at your direction are outside the scope of this table, and the fee rules for that case are not covered in this guide.
6. When a request can be refused
| Type | Grounds listed in the rule |
|---|---|
| No review | Psychotherapy notes and legal-case material; certain inmate requests; research that includes treatment, while it is in progress, if you agreed when you enrolled; some records under the Privacy Act; information obtained from a non-provider under a promise of confidentiality that would reveal the source |
| With review | A licensed health care professional judges that access is reasonably likely to endanger someone’s life or physical safety, or to cause substantial harm to another person named in the record, or (for a personal representative’s request) to you or another person |
For the second group, you can ask for a review by a licensed health care professional chosen by the provider who did not take part in the original decision. The provider must follow that reviewer’s decision. Even when part of a request is refused, the provider must, to the extent possible, give you the rest.
A denial must be written in plain language and include the reason, your review rights if any, and how to complain to the provider or to the Secretary of Health and Human Services, with the name or title and phone number of the contact person or office. If the provider does not hold the records but knows who does, it must tell you where to send the request.
7. If the deadline passes
Under 45 CFR 160.306, anyone who believes a covered entity is not complying can file a complaint with the Secretary. The complaint must be in writing, on paper or electronically, name the provider or plan, and describe what happened. It must be filed within 180 days of when you knew or should have known about the problem, unless the Secretary waives the limit for good cause.
FAQ
Q. Can a doctor’s office hold my records until I pay an old bill?
The access section lists the grounds on which a request can be denied, and an unpaid balance is not one of them. The fee section covers only the cost of producing the copy.
Q. Do I have to say why I want my records?
The regulation lets the provider require a written request, but it does not list a reason as part of the request.
Q. Are my therapist’s session notes included?
Psychotherapy notes kept separate from the medical record are excluded. Diagnosis, prescriptions, session dates, test results and treatment summaries are not part of that exclusion.
Q. Does this apply to fitness and health apps?
The right of access applies to covered entities such as health care providers and health plans. Many consumer health apps are not covered entities; for those, the FTC’s Health Breach Notification Rule may apply to breaches instead.
Official sources
- 45 CFR 164.524 — Access of individuals to protected health information (eCFR, October 1, 2026)
- 45 CFR 164.501 — Definitions: designated record set, psychotherapy notes (eCFR, October 1, 2026)
- 45 CFR 160.306 — Complaints to the Secretary (eCFR, October 1, 2026)
This article is general information based on the federal regulation text. State laws may give additional rights, and individual circumstances differ. For a specific dispute, contact the provider’s privacy office or the U.S. Department of Health and Human Services.