The Enforcement Nobody Plans For
Ask a practice what they are worried about and you will hear ransomware, phishing, maybe a lost laptop. Almost nobody says "a patient asks for their chart and we take too long." Yet the Right of Access Initiative has produced more than 45 settlements since it began, with penalties ranging from $3,500 for a solo dental practice to $240,000 for a hospital system, and OCR has confirmed it remains a priority in 2026.
These cases start with a complaint, not an incident. Someone asked for their records, did not get them, waited, asked again, and eventually filled out a form on the HHS website. No attacker is involved. No technical sophistication is required to avoid it.
The Rule, Stated Plainly
A patient has the right to a copy of their own protected health information held in a designated record set. You generally have 30 days to provide it, with one 30-day extension available if you notify the patient in writing of the delay and the reason. You must provide it in the form and format the patient requests if you can readily produce it that way — including electronically, including by ordinary email if that is what they ask for and they have been warned of the risks. You may charge only a reasonable, cost-based fee.
That is the whole rule, and the settlements almost never turn on anything subtle. They turn on requests that went unanswered for months.
The New Wrinkle: Parents and Minors
OCR has signaled a specific new focus, and it is one that catches good-faith organizations. Some health systems and EHR vendors have implemented age-based or policy-based portal restrictions that automatically cut off a parent's proxy access when a child reaches a certain age — often twelve or thirteen.
The intent is sound. Adolescents have genuine confidentiality rights in specific categories of care, and those rights vary by state. The problem is the bluntness of the implementation. A switch that severs all parental access on a birthday goes far beyond protecting the narrow categories state law actually shields, and in doing so it blocks a personal representative from records they are legally entitled to receive.
Under HIPAA, a parent is generally the personal representative of their minor child and has the same access rights the patient would have — with real exceptions where state law lets a minor consent to care on their own, where a court has intervened, or where the provider reasonably believes disclosure would endanger the child. Those exceptions are specific. A default that applies them to every record for every adolescent is not implementing the exception; it is implementing a blanket denial.
What to Check This Month
- Find out what your portal actually does at each age threshold. Not what you believe it does — what the configuration says. Many practices inherited these settings from a vendor default and have never seen them written down.
- Separate the genuinely protected categories from everything else. If your state protects certain adolescent services, restrict those records. Immunization history, a broken arm, and routine visits are usually not in that category.
- Make sure a denial is reviewable by a human. If the portal cannot release something, there must be an obvious path for a parent to make a written request that a person evaluates. An automated wall with no door behind it is what produces complaints.
- Train front desk staff on what to say. "The system won't let me" is how a manageable question becomes a federal complaint. Staff need a script that ends in a submitted request, not a dead end.
- Log every access request and its outcome. Which brings us to the thing that resolves most of these cases.
The Log Is the Whole Defense
When OCR receives an access complaint, the first question is simple: when did the request arrive, and when did you fulfill it? Practices that can answer with a dated entry usually resolve the matter quickly. Practices that cannot are in a much weaker position, because the patient has a date and the practice has a recollection.
The fix is not expensive. A single log — date received, who asked, what they wanted, what was sent, date sent, and any extension notice — converts an unanswerable question into a documented one. It needs one owner and about two minutes per request.
It also surfaces the problem before OCR does. Requests almost never fail because a practice refuses; they fail because the request arrives by fax to a machine nobody watches, or reaches an inbox belonging to someone on leave. A log makes an aging request visible while there is still time.
Where Practices Actually Go Wrong
Three patterns cause most of it. The request goes to a place with no owner — a general voicemail, a shared inbox, a fax tray. The fee conversation becomes a delay; you may charge a reasonable, cost-based fee, but negotiating it does not pause the 30-day clock. And the records are scattered, so assembling a complete set from the EHR plus scanned documents plus a legacy system takes weeks nobody budgeted.
None of those is a compliance philosophy problem. They are workflow problems with a regulatory deadline attached, which is exactly why they are fixable in an afternoon.
Related Reading
- The violations behind the fines
- 9 things OCR auditors actually ask for
- Notice of Privacy Practices: what changed
- The HIPAA compliance checklist
Call to Action
If you cannot say how many records requests you received last month or how long they took, that is the gap worth closing first. Schedule a walkthrough to see how requests, deadlines, and evidence stay tracked in one place, or take the 3-minute readiness quiz to see where else you stand.