By Fisher, JD, CHC, CCEP
Patient Access to Medical Records Cannot Be Denied Because of an Outstanding Balance
Access to medical records is a core patient right under the HIPAA Privacy Rule. A patient’s ability to review and obtain copies of their health information supports continuity of care, informed decision-making, second opinions, billing reviews, and personal health management. For health care providers, the rule also creates a clear compliance obligation: covered entities generally must provide timely access to requested records and may not use unpaid balances as a reason to withhold them.
Why the Right of Access Matters
The HIPAA Privacy Rule gives individuals the right to inspect and obtain a copy of protected health information maintained in a designated record set, with limited exceptions. This right applies regardless of whether the patient has an unpaid bill with the provider. While a provider may pursue appropriate billing and collection processes separately, those processes cannot be used to block access to medical records.
In general, covered entities must act on a request for access within 30 days. If an extension is permitted, the provider must communicate the delay and follow the rule’s timing requirements. The central principle is that patients should receive timely access to their own health information without unnecessary barriers.
Case Overview: Access Denied Because of an Outstanding Balance
In this case, a complainant alleged that a private practice physician denied her access to her medical records because she had an outstanding balance for services the physician had provided. During the investigation by the Office for Civil Rights, the physician confirmed that the records were withheld for that reason.
The issue was not whether the balance was valid or whether the provider could seek payment. Rather, the problem was that the physician linked access to the patient’s medical information with payment of the outstanding bill. That linkage created a barrier to a right that is protected independently under the Privacy Rule.
OCR Guidance and Compliance Expectations
OCR provided technical assistance to the physician and explained that, in general, the Privacy Rule requires covered entities to provide individuals access to their medical records within 30 days of a request, regardless of whether the individual has a balance due. This guidance reinforced that payment disputes and record access must be handled as separate matters.
OCR’s broader enforcement activity has emphasized timely access, reasonable cost-based fees, and clear internal procedures for responding to patient requests. Providers that delay access, require repeated requests, or condition release of records on unrelated requirements may face complaints, investigations, corrective action, or penalties.
Resolution of the Case
After learning that access could not be withheld until payment was made, the physician provided the complainant with a copy of her medical record. The practice also revised its access procedure so that patients could receive their records even when an outstanding balance existed.
Key Compliance Lessons for Health Care Providers
- Separate billing from access. A patient’s unpaid balance should not determine whether the patient can inspect or obtain a copy of their medical records.
- Track request deadlines. Staff should document the date a request is received and monitor the response period to avoid unnecessary delays.
- Use clear request procedures. Patients should know where to send requests, what information is needed, and how records will be delivered.
- Train front-office and billing staff. Employees who interact with patients should understand that collection efforts and access rights are distinct obligations.
- Review fees carefully. If fees are charged for copies, they should be reasonable and tied to permitted costs.
- Document decisions and communications. Maintaining records of requests, responses, extensions, and communications can help demonstrate compliance if a complaint is filed.
Recommended Practice Procedure
- Receive and log the patient’s request for access.
- Verify the patient’s identity or the authority of the personal representative, using reasonable procedures.
- Identify the records included in the designated record set.
- Prepare the records in the requested form and format if readily producible.
- Communicate any permitted fees clearly and avoid using fees or outstanding balances as a barrier to access.
- Provide access within the required timeframe or document and communicate any permitted extension.
- Retain documentation showing how the request was handled.
Why This Case Is Important
This case illustrates a common compliance risk for smaller practices: routine administrative or billing procedures may unintentionally conflict with patient access rights. Even when a provider has a legitimate financial concern, the practice must avoid policies that delay or prevent access to protected health information. A simple policy revision, supported by staff training and deadline tracking, can reduce risk and improve the patient experience.
Conclusion
Patients have a right to timely access to their medical records, and that right generally cannot be conditioned on payment of an outstanding balance. Health care providers should maintain procedures that distinguish billing matters from record access requests, train staff on those procedures, and document compliance. By doing so, practices can meet regulatory expectations while supporting transparency, trust, and patient-centered care.
