The HIPAA right of access

By Sam Rivera, Founder, SentinelPanda · June 19, 2026 · 1 min read · HIPAA

The right of access is the HIPAA rule OCR fines most. Patients get their records, promptly, at reasonable cost — and "we were slow" is an expensive answer.

The right

Under the Privacy Rule, individuals have the right to inspect and obtain a copy of their own PHI held in a designated record set, in the form and format they request where feasible. It is a patient right, and covered entities must honour it; business associates support it through their contracts.

Timelines and fees

Access must be provided promptly — generally within 30 days of the request, with a limited extension possible. Fees must be reasonable and cost-based; charging excessive fees or imposing barriers is itself a violation. Convenience and speed are part of the requirement, not optional courtesies.

Why it drives enforcement

OCR launched a Right of Access Initiative and has pursued numerous enforcement actions against entities that delayed, overcharged, or refused access. It is one of the most actively enforced parts of HIPAA, partly because complaints are easy for individuals to file.

For business associates

If you hold PHI for a covered entity, your systems and processes need to support the customer's ability to fulfil access requests within the timelines — exporting an individual's records cleanly. SentinelPanda tracks the controls and processes that support these data-subject obligations.