Patient access is won or lost at the records counter

The week

On December 10, 2020, the HHS Office for Civil Rights announced a proposed rule to modify the HIPAA Privacy Rule. It was published in the Federal Register in January 2021. On patient access, it proposed cutting the time covered entities have to respond to a request from 30 days to 15, with a narrower extension. It also proposed a right to inspect records in person and take photographs, and a bar on unreasonable identity verification requirements. Providers would have had to post estimated fee schedules for copies.

The proposal also responded to a January 2020 federal court decision that had narrowed the rules on patients directing copies to third parties. It would have limited that right to electronic copies held in an electronic health record. Other provisions addressed disclosures for care coordination and the notice of privacy practices.

Patients have had a right to see and obtain their health records under HIPAA for two decades. The December 2020 proposal did not create that right. It tried to make it work the way patients experience it. For health systems, that moved the subject from privacy policy to a much less visible place: the release-of-information desk, the patient portal and the vendor that often runs both. The proposal targeted three points of friction. They are the response clock, the identity check and the delivery path. Each is operational, and each was within a provider’s control whether or not the rule was ever finalized.

The response clock

Thirty days, with a 30-day extension, had long been the outer limit for responding. Many organizations treated the limit as the target. A patient changing doctors, seeking a second opinion or managing a chronic condition experiences a month as a long wait.

Meeting a shorter clock is mostly a workflow problem. Requests arrive by mail, fax, portal message, email and in person, often to different departments. A request that sits in a clinic inbox for a week before reaching the records team has already used half of a 15-day allowance. The first control is a single intake log that stamps every request with its receipt date, whichever door it came through.

The second is knowing where the slow requests come from. Organizations that measured their response times usually found that most requests were fast and a long tail was slow. The tail tends to involve records outside the main electronic health record. Typical sources are imaging archives, billing systems, legacy systems from acquired practices and outside storage vendors. Fixing retrieval from those sources does more for the average than pushing the records team to work faster.

Enforcement pressure did not wait for the rule. OCR had launched a right of access enforcement initiative in 2019 and was already announcing settlements with providers that took too long. Many targets were small and mid-sized practices, which showed that size was no shelter.

The identity check

HIPAA requires reasonable steps to verify a requester’s identity before disclosing records. Some organizations had turned that into notarized forms, in-person visits or demands for several documents. Those requirements fell hardest on patients with limited mobility, time or paperwork.

The proposal would have barred unreasonable verification. That exposes a real trade-off. Too little checking invites fraud and disclosure to the wrong person, including in domestic violence situations or custody disputes. Too much checking blocks legitimate patients and generates complaints. The workable answer is proportionate verification, set out in a written standard so staff are not improvising:

• Authenticated portal requests rely on the identity proofing done at enrollment and need no further documents.
• Phone and paper requests accept reasonable proof, such as matching demographic details and a copy of identification, without notarization.
• Higher-risk cases, such as personal representatives, minors, flagged safety concerns or a change of delivery address, get stronger checks and a named escalation contact.

This ties access to the quality of portal enrollment. An account created with weak proofing provides weak assurance for every later request. One created with good proofing makes later requests both simpler and safer. Identity work at the front desk pays off months later at the records counter.

The delivery path

The third friction point is how records reach the patient, and at what cost. Patients increasingly wanted electronic copies, sent to themselves, to an app or to another provider. The proposal would have strengthened directing electronic copies to third parties and required providers to post estimated fees.

Delivery runs into a second set of rules. The information blocking provisions of the 21st Century Cures Act were due to begin applying in April 2021. They restrict practices likely to interfere with access to electronic health information, including by patients. A provider can therefore face two questions about the same request: whether it met HIPAA’s access standard, and whether its process amounted to information blocking. The portal, the application programming interfaces offered to apps and the release-of-information process have to give consistent answers. Organizations should check with counsel on how the two regimes apply to specific request types.

Fees deserve their own review. Many health systems use a release-of-information vendor that charges for copies under its own schedule. The provider remains responsible for the patient’s experience and for what the patient is charged. A posted fee schedule, checked against what the vendor actually bills, removes a frequent source of complaints. Contracts with these vendors should also set response-time targets that match the provider’s own obligations, with reporting the provider can audit.

Staffing ties the three points together. Release-of-information teams are often small and measured on volume. Shorter clocks, more electronic delivery and more judgment about identity call for training and clear escalation paths for unusual requests. Teams with those paths stop improvising under time pressure. They also produce better data on where requests stall, which is what leaders need to keep improving.

With hindsight

The December 2020 proposal was not finalized under the following administration, and as of this writing it remained unfinished. HHS regulatory agendas in 2026 still listed parts of it, with signs that the access deadline would be handled in a separate rulemaking.

Pressure on access came from elsewhere. OCR’s right of access initiative produced dozens of settlements and penalties over the following years, many against smaller providers. The information blocking rules began applying in April 2021. Their scope widened in October 2022 to cover electronic health information broadly, and HHS finalized disincentives for providers found to have engaged in information blocking in 2024. Patient access through portals and apps became an expectation. The organizations that fared best had built a single intake log, a written proportionate identity standard and electronic delivery by default, all of which they could do without waiting for the 2020 proposal.