Arizona Medical Records Request Rules for Practices (2026)

Arizona's medical records law covers both medical records and payment records, and a 2026 amendment added response time frames that depend on why the records are requested. Requests for litigation, including from a patient's attorney, get 30 calendar days. Arizona allows a "reasonable fee" with no dollar cap in the statute, and it has a detailed rule for when a practice may produce records in response to a subpoena.

At a glance

Question	Answer
Deadline for a patient's request	Depends on the purpose. A 2026 subsection that applies "notwithstanding" the rest of the statute sets 10 or 15 business days for records needed for upcoming treatment and 30 calendar days for everything else, including personal copies and litigation. The general rule elsewhere in the statute says seven business days.
Copy fees a practice can charge	A "reasonable fee," with no per-page amount in the statute. No charge when records go to another provider for continuing care, to the patient for the purpose of getting care, or for a Social Security appeal.
Requests from the patient's attorney	Allowed with a written authorization signed by the patient. Litigation requests get 30 calendar days. The same reasonable-fee rule applies.
Subpoenas	Served at least 10 days before production and must come with a patient authorization, a court order or qualified protective order, or fit another listed category. Otherwise the practice may not produce the records to the requesting party.
Records that need extra consent	HIV-related information needs an authorization that specifically says it covers HIV-related information. Genetic testing results need specific written authorization.
How long to keep records	Adults: at least 6 years after the last service. Minors: the later of 3 years after age 18 or 6 years after the last service. Source data such as x-rays: 6 years from collection.
Recent changes (2023–2026)	HB 2557 (Laws 2026, Chapter 98) added the tiered response time frames, effective September 12, 2026.

When the patient asks

Arizona gives patients and their health care decision makers the right to access or get copies of their medical records and payment records on written request (A.R.S. § 12-2293). "Medical records" include records prepared by other providers, and "source data" includes x-rays and other diagnostic images (A.R.S. § 12-2291).

Subsection A of § 12-2293 says a practice must respond "promptly and within not more than seven business days." Subsection E, added in 2026, applies "notwithstanding any other provision of this section" and sets these time frames:

Records needed for upcoming medical treatment: 10 business days if the records are less than 12 months old and in the practice's current electronic health record system, or 15 business days if they are 12 months old or more and in that system.
Any other purpose: 30 calendar days. The statute lists litigation, a patient's personal copies (even when the records are in a patient portal), life insurance, payors, schools and records of a deceased patient.

The law does not require a practice to create or compile records that do not already exist. A practice may deny access only on listed grounds, such as a health professional's finding that access is reasonably likely to endanger someone. It must note the denial in the record, explain it in writing and release the rest.

On fees, Arizona allows a "reasonable fee" for reproductions and lets the practice require payment in advance, except when needed for continuity of care (A.R.S. § 12-2295). The statute sets no dollar amount. Because Arizona has no cap, HIPAA's cost-based fee limit is what limits fees for a patient's own request. A practice cannot charge for records sent to another provider for continuing care, to the patient for the demonstrated purpose of getting health care, or to the patient or legal representative for an appeal of a denial of Social Security benefits (records already given free that calendar year, and additional requests, can be charged; a representative must provide form SSA-1696).

When the patient's attorney asks

A practice may release medical and payment records under a written authorization signed by the patient or the patient's health care decision maker (A.R.S. § 12-2294). A request for litigation falls in the 30-calendar-day group under § 12-2293(E). The reasonable-fee rule in § 12-2295 applies to any person who requests reproductions, so it covers attorney requests too.

Anyone who receives records this way may not pass them on without the patient's written authorization unless the law allows it. A copy service working for the practice is bound by the same rules and must return the records to the practice.

Subpoenas

A.R.S. § 12-2294.01 sets the rules for subpoenas for medical or payment records:

The subpoena must be served on the practice and every party at least 10 days before the production date.
It must come with one of the following: a written authorization signed by the patient or decision maker; a court or tribunal order requiring release or meeting HIPAA's qualified protective order requirements; or it must be a grand jury subpoena, a health profession board subpoena, or a case where another law requires release.
If none of these applies, the practice must not produce the records to the requesting party. It may file the records under seal with the court, file an objection, or move to quash or modify under Arizona Rule of Civil Procedure 45.

To deliver under seal, the practice sends a copy by certified mail or in person to the court clerk by the production date, in a sealed inner envelope marked with the case title and number, the practice name and the subpoena date, inside a sealed outer envelope. A custodian affidavit goes with it, stating that the affiant is the authorized custodian, that the copy is true and complete, and, if applicable, that the practice has none or only part of the records. The copy is admissible under Arizona Rule of Evidence 902(11).

If the practice files an objection, it must send a copy to the patient, the patient's attorney if known and the requesting party. After that, the patient or the patient's attorney is responsible for asserting any privilege, and the practice produces the records if the court orders it.

Records that need extra consent

HIV and communicable disease information. Under A.R.S. § 36-664, an authorization to release communicable disease information must be signed, dated, and name the recipient, the purpose and the time period. A general authorization for medical records does not cover HIV-related information unless it specifically says it is for confidential HIV-related information. HIV-related information also cannot be compelled by subpoena except as that law allows, such as by a court order under § 36-665.

Genetic testing. Genetic testing results are confidential and may be released to a person "specifically authorized in writing" by the person tested, among other listed recipients (A.R.S. § 12-2802). If genetic testing information is subpoenaed, the practice responds with an objection under § 12-2294.01(E).

Billing records and medical bills

Arizona treats "payment records" (all communications about payment for a patient's care that identify the patient) the same as medical records for confidentiality, patient access, release, subpoenas and fees (A.R.S. §§ 12-2291 to 12-2295). An itemized bill or ledger is therefore covered by the same request and subpoena rules as the chart.

How long to keep records

Unless another law requires longer, A.R.S. § 12-2297 requires a provider to keep records:

For adults, at least 6 years after the last date of service.
For minors, at least 3 years after the 18th birthday or 6 years after the last date of service, whichever is later.
For source data kept separately, such as x-rays, 6 years from the date of collection.

A provider who retires or sells a practice must take reasonable steps to make sure the records are kept for these periods.

Recent changes

HB 2557 (Laws 2026, Chapter 98) amended A.R.S. § 12-2293 to add the response time frames described above, including the 30-calendar-day period for litigation and other non-treatment requests and the definition of "upcoming medical treatment." It took effect on Arizona's general effective date for 2026 legislation, September 12, 2026.

What this means for your practice

Log the purpose of every request when it arrives. Arizona's deadline depends on it: 10 or 15 business days for upcoming treatment, 30 calendar days for litigation and personal copies.
Do not produce records on a bare attorney subpoena. Check for a patient authorization, a court order or a qualified protective order, and use the under-seal or objection route if none is attached.
Keep a custodian affidavit template that matches § 12-2294.01(D) so under-seal deliveries are ready to go.
Make sure your authorization form has a separate, specific line for HIV-related information and for genetic testing results.
Set a written copy-fee schedule you can defend as reasonable, and apply HIPAA's cost-based limit to patients' own requests.
Keep adult charts at least 6 years after the last visit and pediatric charts until the later of age 21 or 6 years after the last visit.

Sources

How we verified: statute text and 2026 bill materials read on the Arizona Legislature's official site (azleg.gov) on November 12, 2026.