Medical records requests: fulfilling a patient's right of access (US)
For release-of-information and medical records staff, practice managers and anyone who prepares responses to patients' requests for their own health records at a US health care provider covered by HIPAA. Complete 'Healthcare administration: HIPAA Privacy Rule basics for front-office staff' first: it covers taking the request and the 30-day deadline. This course covers the next steps: working out what's in scope, producing the copy in the form and format asked for, charging only the permitted fee items, handling requests to send records to someone else, and writing a denial that gives the patient their review and complaint rights. Jurisdiction: US federal (45 CFR Part 164). State law and your organisation's procedure may add requirements; your privacy official decides anything not covered here. This is not legal advice and does not grant any licence or certification.
- Level
- Intermediate
- Length
- About 98 minutes
- Contents
- 5 lessons · final exam
- Status
- Published · updated 10 Oct 2026
Skills you'll practise
- Identify what a right-of-access request covers in the designated record set, including the exceptions
- Choose the form, format and delivery method the rule requires for a copy
- Calculate a records fee that includes only the permitted cost items
- Route a request to send records to a third party as a right-of-access directive or as an authorization
- Write a denial of access that states the grounds, review rights and complaint routes the rule requires
Course outline
- 1.Identifying what a right-of-access request coversLesson · 16 min
- 2.Choosing the form, format and delivery method for a copyLesson · 16 min
- 3.Calculating a records fee that includes only permitted costsLesson · 16 min
- 4.Routing a request to send records to a third partyLesson · 14 min
- 5.Writing a denial of access with review and complaint rightsLesson · 16 min
- 6.Medical records requests: fulfilling a patient's right of access (US): knowledge checkKnowledge check · 14 questions
- 7.Medical records requests: fulfilling a patient's right of access (US): practical exerciseKnowledge check · 1 question
- 8.Final exam10 questions · passing it completes the course, so people who already know the material can test out
Sources it draws on
The lessons and questions are written from these references, so learners can go back to the original.
- 45 CFR 164.524 Access of individuals to protected health information, via Cornell LII
- 45 CFR 164.501 Definitions (designated record set, psychotherapy notes), via Cornell LII
- 45 CFR 164.502 Uses and disclosures: general rules (personal representatives), via Cornell LII
- 45 CFR 164.514 Other requirements (verification of identity and authority), via Cornell LII
- 45 CFR 164.508 Uses and disclosures for which an authorization is required, via Cornell LII
- HHS proposed rule (Federal Register, 21 January 2021): Proposed Modifications to the HIPAA Privacy Rule, 86 FR 6446 (background on fees guidance and Ciox v. Azar)
- Ciox Health, LLC v. Azar, No. 18-cv-00040 (D.D.C. 23 January 2020), memorandum opinion, via GovInfo
See it with your own jobs and topics
Tell us about your team and we'll walk you through setup, from choosing jobs to your first skills check.