A Patient Asked for Their Records. What Do I Have to Give Them?

Published September 27, 2026 · 7 minute read · General information, not legal advice. Your licensing regulators decide what applies to you.

A patient emails asking for everything in their file. Or a new clinic calls for records so treatment can continue. Or a request arrives on a lawyer's letterhead. The practice has the chart, so the instinct is to send it. The questions that follow are what counts as everything, who may ask, what can be charged, and how long there is before the answer is late.

The right involved is federal and sits in one place, which makes it one of the few recordkeeping questions that can be read at the source. What follows describes that rule. It is not a statement of what applies to any particular practice, which is a question for the practice's own counsel.

The clock starts at receipt

Under the federal access provision, 45 CFR 164.524, a covered entity must act on a request for access "no later than 30 days after receipt of the request." One extension of up to 30 further days is available, and it is not automatic. It requires written notice to the patient stating the reason for the delay and the date the request will be completed.

Two things follow from the words "receipt of the request." The first is that the clock does not wait for the request to reach the right person. A message in a general inbox over a holiday weekend, a voicemail nobody transcribed, a note handed to a front desk that was covering for someone, a portal message flagged for later: the days run anyway. The practices that get caught out by this are usually not the ones that refused a request. They are the ones where nobody could say when it arrived.

The second is that a request needs a defined landing place: one channel, logged, with a date on it. That log is what can later show the response was inside 30 days, and it costs nothing to keep.

What "the records" covers

The rule gives an individual a right of inspection, a right to a copy, or both, over the protected health information held in what it calls a designated record set. That is wider than the clinical note. It reaches the records the practice uses to make decisions about that patient, which in a treatment setting usually covers photographs, consent forms, intake questionnaires, billing records and correspondence about their care.

Format is specified too. The rule requires access "in the form and format requested by the individual, if it is readily producible in such form and format," and if not, in readable hard copy or another form agreed with the patient. A practice that keeps photographs in one system and notes in another finds out on the first request whether the two can be produced together. That is a better week to find out than the week a complaint is open.

Grounds for denial exist and are listed in the rule itself, some as narrow categories of material and some requiring review by a licensed professional. Denial is a decision to make with advice, not to improvise and explain afterwards.

Fees are limited to named categories

The fee provision is unusually specific. It says the fee includes only the cost of:

"(i) Labor for copying the protected health information requested by the individual, whether in paper or electronic form; (ii) Supplies for creating the paper copy or electronic media if the individual requests that the electronic copy be provided on portable media; (iii) Postage, when the individual has requested the copy, or the summary or explanation, be mailed; and (iv) Preparing an explanation or summary of the protected health information."

What is absent from that list is as informative as what is on it. Time spent finding the record is not a listed cost, and neither is the overhead of the software it lives in. A practice that prices a records request off general staff time, or off what a copy service charges, has not priced it off this paragraph.

When a patient directs that records go to a third party rather than to themselves, the picture changes. A federal court decision in January 2020 vacated part of the third-party directive provision, and the Department of Health and Human Services published a notice on what the ruling changed, which states that "the right of individuals to access their own records and the fee limitations that apply when exercising this right are undisturbed and remain in effect." The two paths are not interchangeable, and a request that names a law firm or another clinic is the point at which a practice asks its own attorney rather than reaching for the same envelope.

Verification is a separate step from disclosure

Nothing in a right of access obliges a practice to send a chart to whoever asks. The requester has to be who they say they are, and where someone is acting for a patient, their authority has to be established. That step is the one most likely to be skipped when a request arrives urgently, and skipping it turns a routine disclosure into a wrong one.

What a practice can settle in advance, in writing:

Which channel requests come in through, and who monitors it on the days the usual person is away.
How receipt is recorded, with a date, so the 30 day count has a start.
How identity is verified, and what is accepted as proof that someone is acting for a patient.
Which systems hold parts of the file, and who can export from each.
What the practice charges, on what basis, and who set that figure.
Who signs off before anything leaves, and who is told when a request is denied in whole or part.
Where a copy of the outgoing release is filed, so the practice can show later what was sent and when.

That last line matters more than it looks. A request answered without a record of the answer is, months later, indistinguishable from one never answered.

Where this sits next to retention

Access and retention are different questions that use the same shelf. A file has to still exist to be produced, and it has to be findable by somebody other than whoever created it. The guide on how long to keep patient records covers the periods side, including why the well known six year figure belongs to a different pile of paper than the charts.

The Complete Charting Bundle and the Patient Communication Set carry the identifiers and dating fields that make a file retrievable, and the correspondence records that show what was sent. The Emergency Documentation Set holds the incident records frequently requested alongside a chart. Periods, fees and release authority are left blank, filled in by the practice from what its own regulators and counsel say.

Do this next

Pick one patient treated in the last two years and run a request against their file as if it had arrived this morning. Gather every part of it, photographs and consents and intake and billing correspondence included, and put it in one place, one format. Write down how long it took, how many systems it came out of, and who would have done it if the person who just did had been away. That page is the start of a records request procedure, and its gaps are the practice's real ones rather than a template's guesses.

Get the framework. The documents described here ship blank, in this structure, with a Jurisdiction Verification page and a medical director sign-off line on every page.

Complete Charting Bundle, 12 records, $27
Patient Communication Set, $12
Emergency Documentation Set, $29

See the full catalog

Questions this guide answers

How long does a practice have to respond to a patient's request for their own records?

The federal rule sets 30 days from receipt of the request, with one extension of up to 30 more days available if the practice gives the patient written notice that says why and when the records will arrive. The clock runs from receipt, not from the point somebody notices the request, which is why the intake path for these requests matters as much as the retrieval.

Can a practice charge a patient for a copy of their own chart?

A fee is permitted, but the categories it can cover are listed in the federal rule and are narrow. They are labor for copying, supplies for paper or portable media, postage where mailing was requested, and preparing a summary or explanation if the patient asked for one. Search time and retrieval time are not on that list. What a practice may charge where it operates is a question for its own counsel.

Does a patient have to say why they want their records?

No. The right of access does not depend on a stated reason. A practice does verify who is making the request before sending anything, and it can require the request in writing if that is its normal practice, but requiring an explanation as a condition of release is a different thing.

What if the request is for the records to be sent to a lawyer or another clinic?

That is a different path from a patient asking for their own copy, and a federal court decision in 2020 narrowed part of it. The Department of Health and Human Services published a notice on what that ruling changed. A practice with a third-party request in hand should get its own advice rather than treating it as the same transaction.