How to respond to a medical records request by fax

A HIPAA-covered practice has 30 calendar days from the day a patient's records request arrives to act on it, and one extension of up to 30 more days if the patient gets a written reason and a new date inside the first 30 (45 CFR 164.524(b)(2)). A request faxed to your number starts that clock the day it lands in the inbox.

Attorneys and other offices ask under different rules, sorted below. In Fax Pigeon the faxed request arrives in the shared inbox with an AI summary, you assign it to whoever handles records, and the delivery certificate on your reply dates the response.

How long do you have to respond to a records request?

The 30 days are calendar days, counted from the day the practice receives the request. HHS says the clock keeps running when the records are old, archived or hard to reach, and that days spent agreeing on a format come out of the 30.

An extension has two conditions. The practice sends the patient a written statement of the reasons for the delay and the date it will finish, and it sends that statement inside the first 30 days. A request gets one extension, so the longest window is 60 days.

A refusal runs on the same clock. The written denial gives the reason, the patient's review rights where they apply and how to complain to the practice or to HHS (45 CFR 164.524(d)(2)). The grounds are narrow, and an unpaid bill is not one of them.

Who is asking, and what do they have to show?

HIPAA requires a practice to verify the identity and authority of a person who asks for records when the practice does not already know them (45 CFR 164.514(h)(1)).

A valid authorization names the records, the sender, the recipient, the purpose and an expiration, and carries the patient's signature and date (45 CFR 164.508(c)(1)). A letter from an attorney is not an authorization. A court order or subpoena runs under 45 CFR 164.512(e) instead, and an order covers only what it expressly authorizes.

The electronic-record limit and the missing fee cap in the second row come from HHS's notice on the 2020 Ciox Health v. Azar decision. HHS also says a practice may accept a faxed copy of a signed request, may not require an in-person trip to make one and may not require a reason.

What can you charge for the copy?

For a patient's own copy, HIPAA allows a reasonable, cost-based fee that covers four things: labor to copy the records, supplies for a paper copy or portable media, postage when the patient asks for mail, and the cost of a summary or explanation the patient agreed to in advance (45 CFR 164.524(c)(4)). HHS reads labor narrowly. It leaves out the time to review the request, search for and pull the records, and verify identity, and it bars those costs even where state law allows them. HHS adds that practices should give patients their copies free of charge.

State law can be stricter. HHS's example is a state that requires one free copy, which HIPAA does not override (45 CFR 160.202 and 160.203).

What form should the records take?

The patient can ask for the form and format they want, and the practice provides it when it is readily producible. Otherwise the practice gives a readable hard copy or a format both sides agree on (45 CFR 164.524(c)(2)).

The right covers the designated record set: the medical and billing records, plus any records used to make decisions about the patient (45 CFR 164.501). Minimum necessary, the rule that limits a disclosure to what its purpose needs, does not apply to disclosures to the patient, under an authorization or to a provider for treatment (45 CFR 164.502(b)(2)).

How does a faxed request move through Fax Pigeon?

1. It arrives. A request faxed to the practice's own number lands in the shared inbox with an AI summary. Email notifications, per fax or daily, tell the practice it came in. The arrival date is day one.
2. It gets an owner. The inbox has roles and assignment, so the fax goes to whoever handles records. HIPAA requires a practice to document the titles of the people or offices that process access requests (45 CFR 164.524(e)(2)), and that is who gets the assignment. Adding the person costs nothing, because every plan includes unlimited people.
3. It gets checked. Match the name and date of birth to the chart, and check the signature on any authorization.
4. The copy goes out. Send it from the browser or from your email. When faxing another office, HHS names confirming that the number is the right one as an example of a reasonable safeguard (45 CFR 164.530(c)).
5. The certificate is filed. Every delivered fax gets a delivery certificate that carries the date and time. An extension notice and a written denial are communications the rule requires in writing, so the practice keeps a copy for six years (45 CFR 164.530(j)). A notice faxed inside the 30 days carries the certificate's date too.

A fax service that stores your patients' records is a business associate, and 45 CFR 164.502(e) requires a written agreement with it. Every Fax Pigeon plan includes a signed Business Associate Agreement (BAA), executed at signup, from $4.99 a month billed annually for 200 pages.

What about lab results and psychotherapy notes?

A laboratory can hand a patient the completed test report directly. 42 CFR 493.1291(l) lets a CLIA laboratory provide it on the patient's request, and HHS's 2014 final rule removed the HIPAA exception to a patient's right of access for results a CLIA laboratory holds. Patients can still get their reports from their doctors, so a request to you for a report in your chart runs on the same 30 days.

Psychotherapy notes kept apart from the chart sit outside the right of access (45 CFR 164.524(a)(1)(i)). Disclosing them to anyone else takes the patient's written authorization, with listed exceptions (164.508(a)(2)), and the definition at 164.501 leaves out clinical test results and summaries of diagnosis, treatment plan, symptoms, prognosis and progress to date. The therapist's side of releases is in HIPAA compliant fax for therapists.

* Fax Pigeon prices and plan terms as of October 12, 2026.