Federal Rules for Medical Records Requests: HIPAA and Related Laws (2026)

Federal law sets the floor for every records request a practice receives. Under HIPAA, a patient asking for their own records must get them within 30 days (one 30-day extension allowed) for no more than a limited, cost-based fee. Requests from attorneys, subpoenas, substance use records and psychotherapy notes each follow separate federal rules, and state law fills in fees, deadlines and retention where HIPAA is silent.

At a glance

Question	Answer
Deadline for a patient's request	No later than 30 days after receipt. One extension of up to 30 more days, only with a written notice to the patient within the first 30 days giving the reason and the completion date (45 CFR 164.524(b)(2)).
Copy fees a practice can charge	A reasonable, cost-based fee limited to copying labor, supplies, postage and an agreed summary (45 CFR 164.524(c)(4)). No search and retrieval charges. HHS allows an optional flat fee of up to $6.50 for electronic copies of records kept electronically.
Requests from the patient's attorney	The HIPAA cost-based fee limit applies only to a patient's request for their own records, not to a request to send records to a third party such as an attorney (HHS notice on Ciox Health v. Azar, 2020). Most attorney requests arrive with a HIPAA authorization under 45 CFR 164.508.
Subpoenas	A subpoena without a court order is not enough by itself. The practice needs written "satisfactory assurance" of notice to the patient or of a qualified protective order (45 CFR 164.512(e)).
Records that need extra consent	Psychotherapy notes need a specific authorization (45 CFR 164.508(a)(2)). Records from federally assisted substance use disorder programs fall under 42 CFR Part 2, which requires patient consent or a special court order for use in proceedings against the patient.
How long to keep records	HIPAA sets no medical record retention period; state law governs. HIPAA documentation, including signed authorizations, must be kept 6 years (45 CFR 164.530(j)).
Recent changes (2023–2026)	The 2024 reproductive health privacy rule was vacated in 2025 (except most of its Notice of Privacy Practices changes). Part 2 compliance became mandatory February 16, 2026, with HHS civil enforcement starting the same day. Information blocking disincentives for providers took effect in 2024.

The patient's right of access

Patients have a right to inspect and get a copy of the health information about them in a practice's "designated record set." For a health care provider, that set includes both medical records and billing records (45 CFR 164.501). Two categories are excluded from the right of access: psychotherapy notes, and information compiled in reasonable anticipation of, or for use in, a civil, criminal or administrative action or proceeding (45 CFR 164.524(a)(1)).

A practice may require requests in writing, as long as it tells patients about that requirement. It must act within 30 days of receiving the request. If it cannot, it may take one extension of no more than 30 days, but only by giving the patient a written statement of the reasons and the date it will finish, before the first 30 days run out (45 CFR 164.524(b)).

The practice must provide the records in the form and format the patient asks for if they are readily producible that way. When records are kept electronically and the patient asks for an electronic copy, the practice must provide one, in the requested format if readily producible or in another readable electronic format both sides agree on. A summary instead of the full record is allowed only if the patient agrees in advance to the summary and to any fee for it (45 CFR 164.524(c)(2)).

A practice can deny access only on limited grounds. Some denials (for example, where a licensed professional finds that access is reasonably likely to endanger someone's life or physical safety) give the patient a right to review by another licensed professional. Every denial must be in writing, in plain language, and explain the reason, any review rights and how to complain (45 CFR 164.524(a) and (d)).

Fees

For a patient's own request, the regulation allows a reasonable, cost-based fee that covers only:

Labor for copying, whether paper or electronic
Supplies for a paper copy, or for portable media such as a CD or USB drive if the patient asks for one
Postage, if the patient asks for the copy to be mailed
Preparing a summary or explanation, if the patient agreed to it in advance

HHS guidance says copying labor does not include reviewing the request or searching for and retrieving the records. Costs for verification, system maintenance and data storage are also excluded, "even if authorized by State law." A practice cannot make a patient buy portable media, and HHS says practices should provide copies free of charge where they can.

HHS describes three ways to set the fee: actual cost per request, a schedule based on average costs, or a flat fee of no more than $6.50 (covering all labor, supplies and postage) for electronic copies of records kept electronically. HHS also says per-page fees are not permitted for copies of records kept electronically; a per-page rate fits only paper records copied to paper or scanned. Practices that charge actual costs must be able to tell patients the approximate fee in advance.

HHS's federal Right of Access enforcement continues. On October 8, 2026, the Office for Civil Rights (OCR) announced its 56th Right of Access enforcement action, a $140,000 settlement with a Pennsylvania dental practice over a failure to give a patient timely access.

Requests sent to an attorney

The regulation text still says that when a patient's signed, written request directs the practice to send a copy to another person, the practice must do so (45 CFR 164.524(c)(3)(ii)). A federal court narrowed this in Ciox Health, LLC v. Azar (D.D.C. January 23, 2020). According to HHS, the court vacated the third-party directive to the extent it went beyond requests for a copy of an electronic health record in an electronic format. HHS also states that the cost-based fee limit "will apply only to an individual's request for access to their own records, and does not apply to an individual's request to transmit records to a third party."

In practice, this means a patient's request to send records to their personal injury attorney is not capped by the HIPAA patient-access fee. Fees for those requests are typically set by state law. HIPAA's rule on the sale of health information still applies: a disclosure is not treated as a prohibited sale when the only payment is a reasonable, cost-based fee to prepare and transmit the records, or a fee expressly permitted by other law (45 CFR 164.502(a)(5)(ii)(B)(2)(viii)).

A patient remains free to request the records for themselves at the patient-access fee and then give them to their attorney.

Authorizations

Most attorney and insurer requests come with a HIPAA authorization. To be valid, an authorization must include (45 CFR 164.508(c)):

A specific description of the information to be disclosed
Who may disclose it and who may receive it
The purpose ("at the request of the individual" is enough when the patient starts the request)
An expiration date or event
The patient's signature and date, or a personal representative's signature with a description of their authority
Statements about the right to revoke in writing, whether treatment can be conditioned on signing, and the possibility of redisclosure by the recipient

It must be in plain language. An authorization is not valid if it has expired, is missing a required element, is known to have been revoked, or contains material information the practice knows is false (45 CFR 164.508(b)(2)). A patient can revoke it in writing at any time, except to the extent the practice already acted on it. Signed authorizations must be kept for 6 years (45 CFR 164.508(b)(6) and 164.530(j)).

Subpoenas

A practice may disclose records in a lawsuit or administrative proceeding in response to a court or tribunal order, limited to exactly what the order authorizes (45 CFR 164.512(e)(1)(i)).

For a subpoena, discovery request or other lawful process that is not signed by a judge, the practice needs "satisfactory assurance" from the party asking. That means a written statement and documentation showing either:

The party made a good-faith attempt to give the patient written notice with enough detail to object, and the time to object has passed with no objection or with objections resolved by the court; or
The parties agreed to, or the requesting party asked the court for, a qualified protective order. That order must limit use of the records to the case and require their return or destruction at the end.

The practice may instead make those notice efforts or seek the protective order itself (45 CFR 164.512(e)(1)(ii) to (vi)). State civil procedure rules still decide whether the subpoena itself is valid and what custodian paperwork is required.

Substance use and psychotherapy records

Psychotherapy notes. These are a mental health professional's notes about counseling session conversations, kept separate from the rest of the medical record. They do not include medication records, session times, treatment types, test results or summaries of diagnosis, treatment plan, symptoms, prognosis or progress (45 CFR 164.501). Almost any disclosure needs a specific authorization, and that authorization can be combined only with another psychotherapy notes authorization (45 CFR 164.508(a)(2) and (b)(3)(ii)). Patients do not have a HIPAA right of access to them.

Substance use disorder records (42 CFR Part 2). Part 2 covers records that identify a patient as having a substance use disorder and that come from a federally assisted program that diagnoses, treats or refers for substance use disorder. Federal assistance includes Medicare participation, and DEA registration where the controlled substance is used for substance use disorder treatment (42 CFR 2.12). A treating provider that is not itself a Part 2 program may record substance use information in its own chart without that chart becoming subject to Part 2 (42 CFR 2.12(d)(2)(ii)).

Part 2 records received from a program cannot be used in civil, criminal, administrative or legislative proceedings against the patient without the patient's written consent or a court order issued under Part 2. A consent for use in a proceeding cannot be combined with any other consent (42 CFR 2.31(d)). A subpoena alone does not permit disclosure; a court must also enter an authorizing order after notice to the patient and the record holder and a finding of good cause (42 CFR 2.61 and 2.64). Disclosures made with consent must carry the required notice against redisclosure (42 CFR 2.32).

Information blocking

Under the 21st Century Cures Act rules, health care providers are "actors" who can commit information blocking (45 CFR 171.102). For a provider, information blocking is a practice the provider knows is unreasonable and likely to interfere with access, exchange or use of electronic health information, unless required by law or covered by an exception (45 CFR 171.103).

Two exceptions matter most for records requests. A provider should fulfill a request in the manner asked for, or if it cannot, in an alternative manner without unnecessary delay (45 CFR 171.301). The fees exception does not protect a fee that HIPAA's patient-access fee rule prohibits, or a fee based on electronic access by the patient, their representative or a person the patient designates (45 CFR 171.302(b)).

Since 2024, providers that the HHS Office of Inspector General finds have committed information blocking can face disincentives from CMS: hospitals and MIPS eligible clinicians can be treated as not meaningful EHR users, and ACOs and their participants can be removed from the Medicare Shared Savings Program for at least one year (45 CFR 171.1001). In September 2025, the Inspector General and the Office of the National Coordinator issued a joint enforcement alert announcing intensified information blocking enforcement.

How long to keep records

HHS states that the HIPAA Privacy Rule does not include medical record retention requirements and that state laws generally govern how long records are kept. HIPAA does require safeguards for records for as long as they are kept, including at disposal. Separately, HIPAA documentation, such as policies, required written communications and signed authorizations, must be kept for 6 years from creation or the date it was last in effect, whichever is later (45 CFR 164.530(j)).

Recent changes

Reproductive health privacy rule vacated. HHS's 2024 HIPAA Privacy Rule to Support Reproductive Health Care Privacy (89 FR 32976, April 26, 2024) added an attestation requirement for certain requests, including subpoenas. In Purl v. U.S. Department of Health and Human Services, No. 2:24-CV-228-Z (N.D. Tex.), the court vacated the rule on June 18, 2025 and entered an amended judgment on July 3, 2025. The judgment keeps the rule's changes to the Notice of Privacy Practices (45 CFR 164.520), except three paragraphs tied to the vacated provisions. As of November 2026, the vacated text still appears in the online Code of Federal Regulations.
Part 2 compliance date and enforcement. HHS's 2024 Part 2 final rule took effect April 16, 2024, with compliance required by February 16, 2026. OCR, which received Part 2 enforcement authority in August 2025, began accepting Part 2 complaints and breach reports on February 16, 2026, with penalties aligned with HIPAA's.
Information blocking disincentives. The provider disincentive rules in 45 CFR 171.1000 to 171.1002 took effect in 2024, followed by the September 4, 2025 enforcement alert.
Right of access rule unchanged. As of November 2026, the 30-day deadline and fee rule in 45 CFR 164.524 have not been amended since 2014.

What this means for your practice

Date-stamp every request on arrival. For a patient's own request, the 30-day clock starts at receipt, and any extension notice must go out before day 30.
Sort each request by who is asking and on what basis: the patient for themselves, the patient directing records to an attorney, an authorization, or a subpoena. The fee rule and paperwork differ for each.
For patient requests, do not charge search and retrieval or per-page fees for electronic records. A flat fee of up to $6.50 is a simple option for electronic copies.
Check every authorization against the required elements in 45 CFR 164.508 before releasing records, and keep it for 6 years.
Do not release records on a subpoena alone. Look for a court order or written satisfactory assurance, and check state procedure rules for the subpoena itself.
Flag psychotherapy notes and any Part 2 records in the chart so they are not released under a general authorization or an ordinary subpoena.

Sources

How we verified: regulation text was read from the official eCFR (current through November 2026), HHS and ONC guidance and press releases were read on hhs.gov and healthit.gov, and the Purl rulings were read from copies of the filed court documents, all on November 12, 2026.