A patient calls your front desk on a Tuesday in July and asks for everything in her chart from the last two years. She was seen eleven times. Seven of those visits were with four different residents, two of whom have since graduated, and one visit happened at a community rotation site your clinic does not own. Your clock started the moment she asked. You have 30 days.

If your practice operates as a medical residency training site — a family medicine clinic under a sponsoring hospital, an internal medicine continuity clinic, a faculty practice plan attached to a university — the right-of-access rules that apply to you are identical to those that apply to a two-physician private office. What is different is the plumbing. This post is about that plumbing: who holds the record, who verifies the requester, who signs the release letter, and where the 30-day clock quietly runs out.

Why a Medical Residency Clinic Complicates a Simple Request

Nothing in 45 CFR 164.524 says "unless a trainee wrote the note." The obligation belongs to the covered entity, not the individual clinician. But three structural facts about teaching sites create delay, and delay is what OCR enforces against.

First, authorship turns over. Residents rotate on four-week or eight-week blocks and graduate in June. A note signed by a PGY-2 who left in 2025 is still your record, and "the author is unavailable" is not a lawful reason to slow a request.

Second, the record is often split. A university-affiliated clinic may sit inside a hybrid entity or an organized health care arrangement with the sponsoring hospital, which means the professional-fee documentation and the hospital facility record can live in different systems under different custodians. Patients do not know or care about that boundary.

Third, rotation sites are separate covered entities. When a resident sees a patient at an outside FQHC or a specialty office during a rotation, that encounter record belongs to the rotation site. Your affiliation agreement governs training and liability; it does not make you the custodian of their charts.

How Long Does a Residency Clinic Have to Fulfill a Records Request?

Thirty calendar days from receipt of the request. You may take one 30-day extension, but only if you notify the individual in writing within the original 30 days, state the reason for the delay, and give the date you will deliver. There is no second extension. If your state law gives patients a shorter window or a lower fee cap, the state rule controls to the extent it is more protective.

The clock starts when the request reaches your practice — not when it reaches your release-of-information vendor, not when the supervising attending gets around to signing, not when the graduated resident answers an email. HHS has published extensive guidance on this in its right of access materials for professionals, and OCR has closed dozens of settlements under its Right of Access Initiative since 2019, most of them over nothing more exotic than a request that sat too long.

Where teaching sites lose the first ten days

  • The request is routed to a program coordinator instead of the privacy officer.
  • Staff wait for an attending co-signature on a resident note before releasing it.
  • The request is forwarded to the sponsoring hospital "because they have the real chart," and nobody tracks it.
  • The requester is told to come in person to sign a form, which is not required and may itself be an unreasonable barrier.

Verification Without Building a Wall

Section 164.514(h) requires you to verify the identity and authority of the requester using reasonable measures. It does not license you to invent friction. Requiring notarization, an in-person visit, or a proprietary form the patient must obtain from your office are all practices OCR has treated skeptically.

Write down what "reasonable" means at your site and apply it uniformly:

  1. Patient in person: government photo ID, or two identifiers matched against the chart if ID is unavailable.
  2. Patient by phone or portal: match at least three identifiers (full name, date of birth, and one of address, last four of SSN, or last visit date). Log which three you used.
  3. Personal representative: the document establishing authority — power of attorney, guardianship order, parent status subject to your state's minor-consent rules. Keep a copy in the request file, not the chart.
  4. Third party by patient directive: a written, signed instruction from the patient that clearly names the recipient and the delivery address. Verify the patient's signature, not the recipient's identity.

Minors are the sharp edge at a medical residency continuity clinic, because adolescent visits often include services your state lets a minor consent to independently. Build the parental-access decision tree once, with counsel, and put it in the request workflow — not in the head of whoever answers the phone.

What Counts as the Designated Record Set When Residents Rotate

The designated record set is defined at 45 CFR 164.501: medical and billing records used to make decisions about the individual. It is broader than most staff assume and includes information you received from others, not just what you generated.

Resident study notes and precepting scratch

A resident's personal notes kept for their own learning, never filed and never used to make decisions about the patient, are generally outside the designated record set. The moment that content is entered into the chart, attached to an encounter, or used to justify a decision, it is inside — regardless of who typed it. Tell your program leadership this in plain terms during orientation, because the failure mode is a resident keeping a parallel spreadsheet on a personal laptop, which is a security problem long before it is an access problem.

Supervision entries and attending attestations

Attending attestations, precepting notes, and co-signature audit entries that live in the encounter are part of the record. They are frequently the thing a patient or a plaintiff's attorney actually wants. Do not strip them; do not delay release waiting for a signature that should have been obtained at the time of service. Documentation completeness is a billing and program-accreditation issue with its own timelines. It is not a lawful basis to hold a records request.

Records you do not have

If the request covers an encounter at a rotation site you do not control, deny that portion in writing and — this part gets skipped — tell the individual where to direct the request if you know. That is an affirmative obligation under 164.524(d)(3), not a courtesy. Keep a current list of rotation sites and their release-of-information contacts next to your request log.

Fees, Formats, and Third-Party Directives

You may charge a reasonable, cost-based fee: labor for copying (including electronic copying), supplies, postage, and preparation of an agreed summary. You may not charge for search and retrieval, or for the time your staff spends verifying identity or reviewing the record. OCR has described a flat fee of up to $6.50 as one permissible approach for electronic copies of records maintained electronically.

Format matters. If the patient asks for an electronic copy and you can readily produce it, produce it. Handing a patient 340 pages of PDF printouts because your scanning workflow is easier is a compliance risk and, under the Cures Act information blocking rules, a separate exposure. ASTP/ONC maintains the current framework on information blocking and the exceptions, and "we do this manually" is not one of the exceptions.

Third-party directives are the trap. Following the 2020 Ciox Health v. Azar decision, the patient-rate fee limit does not extend to requests directing PHI to a third party in non-electronic form the way the 2013 guidance had asserted. Your billing table should distinguish (a) copies to the patient, (b) patient-directed transmissions to a third party, and (c) authorization-based disclosures to attorneys and insurers. Three columns, three fee treatments, one page.

The Vendor Layer Nobody Diagrams Until an Audit

Count the outside parties that touch a single records request at a teaching site: the release-of-information company, the document scanning vendor, the transcription service, the secure file transfer platform, the print-and-mail house, and increasingly an AI documentation assistant that drafted part of the resident's note. Each is a business associate. Each needs a signed BAA that predates the disclosure.

The gap I see most often at academic clinics is inherited paperwork. The sponsoring hospital signed a BAA with the ROI vendor in 2019; your faculty practice plan is a legally distinct covered entity and never signed anything. When OCR asks for the agreement, "the university has one" is not an answer that closes the file. If you are staring at that gap right now, you can generate a signature-ready Business Associate Agreement through a six-step wizard and have a PDF or DOCX in front of the vendor this afternoon — one-time purchase, no subscription, no procurement cycle.

Then check the second layer. Your ROI vendor almost certainly uses subcontractors for printing or storage. Your BAA should require flow-down agreements and give you the right to ask for evidence. Ask once a year. Put the date on the calendar.

A Working Rhythm: Days 1 Through 25

Assign these by role, not by name, so the workflow survives staff turnover and the June transition.

  • Day 0–1 (front desk / portal monitor): log the request with a timestamp, requester type, and scope. Every intake channel — phone, fax, portal, walk-in, email — feeds one log. If you have five channels and no single log, you do not have a 30-day clock, you have five of them.
  • Day 1–3 (HIM or privacy designee): verify identity, confirm scope, and identify which systems hold responsive records. Flag rotation-site encounters immediately.
  • Day 3–7 (HIM): assemble from all sources, including scanned outside records and behavioral health documentation, where alignment of 42 CFR Part 2 requirements with HIPAA now shapes how consent and redisclosure notices are handled.
  • Day 7–12 (privacy officer): review for the narrow categories that may be withheld — psychotherapy notes, information compiled for litigation, and the limited reviewable-denial grounds. Document the basis for anything held back.
  • Day 12–20: produce in the requested format, apply the correct fee column, and deliver by the method the patient chose, including unencrypted email if the patient was warned of the risk and still wants it.
  • Day 20–25: if delivery will slip, send the written extension notice before day 30 with a firm date. A late extension notice is worse than no extension.

Denials, Partial Denials, and the Review You Owe

Most denials at a medical residency site should be unreviewable and boring: the record does not exist, or it belongs to another entity. Reviewable denials — the ones grounded in a licensed professional's judgment about harm — require you to offer review by a licensed practitioner who was not involved in the original decision, and to tell the patient how to request it.

Write the denial letter from a template. It must be in plain language and state the basis, the review rights if any, and how to complain to you and to HHS. A resident should never draft or sign this letter. Custodial correspondence belongs to the privacy officer.

What Your Log Has to Prove

Assume an OCR data request arrives eighteen months from now. Your log should show, for every request: date received, channel, requester and verification method, scope, date fulfilled or denied, format delivered, fee charged, and whether an extension notice went out. If you also track median days-to-fulfillment by month, you will spot the July slowdown that every teaching clinic experiences during intern transition before a patient complaint spots it for you.

Cross-reference this against your broader documentation set — risk analysis, workforce training records, and vendor inventory. Practices that keep those artifacts current in one place, whether through internal process or by automating the risk analysis and policy set, spend far less time reconstructing history under deadline. And when you want a reality check on how access-related complaints get resolved, the OCR breach reporting portal is a public reminder of how ordinary most reported failures are.

Next Step

Pull your vendor list this week and mark every party that touches a records request. For any one without a current, countersigned agreement in your own entity's name, build the BAA and send it out before the next request lands. It is a one-hour task that removes the single most common finding in access-related investigations at teaching practices.