SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-access-30-days

How long does a covered entity generally have to act on a patient's request for copies of their records?

30 days.

Start playing free

  1. 60 days
  2. 10 business days
  3. 30 days ✔

Why: A covered entity must act on an access request within 30 days. It may extend once, by up to 30 more days, with a written reason and a new date.

Huh, didn't know that: If the request is denied, in whole or in part, the denial must be in writing.

The dad joke
Why did the mail carrier always stay calm? Patience comes with the route.
Like this card?
Play the game

References

Answer: 30 days. A covered entity must act on an access request within 30 days. It may extend once, by up to 30 more days, with a written reason and a new date.

  1. 45 CFR 164.524 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524
    the covered entity must act on a request for access no later than 30 days after receipt of the request
    Checked 2026-10-10.
  2. 45 CFR 164.524 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524
    may extend the time for such actions by no more than 30 days
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsA patient asks for an electronic copy of records the clinic keeps electronically. What must the clinic do?Work SkillsWhat may a provider charge a patient for a copy of their own records?Work SkillsHow long does a covered entity have to act on a patient's request to amend their record?

That's stuff everyone should know.