A patient sends a written request to a physician practice for an electronic copy of their medical record, which the practice maintains electronically. Under the HIPAA Privacy Rule, what is the practice's primary obligation in responding?
Tap an answer to reveal the correct answer, rationale and source.
Answer:
The HIPAA right of access requires a covered entity to act on a request generally within 30 days and to provide records in the electronic form and format requested when readily producible, charging only a reasonable, cost-based fee. A overstates the baseline timeline, which is 30 days, not 60. B is wrong because individuals do not need an authorization to obtain their own records. D is wrong because a standard per-page copy rate is not a cost-based fee.
Source: HIPAA Privacy Rule, 45 CFR 164.524
