A patient searches how to get rid of a canker sore at 11 p.m., books a same-day telehealth slot, sends a photo of the inside of their lip through your portal, gets a five-minute visit, and receives a referral to an oral medicine specialist. Nine days later they message: "Please send my complete record to my dentist and email a copy to me." That message started a 30-day clock, and it did not start when your release-of-information coordinator got around to opening it. This post is for the administrator who owns that clock — the timelines, the verification steps, the fee rules, and the vendor gaps that turn a trivial encounter into an access complaint.

The 30-Day Clock Starts on Receipt, Not on Triage

Under 45 CFR 164.524, a covered entity must act on an individual's request for access no later than 30 calendar days after receiving it. You get one 30-day extension, and only if you send the patient a written notice inside the first 30 days stating the reason for the delay and the date you will deliver. There is no second extension.

"Receiving it" means the moment the request lands anywhere the patient reasonably expects you to be listening: the portal inbox, the general practice email, the fax line, the front desk. If your portal messages route to a clinical queue that nobody reads on weekends, the clock is still running. OCR's right of access guidance is explicit that the individual does not have to use a specific form, submit the request in a specific place, or explain why they want the record.

Several states impose shorter deadlines than HIPAA's 30 days, and where state law is more protective of the patient, state law governs your operational SLA. Build your internal target to the shortest deadline that applies to you, not to the federal ceiling. Practices that set an internal 10-business-day standard almost never miss the legal one.

The Office for Civil Rights has been resolving right-of-access complaints through its enforcement initiative since 2019, and the pattern in those cases is consistent and unglamorous: a patient asked, nobody responded, the patient filed, and the practice paid to settle a records request it could have fulfilled for the cost of a stamp.

How Long Do You Have to Fulfill a Canker Sore Visit Records Request?

Thirty calendar days from receipt, with one written 30-day extension available. Specifically:

  • Day 0: the request arrives at any practice-controlled channel.
  • Within 30 days: provide the records, or send a written extension notice with a reason and a delivery date, or send a written denial citing a permitted ground.
  • Extension ceiling: 60 days total. One extension only.
  • Format: the patient's requested form and format if you can readily produce it electronically; otherwise a readable alternative you both agree on.
  • Fees: reasonable, cost-based only. No search or retrieval charges.

A single-visit note for a minor oral lesion is the easiest request your practice will ever fulfill. Miss it anyway and it becomes indistinguishable, on a complaint form, from withholding an oncology chart.

Why a "How to Get Rid of a Canker Sore" Visit Produces More Records Than You Expect

Administrators consistently underestimate the designated record set for low-acuity encounters. Recurrent oral lesions frequently route outward — to dentistry, oral medicine, ENT, or internal medicine when the pattern warrants a broader workup — which means the record does not sit in one system. That is the only clinical fact this article needs: records move between organizations, and every hop is a disclosure you must be able to account for.

For one visit prompted by a patient searching how to get rid a canker sore, your fulfillment inventory may include:

  • The portal intake questionnaire and free-text symptom description.
  • The photo the patient uploaded, stored as an attachment in the messaging module or in a separate image repository.
  • The telehealth platform's visit metadata, and the chat transcript if the platform retains one.
  • The clinical note and any addendum.
  • The e-prescribing record and pharmacy transmission log.
  • The referral letter to the specialist and any returned consult report you filed into the chart.
  • Billing and coding records, which are part of the designated record set when maintained by or for you.

Portal photos are part of the record

If a patient sends a clinical image and a clinician looks at it to make a decision, it belongs in the designated record set. Practices lose access disputes because the image lived in a messaging thread that the ROI export routine never touched. Test your export against a real encounter that included an attachment. If the attachment does not come out, your workflow is broken and you will find out from a complaint rather than an audit.

Verification That Confirms Identity Without Building a Wall

45 CFR 164.514(h) requires you to verify identity before disclosing. It does not authorize you to invent friction. You may not require notarization, an in-person appearance, a proprietary form, or a reason for the request.

Workable verification for a portal-originated request: the authenticated portal account itself, plus a match on two static identifiers. For a phoned-in or faxed request: date of birth plus address on file plus one additional element, documented in the request log. For emailed requests, you may confirm the address by replying to the address of record.

If the patient asks you to email an unencrypted copy, you must honor it after warning them about the risk. Document the warning and the patient's confirmation in the same log entry. That documented exchange is your defense if the message is later intercepted.

Adolescents, parents, and personal representatives

Oral lesion visits skew young, and teen encounters are where verification workflows fail. Whether a parent is the personal representative — and therefore entitled to the record — turns on state minor-consent law and on whether the minor consented to that specific service independently. Assign this determination to one named person, usually the privacy officer, and require documentation of the basis in the request log. Do not let a front-desk staffer resolve it in real time at the counter with a parent standing there.

When the patient directs you to send records to a third party, such as their dentist, the direction must be in writing, signed, and must clearly identify the recipient and where to send it. A portal message the patient typed and submitted under their authenticated account satisfies the writing requirement in most implementations; confirm yours with counsel and write the answer into your policy.

Fees: Cost-Based, Narrow, and Easy to Get Wrong

For a copy going to the patient, you may charge only labor for copying, supplies such as media or paper, postage, and preparation of an explanation or summary if the patient agreed to one in advance. You may not charge for searching, retrieving, verifying, or for the time your staff spent deciding whether to release. There is no fee for the patient viewing the record in your portal.

A 2020 federal court decision in Ciox Health, LLC v. Azar narrowed the patient-rate fee cap so that it does not automatically apply to copies a patient directs you to send to a third party. That distinction has real billing consequences, and it is a common source of miscalculation when a request bundles both destinations, as the dentist-plus-patient example does. Post your fee schedule, apply the patient rate to the patient's own copy, and document your basis for anything else.

The Vendor Layer: Whoever Actually Holds the Note

Count the third parties in a single low-acuity telehealth encounter: the telehealth platform, the transcription service, the cloud fax provider that transmitted the referral, the image storage vendor, the answering service that took the callback, and possibly an outsourced release-of-information company. Every one of them creates, receives, maintains, or transmits PHI on your behalf. Every one needs a Business Associate Agreement in place before the first record moves.

Records requests are where missing agreements surface, because fulfillment forces you to enumerate every system the data touched. If that enumeration turns up a vendor you never papered — the fax service the office manager signed up for in 2023, the scheduling tool the new provider brought with them — fix it the same week. You can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX, one-time purchase, which is faster than routing a redline through counsel for a $40-a-month fax vendor.

Then look at the operational half of those contracts. If your ROI vendor's SLA is 20 business days, and your intake team takes four days to hand off, you are at the federal ceiling before anyone touches a keyboard. Negotiate turnaround into the agreement and hold the vendor to it. HIPAA does not care that your subcontractor was slow; the obligation is yours.

A Worked Timeline for the Canker Sore Request

  1. Day 0: Portal message arrives. Auto-acknowledgment sends. Message is tagged as an access request and routed to the ROI queue, not the clinical queue.
  2. Day 1: Coordinator opens the request log entry: date received, channel, requester, verification method, formats and destinations requested.
  3. Day 2: Verification completed through the authenticated portal account plus identifier match. Third-party direction to the dentist confirmed as signed and specific.
  4. Day 3: Designated record set assembled — note, intake form, uploaded image, referral letter, billing record. Image export verified visually, not assumed.
  5. Day 4: Fee calculated for the patient copy. Patient notified of the amount and, because they asked for email, of the risk of unencrypted transmission.
  6. Day 6: Patient confirms. Records delivered to both destinations. Delivery method, timestamp, and recipient recorded.
  7. Day 6: Log entry closed. No extension needed, 24 days of margin remaining.

That is the whole workflow. It fails only when Day 0 goes unnoticed for three weeks.

Denials Are Narrow, and This Is Not One of Them

The permitted grounds for denying access are limited: psychotherapy notes, information compiled in reasonable anticipation of litigation, certain research and correctional contexts, and a small set of reviewable grounds involving likelihood of substantial harm. A note documenting a minor oral lesion and a specialist referral does not qualify.

If you ever do deny in part, the denial must be written in plain language, must state the basis, must explain review rights where they apply, and must describe how to complain to you and to HHS. And you must still release the portions that are not exempt. Partial release with a written explanation is almost always the correct answer.

Three Front-Desk Sentences That Generate Complaints

Train these out of your staff's vocabulary this quarter:

  • "You'll need to sign an authorization for that." Patients do not authorize disclosures to themselves. Requiring one is an access barrier.
  • "Only the doctor can approve a records release." Clinician review is not a legal prerequisite and it is the single most common cause of blown 30-day deadlines.
  • "What do you need it for?" You may not condition access on the answer, and asking signals to the patient that you might.

Add a fourth rule: no discussion of a patient's oral lesion, or anything else, at an open check-in counter within earshot of the waiting room. The minimum necessary standard applies to volume as well as content.

The Audit Trail That Proves You Complied

Your request log is the artifact an investigator will ask for. Every entry should carry: date and channel of receipt, requester and relationship, verification method used, records requested, format and destination, fee charged and its basis, extension notice date if any, delivery date and method, and the staff member who closed it. Retain the documentation for six years.

Fold access-request handling into your annual risk analysis rather than treating it as a separate exercise. Portal messaging, image storage, and outsourced ROI each represent a place where PHI leaves your direct control. If your policy set and risk documentation are stale, automated HIPAA risk analysis and policy generation will get you to a defensible baseline faster than rebuilding templates by hand. For breach context and enforcement patterns, the OCR breach portal and ONC's patient access resources are worth an hour of your time each quarter.

Your Next Step This Week

Pull the last ten access requests your practice fulfilled. Check the interval between receipt and delivery, whether portal attachments made it into the export, and whether every vendor that touched those records has a current signed agreement on file. If even one is missing, build and execute the Business Associate Agreement now — before the next patient who searched how to get rid of a canker sore asks you for their chart and starts a clock you cannot stop.