The Office for Civil Rights (OCR) continues to vigorously enforce an individual's right to access their medical records. OCR ensures that patients receive their medical records in a timely manner consistent with the format and fee requirements set forth under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. Based on OCR's continued focus on enforcement of an individual's right of access, entities should prioritize responding to access requests in a compliant manner and address any access-related issues that are brought to their attention immediately.

Patients' rights to access their protected health information (PHI) is a hallmark of the HIPAA Privacy Rule and should be a compliance priority for healthcare entities. Entities that fail to provide patients with timely access to their medical records can face enforcement actions and hefty fines. Timely, according to the Privacy Rule, generally means a healthcare provider must act upon the request within 30 days.

Under HIPAA, patients generally have the right to request access to inspect and obtain a copy of their health information. This right extends to a broad array of information including medical records, billing and payment records, insurance information, clinical laboratory test results, medical images (such as x-rays), and other types of health information.

If the healthcare entity cannot fulfill the request within 30 days, it must provide the patient with a written notice of the reasons for the delay and the date by which the entity will act on the request. This notice must occur during the original 30 days window.

You can learn more about an individual's right under HIPAA to access health information by going to the U.S. Department of Health and Human Services website at https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html.