The HIPAA 30-day rule, and where it applies
Under the HIPAA right of access, a covered provider must act on a patient's own request for their records within 30 calendar days, with one 30-day extension if it explains the delay in writing. Some state laws set shorter limits.
Requests made by a law firm or insurer under the patient's signed authorization are a different route and are generally not covered by that federal deadline. In practice these requests join the provider's release-of-information queue, which is why follow-up matters. Many states set their own deadlines, which can apply to authorization-based requests too, so check the state where the records are held.
Common causes of delay
| Cause | What happens | How to prevent it |
|---|---|---|
| Authorization rejected | Missing element, expired, wrong provider name or date range | Check it against a checklist before sending |
| Fee not paid | Records held until a copy fee is settled | Agree fee approval rules up front |
| Wrong location | Request sent to a clinic that does not hold the records | Confirm where records are kept, including archives |
| Identity mismatch | Patient seen under a different name or date of birth | Include former names and identifiers |
| Vague request | "All records" takes longer to compile and review | Name record types and date ranges |
| No follow-up | Request sits unopened in a queue | Follow up on a fixed schedule |
A follow-up schedule that works
- Day of sending: confirm the request was received and is complete.
- Every few days after: check status, ask what is missing, and log the answer.
- On any problem: fix and resubmit the same day rather than waiting for the next check.
- On arrival: check the records against the request before closing it.
- SendRequest with a clean authorization.
- ConfirmReceipt and completeness confirmed.
- ChaseScheduled follow-up, problems fixed same day.
- CheckRecords checked against the request.
After the records arrive
Retrieval time is set by the provider; review time is set by you. Once records are in, Dynamix delivers checked summaries and chronologies in 3 to 5 business days. See retrieval for law firms and APS retrieval for insurers.