A fax lands at 8:40 on a Tuesday. A patient seen eight weeks ago for bleeding hemorrhoids wants "my complete file" sent to a new gastroenterologist across town, plus a copy emailed to herself. Your front desk has a signed form, no ID, an email address that doesn't match the one in the chart, and a note that the patient is traveling. The 30-day clock started the moment that request arrived — not when someone gets around to processing it. This post walks the administrative workflow: what the clock actually covers, how much verification is enough, what you may charge, and which vendors in the chain need a signed agreement before any of it moves.

Why One Rectal Bleeding Complaint Scatters Records Across Four Systems

The clinical detail matters here only because it explains where the paper goes. A complaint of rectal bleeding is commonly worked up rather than assumed, which means a single episode of care frequently generates records in more than one organization.

In a typical chain, your practice holds the office note and the referral. The gastroenterology group holds the consult. An ambulatory endoscopy center holds the procedure report and the anesthesia record. A pathology lab holds the specimen report. A third-party billing company holds the claim.

When the patient says "send everything," she means all of that. Your designated record set does not. Understanding that boundary before you respond is the difference between a clean fulfillment and an access complaint.

Define your designated record set in writing, once

Your designated record set includes the medical and billing records you use to make decisions about the individual — office notes, results you received and filed, images, correspondence, and the claims data you maintain. It does not include a specialist's internal records you never received, and it does not include quality-assurance work product or peer review files that live outside the record set.

Write this definition down as a one-page policy and give it to whoever staffs release of information. Otherwise the answer changes depending on who opens the fax, and inconsistency is what OCR notices when a complaint arrives.

The 30-Day Clock That Starts When the Request Arrives

Under the HIPAA right of access, you have 30 calendar days from receipt to act on a request. "Receipt" means arrival at your organization — the portal message timestamp, the fax header, the postmark, the date the front desk took the form across the counter. Not the date it reached the privacy officer's desk.

You get one 30-day extension, and only one. To use it, you must notify the individual in writing inside the original 30 days, state the reason for the delay, and give the date you will deliver. An extension you take without written notice is simply a late response.

Several states impose shorter deadlines — 15 business days is common — and stricter state law controls. Build your internal service level around the shortest deadline that applies to you, not the federal ceiling. HHS's individuals' right of access guidance is the authoritative reference and worth printing for the ROI binder.

What "act on" actually requires

Acting means either providing the copy or issuing a written denial with the grounds and the review rights. A partial fulfillment with a promise to "send the rest later" is not acting. If a portion of the record is unavailable, send what you have inside the deadline and document the gap.

Thirty calendar days from the date the request reaches your organization, with one 30-day extension available if you notify the patient in writing within the first 30 days. The condition does not change the timeline — a request for records from a bleeding hemorrhoids visit runs on the same clock as any other. The operational checklist:

  • Day 0: Date-stamp the request at the point of arrival, in every channel.
  • Day 0–2: Verify identity and, if the request names a third party, confirm the written directive is signed and specific.
  • Day 2–5: Pull the designated record set; confirm what you hold versus what belongs to the specialist, endoscopy center, or lab.
  • Day 5–10: Calculate any fee, notify the patient in advance, and confirm the delivery format the patient requested.
  • By Day 30: Deliver, or deliver a written denial, or send the written extension notice.

Shorter state deadlines override the federal 30 days. Check yours before you write the policy.

Verification: Enough to Be Reasonable, Not Enough to Be a Barrier

HIPAA requires you to verify the identity and authority of the requester. It does not tell you how, and it explicitly warns against verification procedures that create unreasonable obstacles to access. Requiring an in-person visit with photo ID from a patient who asked by portal is the classic over-correction — and it has shown up repeatedly in OCR's right-of-access enforcement work, which has produced dozens of settlements since the initiative launched in 2019.

A verification tier that survives audit

  • Authenticated portal request: The login is the verification. Do not ask for more.
  • Written request by mail or fax: Match name, date of birth, and at least one additional data point on file. Deliver to an address or number already in the chart when possible.
  • Email request from an unrecognized address: Call the number on file and confirm. Log the callback with time and staff initials.
  • Personal representative: Obtain the legal document — power of attorney, guardianship order, parental status per state law — and note what you reviewed, not just that you reviewed something.

One caution specific to sensitive GI encounters: patients frequently do not want a mailed envelope arriving at a shared household address. If the patient requests delivery by unencrypted email and you have warned them of the risk, you must honor it. Document the warning and the patient's confirmation in the request log.

Fees You May Charge, and the Ones That Generate Complaints

You may charge a reasonable, cost-based fee covering labor for copying, supplies such as media or paper, postage, and preparation of an explanation or summary if the patient agreed to one in advance. You may not charge for search and retrieval, and you may not charge for the staff time spent verifying the requester or reviewing the record for accuracy.

OCR guidance also describes a flat-fee option of $6.50 for electronic copies of records maintained electronically. Many practices adopt it purely to remove the argument from the front desk.

Tell the patient the fee before you incur it. Surprise invoices attached to a delivered record are a reliable source of complaints, and a fee that functions as a deterrent to access is treated as a denial of access.

The third-party directive wrinkle

When a patient directs you to send records to a third party — a new gastroenterology practice, an attorney, a disability insurer — the 2020 Ciox Health v. Azar decision vacated the portion of OCR guidance that extended patient-rate fee limits to third-party directives for records in any format. Practically: fee limits apply to copies going to the patient. Third-party directives may follow your state's copy-fee schedule. Train staff to distinguish the two on intake, because they route differently and price differently.

Every Hand That Touches the Record Needs an Agreement

Trace one bleeding hemorrhoids record request through your actual environment and count the outside entities involved. A release-of-information vendor pulls and packages the file. A cloud fax service transmits it. A transcription service produced the underlying note. A secure-messaging platform delivers the patient's copy. A document-storage company holds the archived paper chart from before your EHR migration.

Each of those is a business associate creating, receiving, maintaining, or transmitting PHI on your behalf, and each requires a signed agreement in place before the first record moves. The gap most practices discover during an audit is not the EHR contract — it is the fax service someone added in 2023 with a credit card, or the ROI vendor operating under a two-page service order that never mentions HIPAA.

If you are staring at a vendor list with holes in it, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX — a one-time purchase, no subscription — which is usually faster than routing a redline through counsel for a $40-per-month fax service. Get the paper signed before the next request lands, not after.

Ask ROI vendors these four questions

  1. What is your internal turnaround, and does it fit inside our 30-day obligation with room to spare?
  2. Who sets the fee shown to the patient, and can we override it for patient-directed requests?
  3. How do you distinguish a patient request from a third-party directive at intake?
  4. Do you notify us of every request received, or only the ones you cannot fulfill?

That last question matters. If your vendor is late, you are late. The obligation does not delegate.

Information Blocking Sits on Top of the Access Rule

The right of access is not the only rule in play. Information blocking regulations independently prohibit practices that interfere with the access, exchange, or use of electronic health information, and the exceptions are narrow and specific. A delay you can justify under HIPAA's 30-day window may still look like interference if the record is sitting in the EHR and the only obstacle is an unstaffed ROI queue.

Review the current exceptions on HealthIT.gov's information blocking page and map them against your actual denial reasons. If your staff has a habit of holding results "until the doctor reviews them," that habit needs a documented basis or it needs to stop.

A Worked Timeline: Request to Delivery in Eleven Days

Day 0, Tuesday 8:40 a.m. Fax arrives. Front desk date-stamps, scans to the ROI queue, and logs it in the tracker. No triage judgment at this step — every request gets logged.

Day 0, 11:00 a.m. ROI coordinator reviews. Two destinations: the patient's email and a named gastroenterology practice. She splits it into two tasks because the fee rules differ.

Day 1. Callback to the number on file confirms the email address. Coordinator documents the verification and the patient's acknowledgment that unencrypted email carries risk.

Day 3. Record set assembled: office notes, the referral letter, the pathology report your practice received, and the imaging report. The endoscopy center's procedure note was never sent to you — the coordinator tells the patient in writing where to request it rather than staying silent.

Day 4. Fee quoted for the third-party copy under the state schedule; patient copy sent at the flat electronic rate. Both figures disclosed in advance in writing.

Day 9. Patient copy delivered. Third-party copy transmitted through the fax vendor with a signed agreement on file.

Day 11. Tracker closed with delivery confirmations attached. Total elapsed: eleven days against a thirty-day obligation, with an audit trail that answers every question an investigator would ask.

What to Log, and Why the Log Is the Defense

When a right-of-access complaint arrives, the investigator does not ask whether you meant well. They ask for dates. Your tracker should capture, for every request: arrival date and channel, requester and relationship, verification method and who performed it, scope requested versus scope produced, fee quoted and date disclosed, extension notice date if used, delivery date, and delivery method with confirmation.

Run a monthly report on two numbers: median days to fulfillment and count of requests over 20 days. The second number is your early warning. A queue that drifts past 20 days will eventually breach 30, and by then you are explaining a pattern rather than an incident.

Pair that with a periodic look at the HHS breach portal to see how misdirected records and vendor incidents actually surface in your region. Records-request workflows generate a meaningful share of small-scale disclosure errors — wrong fax number, wrong patient in a batch, wrong household address.

Close the Vendor Gaps Before the Next Request

The administrative failure mode around a bleeding hemorrhoids encounter is never clinical. It is a request that sat in a queue, a fee that was never disclosed, or a copy service moving PHI with no agreement behind it.

Take twenty minutes this week: list every outside party that touches a records request in your practice, and check each one against your signed agreements. For the gaps, build and export a compliant BAA in a single sitting. If your broader policy set and risk analysis are also overdue, automating the full compliance document set will get you further than another spreadsheet.