---
title: "What Is the HIPAA Right of Access? Rules and Deadlines"
description: "The HIPAA right of access lets patients inspect and copy their records within 30 days. Deadlines, formats, fees, and how it works in telehealth on Cuvo."
canonical: "https://cuvo.co/glossary/hipaa-right-of-access"
last-updated: "Oct 26, 2026"
---
**Definition:** The HIPAA right of access is a patient's right to inspect and get a copy of their protected health information in a covered entity's designated record set, which the covered entity must act on within 30 days, with one 30-day extension (45 CFR 164.524).

# What is the HIPAA right of access?

A patient can ask any covered entity for a copy of their records, and HIPAA sets the clock, the format and what the provider may charge. In telehealth the request runs to the practice that keeps the chart. On Cuvo Health that chart belongs to the treating professional corporation, and the brand owns everything else.

Published Oct 26, 2026. Facts reviewed Oct 26, 2026.

The HIPAA right of access is a patient's right to inspect and obtain a copy of their protected health information in a covered entity's designated record set. Under 45 CFR 164.524, the covered entity must act on a request within 30 days and may extend once, by up to 30 days, with a written reason and completion date. It must give an electronic copy in the form requested when readily producible, send the copy to a person the patient names in a signed written request, and charge only a reasonable, cost-based fee. On Cuvo Health, the brand owns the patient relationship and every business record, while the chart, and the duty to answer access requests, belongs to the treating professional corporation and its licensed clinicians.

**At a glance**
- What it is: A patient's right to inspect and copy their PHI in the designated record set
- Rule: 45 CFR 164.524
- Deadline: Act within 30 days; one extension of up to 30 days, with reasons and a date in writing
- Format: The electronic form requested, if readily producible, or another agreed readable form
- Fees: A reasonable, cost-based fee for labor, supplies, postage and an agreed summary only
- On Cuvo: The chart belongs to the treating professional corporation; the brand owns its business records

**What 45 CFR 164.524 requires of the covered entity**

| Requirement | What the rule says | Paragraph |
| --- | --- | --- |
| **Request** | The covered entity may require written requests if it tells patients so | 164.524(b)(1) |
| **Timing** | Act within 30 days of receipt; one extension of up to 30 days | 164.524(b)(2) |
| **Form and format** | The form requested if readily producible; an electronic copy of electronic records when asked | 164.524(c)(2) |
| **Copy to a third party** | Send it to the person the patient names in a signed written request | 164.524(c)(3)(ii) |
| **Fees** | Reasonable and cost-based: copying labor, supplies, postage, an agreed summary | 164.524(c)(4) |
| **Exclusions** | Psychotherapy notes and information compiled for a legal proceeding | 164.524(a)(1) |
| **Denial** | A timely written denial, with access to the rest of the requested information | 164.524(d) |

## 01. Who answers a right of access request in telehealth?

The covered entity does, which in a white-label model is the treating practice that keeps the chart. A platform that holds the chart for the practice is a business associate, and its agreement must require it to make protected health information available so the practice can meet the request (45 CFR 164.504(e)(2)(ii)(E)). A brand that receives a records request from a patient should pass it to the practice promptly, since the practice owes the response. On Cuvo, the chart sits on HIPAA-compliant infrastructure under a business associate agreement signed on every plan.

## 02. How is the right of access different from a brand's data export?

The right of access belongs to the patient and runs against the covered entity; it covers the clinical record. A brand's ability to take its customer list and business records with it is a matter of contract with the platform. On Cuvo, the brand owns the patient relationship, the customer list and every business record, including orders, subscriptions, invoices and revenue, all exportable at any time, and medical charts belong to the treating professional corporation and its licensed clinicians, as HIPAA and state law require.

## 03. Can a patient send their records to another provider?

Yes. Section 164.524(c)(3)(ii) requires the covered entity to send the copy directly to a person the patient designates, when the request is in writing, signed by the patient, and clearly identifies the recipient and where to send it. That is how a patient moving to a new provider takes their chart along. This is general information, not legal advice.

**Primary sources**
- [45 CFR 164.524: access of individuals to protected health information](https://www.ecfr.gov/current/title-45/section-164.524): eCFR, checked Oct 26, 2026
- [45 CFR 164.501: designated record set](https://www.ecfr.gov/current/title-45/section-164.501): The records the right reaches
- [45 CFR 164.504(e): business associate contracts](https://www.ecfr.gov/current/title-45/section-164.504): A business associate's duty to make PHI available

## Frequently asked questions

**Q: What is the HIPAA right of access?**

A: It is a patient's right under 45 CFR 164.524 to inspect and get a copy of their protected health information in a covered entity's designated record set. On Cuvo, the chart belongs to the treating professional corporation, which answers access requests, and the brand owns its own business records.

**Q: How long does a provider have to respond to a medical records request under HIPAA?**

A: Thirty days from receipt, with one extension of no more than 30 days if the provider gives the patient a written reason and a completion date within the first 30. On Cuvo, the chart sits on HIPAA-compliant infrastructure under a business associate agreement, so the treating practice can produce it.

**Q: Can a provider charge for medical records under HIPAA?**

A: Only a reasonable, cost-based fee covering copying labor, supplies for portable media, postage and an agreed summary, under 45 CFR 164.524(c)(4). On Cuvo, the brand's own business records are exportable at any time as part of the platform.

**Q: Does the right of access cover telehealth records?**

A: Yes. The rule reaches protected health information in the designated record set however care was delivered, and requires an electronic copy of electronic records in the form requested when readily producible. On Cuvo, telehealth charts are kept by the treating professional corporation on HIPAA-compliant infrastructure.

**Q: Who handles a patient's records request on a white-label telehealth platform?**

A: The treating practice, as the covered entity, with the platform making the record available under its business associate agreement. On Cuvo, medical charts belong to the treating professional corporation and its licensed clinicians, and Cuvo signs a business associate agreement on every plan.

**Related pages**

- [Who owns the patients and data in white label telehealth](/blog/who-owns-the-patients-and-data-on-a-white-label-telehealth-platform): Patient access, brand exports and exit terms in one guide
- [Designated record set](/glossary/designated-record-set): The records the right of access reaches
- [Business associate agreement (BAA)](/glossary/business-associate-agreement): The vendor's duty to make records available
- [Protected health information (PHI)](/glossary/protected-health-information): What the patient is entitled to see
- [Cuvo compliance](/compliance): HIPAA infrastructure Cuvo runs for every brand
- [Telehealth glossary](/glossary): Every term a telehealth founder meets

Canonical page: https://cuvo.co/glossary/hipaa-right-of-access