The HIPAA Right of Access in Medical Billing

The HIPAA Privacy Rule does more than permit a practice to use protected health information for payment; it also grants the individual an affirmative right to see and receive a copy of it. Under 45 CFR 164.524, a person has the right to inspect and obtain a copy of protected health information about themselves that a covered entity maintains in a designated record set, for as long as the information is kept in that set. It is the counterpart to the HIPAA Privacy Rule's permission side: the rule that lets a practice use the information to bill is the same rule that lets the patient get it back.

Two verbs sit inside the right, and they are not the same. To inspect is to view the information; to obtain a copy is to take it away in a usable form. An individual may ask for either or both, and a practice's process has to be able to deliver either — a patient who wants to read their file in the office is exercising the same right as one who wants an electronic copy emailed to them.

It is tempting to treat the right of access as a medical-records-department problem. The definition of the records it reaches says otherwise. A designated record set is a group of records a covered entity uses to make decisions about individuals, and 45 CFR 164.501 names the parts of it outright: for a provider, the medical records and the billing records about individuals; for a health plan, the enrollment, payment, claims-adjudication, and case- or medical-management record systems. Billing is not adjacent to the right of access — it is written into the definition.

In practice that means an access request can reach into records a billing office owns and a medical-records clerk never sees: the itemized account of what was charged, the claim data the practice submitted, the explanations of benefits and remittances it holds, the notes on a patient's balance. If the practice used a record to make a decision about the patient — including a billing or payment decision — it is part of the set the patient may ask to see.

The right of access is broad, and the exceptions to it are narrow and specific. Two categories of information sit outside the right entirely: psychotherapy notes, and information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative proceeding (45 CFR 164.524(a)(1)). Neither is something a billing operation ordinarily handles.

Beyond those, the rule allows a covered entity to deny access only on grounds it lists exhaustively, and it sorts them into two kinds:

• Unreviewable grounds (45 CFR 164.524(a)(2)) — a short, fixed list, such as records subject to the Clinical Laboratory Improvements or Privacy Act provisions, information obtained under a promise of confidentiality where access would reveal the source, or an inmate request that would jeopardize safety. A denial on one of these is not subject to review.
• Reviewable grounds (45 CFR 164.524(a)(3)) — chiefly where a licensed health care professional has determined that access is reasonably likely to endanger the life or physical safety of the individual or another person. A denial on a reviewable ground must be reviewed by a designated licensed professional if the individual asks.

For a billing operation the practical rule is simple: withholding access is not a billing decision. If a request appears to touch one of the narrow grounds, it is routed to the person responsible for the practice's access policy — usually the privacy officer — who applies the rule and, where a ground is reviewable, arranges the required professional review. A biller's job is to recognize the request and move it, not to decide it.

The rule puts the response on a clock. A covered entity must act on a request for access no later than 30 days after it receives the request (45 CFR 164.524(b)(2)(i)). Acting means either providing the access or, if a ground for denial applies, giving a written denial that explains it and how to seek review or complain.

One extension is allowed. If the practice cannot act within 30 days, it may take up to one additional 30-day period, but only if — within the original window — it gives the individual a written statement of the reason for the delay and the date it will complete the request (45 CFR 164.524(b)(2)(ii)). The rule permits only a single extension; a second one is not available.

Timely access is not a technicality the enforcer overlooks. HHS's Office for Civil Rights runs a HIPAA Right of Access Initiative — an enforcement effort aimed specifically at covered entities that fail to give individuals prompt access to their records at a reasonable cost — and it has been an active, ongoing priority producing a series of enforcement actions. A request left to drift toward the 30-day limit, or past it, is exactly the kind of lapse the initiative exists to catch.

The rule gives the individual, not the practice, the say over the form the copy takes. A covered entity must provide access in the form and format the individual requests, if the information is readily producible that way; if it is not, then in a readable hard copy or another form and format the parties agree to (45 CFR 164.524(c)(2)(i)). Where the information is maintained electronically and the individual asks for an electronic copy, the practice must provide it in the electronic form and format requested if readily producible, and otherwise in a readable electronic form the parties agree to (164.524(c)(2)(ii)).

A practice may offer a summary or explanation instead of the full copy, but only if the individual agrees to that in advance and agrees in advance to any fee for it (45 CFR 164.524(c)(2)(iii)). A summary is an option the patient can accept, not a substitute the practice can impose.

The right also runs to a person the individual chooses. If a request directs the practice to transmit a copy directly to a third party the individual designates, the practice must send it there — provided the request is in writing, signed by the individual, and clearly identifies the designated person and where to send the copy (45 CFR 164.524(c)(3)). This is what lets a patient have their records sent to a new provider, an attorney, or a family member, and the written-and-signed requirement is what protects against a copy being routed to the wrong hands.

A practice may charge for a copy, but the rule caps both the size and the makeup of the fee. It must be a reasonable, cost-based fee, and 45 CFR 164.524(c)(4) enumerates the only costs it may include: the labor for copying the information, whether on paper or electronically; the supplies for a paper copy or the portable media the individual asked for; postage, when the individual asked for the copy to be mailed; and the cost of preparing a summary or explanation, if the individual agreed to one. Anything outside that list — the practice's overhead, the cost of searching for and retrieving the records, the time spent verifying identity — is not a permitted component of the fee.

Because the standard is cost-based, the honest way to set the fee is to build it from the actual or reasonable costs the rule allows, rather than to apply a flat charge chosen for convenience. HHS has published guidance on acceptable ways to calculate the fee; a practice should ground its charge in that guidance and in the current regulation rather than in a number carried over from a records vendor.

For a billing office, complying with the right of access is less a legal project than a handful of defaults built into how records requests are handled.

1. 01

   Know that your billing records are in scope

   The designated record set includes billing records and the payment and claims-adjudication systems (45 CFR 164.501). Treat a patient's request for their claim data, statements, or remittances as a right-of-access request, not a favor.
2. 02

   Never condition access on a paid balance

   Nonpayment for care is not a ground for denial. Separate the two ledgers: work the outstanding balance through the normal billing process, and release the records on the access timeline regardless of what the patient owes.
3. 03

   Start the 30-day clock on receipt and track it

   A covered entity must act within 30 days of receiving the request, with at most one 30-day extension on written notice (45 CFR 164.524(b)(2)). Log the receipt date, and treat the deadline as a ceiling to beat, not a target to reach.
4. 04

   Honor the requested form, format, and destination

   Provide the copy in the form and format requested where readily producible, including an electronic copy of electronic records, and transmit it to a third party when the individual's written, signed request directs it (45 CFR 164.524(c)(2)–(3)).
5. 05

   Charge only a reasonable, cost-based fee

   Limit any fee to the labor for copying, supplies, postage, and an agreed summary (45 CFR 164.524(c)(4)); leave out search, retrieval, and overhead, and never use the fee to recover the care bill.
6. 06

   Route anything that looks like a denial

   Withholding access is not a billing decision. Send any request that appears to touch a ground for denial to the privacy officer, who applies the rule and arranges the professional review a reviewable ground requires.

The right of access is one of several individual rights the Privacy Rule creates — the right to amend a record (45 CFR 164.526) and the right to an accounting of certain disclosures (45 CFR 164.528) are separate rights with their own procedures. It sits alongside the other regulatory duties in the Compliance and Regulations category, and where a practice's records are held by a vendor, the business associate agreement must require that vendor to make the information available so the practice can meet a request. Because the rules are revised and enforcement guidance evolves, a practice's access policy should point to the current regulation and be reviewed when it changes.