Brief 002 · Navigate · source checked 2026-07-31
The HIPAA access clock, without the fine print.
A source-led briefing on the federal right of access, the 30-calendar-day response period, the one permitted extension, and the OCR complaint route.
Answer first
The short version
Under the federal HIPAA access rule, a covered entity generally must act on a records request within 30 calendar days. It may take one extension of up to 30 more calendar days only if it gives a written reason and completion date before the first period ends; another law may require faster access.
- Keep a dated copy of the request and every response.
- A federal extension is limited to one additional period of up to 30 calendar days and requires written notice.
- Check HHS guidance and the OCR complaint route if access is delayed or denied.
Frame 1 of 4: Know the federal baseline
01 / 04
Know the federal baseline
The HIPAA Privacy Rule generally gives an individual a right to inspect or obtain a copy of protected health information in a designated record set, subject to limited exclusions described by HHS.
Read · search · print
Full transcript
- 01
Know the federal baseline
The HIPAA Privacy Rule generally gives an individual a right to inspect or obtain a copy of protected health information in a designated record set, subject to limited exclusions described by HHS.
- 02
Start the clock
Under the federal rule, a covered entity generally must act on an access request no later than 30 calendar days after receiving it.
- 03
Understand the extension
One extension of up to 30 additional calendar days is permitted. Before the first period ends, the covered entity must give a written reason for the delay and a date by which it will act.
- 04
Escalate with a record
Keep the request and any response. If access is delayed or denied, review HHS guidance and the Office for Civil Rights complaint route. State law or another federal law may sometimes require faster access.
Common questions
Quick answers from this brief
How long does a provider have to respond to a HIPAA records request?
The federal baseline is generally no later than 30 calendar days after receipt. State or other federal law may sometimes require faster access.
Can the provider extend the HIPAA access deadline?
One extension of up to 30 additional calendar days is permitted if the covered entity gives a written reason and expected completion date before the first period ends.
Where can I complain about delayed or denied access?
HHS Office for Civil Rights publishes a health-information privacy complaint route. Keep your request and responses before reviewing that process.
Continue by task
Related source-led help
- Publisher
- MedicalRecords.com Editorial
- Published
- 2026-07-31
- Source check
- 2026-07-31
- Page updated
- 2026-08-12
- Format
- 4-frame visual brief + transcript
Ready to work with your own information? Continue to MedicalRecords.com. No answer or health detail is carried in this link.