September 22, 2026
This story is fictional. If it sounds like your hospital, that’s between you and your privacy officer.
March 3
Dear Sir or Madam:
I am writing for my wife, Carol Bryce, who was a patient at Halsey Memorial last October. She has an appointment at the university on March 27 for a second opinion before her surgery, and the surgeon there has asked to see her scans and the pathology report. Carol is not well enough to write letters, so I enclose a note in her own hand asking you to send them to her at this address.
Yours truly, Walter Bryce
March 19
Dear Patient:
Thank you for contacting Halsey Memorial Hospital. To protect your privacy, all requests must be submitted on Form HIM-114, signed by the patient and notarized. Please allow 30 business days for processing. Fees are $25.00 for search and retrieval plus $0.75 per page. Requests not submitted on the approved form cannot be processed.
Release of Information, Health Information Management
March 22
Dear Release of Information:
Your form is enclosed, notarized at our bank, with a check for $25.00. Carol signed it lying down, and her signature may not look the way it used to. I have asked the university to move the appointment.
W.B.
April 21
Dear Patient:
We are unable to process your request. The signature on Form HIM-114 does not match the signature on file. In addition, Section 4 (Purpose of Request) was left blank. Please note that diagnostic images are maintained by the Department of Radiology and must be requested separately on Form R-9. Your check is being held pending a complete request.
Release of Information
April 23
Dear Release of Information:
Purpose of request: she would like to know what is wrong with her.
A new HIM-114 is enclosed. I held the pen with her. Form R-9 is enclosed as well. The university has moved the appointment to May 30.
W.B.
May 28
Dear Patient:
Your request has been received and is in process. Our staff attempted to verify your request by telephone on May 14, May 20 and May 27 but were unable to reach you at the number on file. Protected health information cannot be released until identity has been verified. Halsey Memorial is committed to protecting your privacy.
Release of Information
June 9
Dear Release of Information:
You will not reach her at that number. Please send the records here anyway. I would still like to know what was wrong with her.
Walter Bryce
August 30
Dear Ms. Bryce:
Enclosed please find copies of your records as requested (212 pages). An invoice for $159.00 is enclosed. We apologize for any delay.
At Halsey Memorial, your experience matters. In the coming days you may receive a brief survey about your recent interaction with our Release of Information team. We hope you will take a moment to tell us how we did.
Before you read on: Which of the hospital’s requirements did HIPAA allow? How long did the hospital actually have? Was there a faster way to get the scans to the university?
Under 45 C.F.R. § 164.524, Carol was entitled to her records within 30 calendar days of her request, and the hospital’s first letter quoted 30 business days. Halsey could have extended once, by 30 days, if it had told her in writing within the first 30 why it needed more time and when the records would come (§ 164.524(b)(2)). It sent no such notice, and the records arrived in August, five months after Walter’s first letter.
A hospital may require a written request on its own form if it tells patients so in advance (§ 164.524(b)(1)), and it must verify identity (§ 164.514(h)). OCR’s access guidance warns against verification steps that cause unreasonable delay, and three unanswered calls to a patient’s home number over two weeks seem to me a fair example. The same guidance bars a search-and-retrieval fee, because access fees must be reasonable and cost-based (§ 164.524(c)(4)), and it bars asking a patient why she wants her records. Images are part of the record, and the separate Radiology form for them cost Carol another round of waiting.
OCR has enforced the access right through its Right of Access Initiative since 2019. The first settlement under it, announced that September, was an $85,000 payment by Bayfront Health St. Petersburg, which took more than nine months to give a mother her prenatal fetal heart monitor records.
To prevent a repeat, route every part of the record, images included, through one intake, start the clock on the day a request arrives, and have a supervisor review any request nearing day 30. The university’s office could also have asked Halsey for the scans directly, because § 164.506(c)(2) lets one provider disclose PHI to another for treatment, and that request needs no form from the patient.
Takeaway: The 30 days start when the request arrives, not when the paperwork is perfect.