Patient access is won or lost at the records counter

The week

On December 10, 2020, the HHS Office for Civil Rights, known as OCR, which enforces HIPAA, announced a proposed rule to modify the HIPAA Privacy Rule. Much of it was aimed at a familiar story. Anyone who has tried to get a copy of their own medical records knows it: a form to download, print, sign and fax, a phone line that rings out, a request that disappears for weeks, a bill for photocopies. For a patient switching doctors, seeking a second opinion or caring for an aging parent, that wait can delay care.

Patients have a legal right to their records under HIPAA, the federal law whose Privacy Rule governs how doctors, hospitals and health plans handle patients’ health information. Organizations bound by it are called covered entities. The right existed on paper; the experience often fell short.

The proposal had a long run-up. HHS presented it as part of its Regulatory Sprint to Coordinated Care, an effort launched in 2018 to remove regulatory barriers to care coordination. OCR had published a request for information on changing the HIPAA rules in December 2018, and the proposal drew on the responses. It arrived in the last weeks of an outgoing administration. That timing shaped its fate as much as its content did.

The proposal was published in the Federal Register on January 21, 2021, the day after the presidential inauguration. A proposed rule is a draft regulation released for public comment; it does not take effect unless finalized. The comment deadline was originally March 22, 2021. In March, OCR extended it to May 6, 2021, citing the expected level of public interest.

What the access provisions said

On patient access, the proposal went straight at the points of friction. It proposed cutting the time covered entities have to respond to a request from 30 days to 15 calendar days, with one 15-day extension in place of the existing 30-day one. It proposed a right to inspect records in person and to take notes or photographs, so a patient could simply snap a picture of a test result on their phone. Providers would not have been able to delay an inspection when the records were readily available during an appointment.

It proposed a bar on unreasonable measures that impede access. The examples were concrete: insisting on notarized requests, demanding proof of identity in person when remote verification would do, and accepting requests through only one channel, whether paper or portal. Providers would have had to post estimated fee schedules for copies, so patients would know the cost in advance. Certain kinds of access, such as in-person inspection, would have been free.

The proposal also treated records requested through secure, standards-based application programming interfaces, using an app the patient chose, as part of what a provider could readily produce. That brought apps into the core of the access right rather than leaving them as an optional extra.

The court decision it answered

The proposal responded to a January 2020 federal court decision, Ciox Health v. Azar, in the U.S. District Court for the District of Columbia. Ciox, a large release-of-information company, had challenged parts of OCR’s 2016 access guidance. The court held that the right to direct copies to a third party covered only electronic copies of records held in an electronic health record. It also held that OCR’s limits on fees for patient copies could not be extended to copies sent to third parties at the patient’s direction.

That mattered because third-party directives were how many patients actually used the right: asking a hospital to send records straight to a lawyer, an app or another provider. The proposal would have limited that right to electronic copies held in an electronic health record, the digital chart that now holds most clinical information, in line with the court’s reading. It also proposed a new way for a patient to ask one provider or health plan to request records from another on the patient’s behalf.

The rest of the package

Other provisions addressed disclosures for care coordination, meaning the sharing of information among providers and others involved in a patient’s care. The proposal would have created an exception to the “minimum necessary” standard for care coordination and case management at the individual level. It would have allowed disclosures to social services agencies and community-based organizations that support a patient’s care. It would have replaced the “professional judgment” standard for certain disclosures to family members with a “good faith” belief standard. It would also have loosened the threat-to-safety standard from “serious and imminent” to “serious and reasonably foreseeable.” Those changes were aimed largely at families of people in crisis, including during the opioid epidemic.

It also addressed the notice of privacy practices, the document that explains to patients how their information is used. The proposal would have dropped the requirement for providers to obtain a patient’s written acknowledgment that they had received it.

The setting

The proposal landed beside other access pressure. In December 2020 CMS also proposed a rule on health plan application programming interfaces and prior authorization. OCR had been announcing right of access settlements since 2019. The information blocking rules under the 21st Century Cures Act had just been pushed back, by an interim final rule published in November 2020, to begin applying in April 2021. And records teams were working through the pandemic’s first winter, often remotely and short-staffed.

It was a draft. But it described, with unusual precision, where patient access actually breaks down, and almost all of those places were within a provider’s own control.

Patients have had a right to see and obtain their health records under HIPAA for two decades. The December 2020 proposal did not create that right. It tried to make it work the way patients experience it. For health systems, that moved the subject from privacy policy to a much less visible place: the release-of-information desk, the patient portal and the vendor that often runs both.

The proposal targeted three points of friction. They are the response clock, the identity check and the delivery path. Each is operational, and each was within a provider’s control whether or not the rule was ever finalized. The three interact. A heavy identity check burns days on the clock. A slow delivery path makes a fast response meaningless. A weak identity check makes a fast delivery path dangerous. Most organizations own all three in different departments, which is part of why the experience breaks.

The sections below take the machinery first, then each friction point in turn. A single request is then followed from start to finish. The last sections cover the costs of getting it wrong, a counter that works, and the evidence a records team should be able to produce. First, the machinery most patients never see.

Behind the counter: how records requests actually work

Release of information is the health care term for the process of handling requests for copies of medical records. Requests come from patients, from other providers, from insurers, from lawyers and from government agencies. Each must be logged, checked, fulfilled from the right systems and tracked. In a large health system the volume is substantial, and in many organizations the work is done by a small team or outsourced to a specialist vendor.

Not every request is an access request

The legal category of a request decides the rules that apply to it. A patient asking for their own records is exercising the right of access. A lawyer or insurer presenting a form the patient signed is usually relying on an authorization, a different part of the Privacy Rule with different timing and fee rules. A subpoena or court order is different again. A request from another treating provider may need no patient paperwork at all, because HIPAA permits disclosures for treatment.

Release-of-information staff spend much of their day sorting requests into these categories. The sorting has consequences. The fee limits for patient access do not apply to an authorization-based request from a law firm. A patient who asks for records to be sent to their own attorney, however, may be making an access request. After the 2020 court decision, whether that request concerns electronic records in an electronic health record changes what the provider may charge. A team that misclassifies requests will either overcharge patients or miss deadlines the law treats as firm.

What counts as “the record”

The access right covers the designated record set: the medical and billing records, and other records used to make decisions about the patient. That is far wider than what a portal shows. It can include radiology images, outside records incorporated into the chart, billing statements, claims data at a health plan, and records still held in a system from a practice the organization acquired. Psychotherapy notes kept separately by a therapist are a narrow exception. So is information compiled for litigation.

A health system that does not know where its designated record set lives cannot meet any clock, long or short. The map of those systems is the first artifact a records program needs, and in many organizations nobody owns it.

Portals, APIs and identity

A patient portal is the secure website or app where patients can see test results, message their doctor and download parts of their record. It is often the fastest route to records, but it rarely shows everything. Older notes, images, billing records and documents from acquired practices may not appear there.

An application programming interface, or API, is a standard way for one piece of software to request information from another automatically. A useful analogy is a restaurant’s order window: the app passes a properly written order through the window, and the kitchen sends back exactly what was asked for, without anyone needing to come into the kitchen. APIs are how a patient’s chosen health app can pull their records directly from a hospital’s system, with the patient’s permission. Federal certification rules required certified record systems to offer a standardized API, built on the FHIR standard, by the end of 2022.

Identity proofing is the process of confirming that a person is who they claim to be when they first create an account, for example by checking identification. Later logins rely on that original check. If it was strong, everything built on it is more trustworthy. If it was weak, every later request inherits the weakness.

Who does the work

Release-of-information work is organized in roughly three ways. Some providers run it entirely in-house, inside health information management. Some use a vendor whose staff work on site or remotely inside the provider’s systems. Others use a hybrid, keeping patient requests in-house and sending legal and insurer requests to a vendor. Vendors are usually business associates under HIPAA, bound by a business associate agreement. Many are paid in part by the fees they charge requesters, which gives them their own stake in how fees are set.

With those terms in hand, the three friction points become easier to see.

The response clock

Thirty days, with a 30-day extension, had long been the outer limit for responding. Many organizations treated the limit as the target. A patient changing doctors, seeking a second opinion or managing a chronic condition experiences a month as a long wait.

Where the clock starts

Meeting a shorter clock is mostly a workflow problem. Requests arrive by mail, fax, portal message, email and in person, often to different departments. A request that waits in a clinic inbox for a week before reaching the records team has already used half of a 15-day allowance. The first control is a single intake log that stamps every request with its receipt date, whichever door it came through, much as a post room stamps incoming mail. The clock starts when the request arrives anywhere in the organization, not when it reaches the right desk.

That log has to reach the edges of the organization. Front-desk staff at outpatient clinics, call center agents, the patient relations office and even the privacy office receive records requests. Each needs a simple rule: log it the same day, route it, and give the patient a reference. A shared mailbox and a one-page form are enough for a small practice. A large system usually builds the intake into its release-of-information software or ticketing system, with a fax-to-queue integration and a portal form that writes straight to the queue.

The long tail

The second control is knowing where the slow requests come from. Organizations that measured their response times usually found that most requests were fast and a long tail was slow. The tail tends to involve records outside the main electronic health record. Typical sources are imaging archives, billing systems, legacy systems from acquired practices and outside storage vendors. A legacy system is an older system that is still needed but no longer central, often kept running only because it holds historical data. Retrieving from it may require a specialist login, a manual export or a call to a former vendor.

Fixing retrieval from those sources does more for the average than pushing the records team to work faster. If nine requests in ten take a few days and the tenth takes six weeks because it needs scans from an archive in another building, the solution is the archive, not the team.

The fixes differ by source. Imaging can often be delivered through a patient-facing image sharing service rather than discs. Legacy systems from acquisitions can be consolidated into a read-only archive with a documented export procedure, so retrieval does not depend on one person. Paper held by an offsite storage company can be covered by a contract term on retrieval time. Each fix has a cost, and the slow-tail report tells leaders which one buys the most.

Using the extension well

HIPAA allows one extension, but only with a written notice to the patient, within the original period, stating the reason and the date by which the provider will respond. Many teams used the extension as a routine buffer. A shorter clock with a shorter extension makes that habit untenable. A better practice is to treat every extension as an exception that someone reviews, with the reason recorded. Extensions then become data: a cluster of them pointing at one archive is a funding case.

Partial fulfillment helps too. A provider can usually send what is ready, such as the current chart, and tell the patient what is still being gathered. Patients care most about the documents their next clinician needs. Sending those first turns a long wait into a short one for the purpose that matters.

How the clock differs by organization

The clock bites differently by type of covered entity. A large health system has volume, many entry points and many legacy systems, so intake and retrieval dominate. A small physician practice has few systems but often one person handling records alongside other duties, so absence and backlog dominate. A health plan holds claims and enrollment data rather than clinical notes, and its requests often come through member services. An ambulatory surgery network or multi-site specialty group may hold records across several practice management systems from acquisitions. The same 15-day target needs a different fix in each.

Enforcement pressure did not wait for the rule. OCR had launched a right of access enforcement initiative in 2019 and was already announcing settlements with providers that took too long. Many targets were small and mid-sized practices, which showed that size was no shelter. A slow records counter was already a regulatory exposure, proposal or no proposal.

The identity check

HIPAA requires reasonable steps to verify a requester’s identity before disclosing records. Some organizations had turned that into notarized forms, in-person visits or demands for several documents. Those requirements fell hardest on patients with limited mobility, time or paperwork: an older patient without a car, a shift worker who cannot visit during office hours, a person whose documents were lost in a move.

The proposal would have barred unreasonable verification. That exposes a real trade-off. Too little checking invites fraud and disclosure to the wrong person, including in domestic violence situations or custody disputes. Too much checking blocks legitimate patients and generates complaints. One harms a patient by exposing their information; the other harms a patient by denying it to them.

A proportionate standard

The workable answer is proportionate verification, set out in a written standard so staff are not improvising:

• Authenticated portal requests rely on the identity proofing done at enrollment and need no further documents.
• Phone and paper requests accept reasonable proof, such as matching demographic details and a copy of identification, without notarization.
• Higher-risk cases, such as personal representatives, minors, flagged safety concerns or a change of delivery address, get stronger checks and a named escalation contact.

The standard should say what staff do when a check fails. A mismatch on one detail is usually a data quality problem, such as a married name or an old address. A clear fallback, such as a call-back to the phone number on file, resolves most of them without a visit. Without one, staff either refuse or wave the request through, and both outcomes create risk.

Enrollment is where assurance is won

This ties access to the quality of portal enrollment. An account created with weak proofing provides weak assurance for every later request. One created with good proofing makes later requests both simpler and safer. Identity work at the front desk pays off months later at the records counter. In practical terms, the receptionist who carefully checks identification when helping a patient sign up for the portal is doing records-access work, even if nobody describes it that way.

Many portals let patients self-enroll online using an activation code from a visit summary, or by answering knowledge-based questions drawn from credit records. Those questions are weak against a determined fraudster, because much of the underlying data has leaked in past breaches. NIST’s digital identity guidelines describe stronger levels of identity assurance, which involve checking a government document and binding it to the person. A provider does not need the highest level for every patient. It does need to know what level its enrollment actually achieves, and to set its access rules to match.

Personal representatives and proxies

The hardest identity questions involve people acting for someone else. A parent requesting a child’s records, an adult child holding a health care power of attorney, a guardian or an executor of an estate are personal representatives under HIPAA when state law gives them authority. HIPAA largely defers to state law here, and state rules on minors’ consent to sensitive care vary widely.

Portals handle this through proxy access, which often has its own rules. Teenagers’ records are a common difficulty: many systems restrict parental proxy access for adolescents to protect confidential care. Those rules belong in the written standard, reviewed by counsel for each state the organization serves. A records team should not be deciding them case by case at the counter.

The case for caution

The strongest objection to lighter identity checks is fraud. Medical identity theft is real, and records hold exactly the details a fraudster wants: dates of birth, insurance numbers and sometimes Social Security numbers. A disclosure to the wrong person can be a breach under HIPAA’s Breach Notification Rule, with notice to the patient and to HHS. Records sent to an abuser who claimed to be the patient can do grave harm.

That objection supports proportionality, not heavy uniform checks. Notarization does little against a determined impostor, since it verifies a signature at a moment rather than the requester’s right to the records. The controls that work are targeted: extra checks when the delivery address changes, when records go to a new email, when a safety flag is on the chart, or when a proxy relationship is new. Concentrating effort there protects vulnerable patients better than burdening every request.

The delivery path

The third friction point is how records reach the patient, and at what cost. Patients increasingly wanted electronic copies, sent to themselves, to an app or to another provider. The proposal would have strengthened directing electronic copies to third parties and required providers to post estimated fees.

Form and format

HIPAA already required providers to supply records in the form and format the patient requests, if it is readily producible. For records held electronically, that means an electronic copy when the patient asks for one. OCR guidance had also said that a patient who asks to receive records by ordinary, unencrypted email may have them sent that way, after being told of the risk. Many organizations nonetheless defaulted to paper or discs because their own processes were built around them.

Electronic delivery by default changes the work. Secure download links, portal delivery and direct messaging between providers replace printing and postage. The trade-offs are real: secure links expire and confuse some patients, large image files strain email, and older patients may still prefer paper. A default is not a mandate. Patients who want paper still get it.

Apps and the edge of HIPAA

Records sent to a consumer app the patient chose usually leave HIPAA’s protection. Most such apps are neither covered entities nor business associates. The Federal Trade Commission’s Health Breach Notification Rule and state privacy laws may apply to them instead. Providers often worried that releasing records to an app would make them liable for what the app did next.

OCR had addressed that concern in guidance: once a provider sends records to an app at the patient’s direction, it is generally not responsible for the app’s later handling. Providers may tell patients about the risks of an app. They should not use those concerns as a reason to refuse or delay. That distinction, between educating and obstructing, is where many access policies needed rewriting.

Where information blocking comes in

Delivery runs into a second set of rules. The information blocking provisions of the 21st Century Cures Act were due to begin applying in April 2021. They restrict practices likely to interfere with access to electronic health information, including by patients. Information blocking, then, means putting unnecessary obstacles between people and electronic health information they are entitled to, whether through technology, fees or process. The rules come with defined exceptions, such as preventing harm, protecting privacy and security, and genuine infeasibility.

A provider can therefore face two questions about the same request: whether it met HIPAA’s access standard, and whether its process amounted to information blocking. The portal, the APIs offered to apps and the release-of-information process have to give consistent answers. Consider a patient told by the portal that a document is unavailable, by the app that it is available, and by the records desk that it will take a month. That patient is dealing with three different organizations under one name. Which regime governs a particular type of request is a question for the health system’s lawyers.

The two regimes measure different things. HIPAA sets an outer time limit and fee rules. Information blocking asks whether a practice is likely to interfere with access, which can catch delays well inside 30 days if they serve no legitimate purpose. A provider that releases test results to the portal only after a waiting period, for example, may need to show that the delay fits an exception. Many providers revisited their result-release delays for this reason around April 2021.

Fees and the vendor

Fees deserve their own review. HIPAA limits what a provider may charge a patient for access to a reasonable, cost-based fee for labor, supplies and postage. Retrieval and search fees are not allowed for patient access. Many health systems use a release-of-information vendor that charges for copies under its own schedule. The provider remains responsible for the patient’s experience and for what the patient is charged.

A posted fee schedule, checked against what the vendor actually bills, removes a frequent source of complaints. Contracts with these vendors should also set response-time targets that match the provider’s own obligations, with reporting the provider can audit. The contract should also say which party classifies requests as access or authorization, since that choice drives the fee. When the vendor makes the call and also keeps the fee, the provider should sample the classifications.

One request, followed from start to finish

The three friction points are easiest to see by following a single request through a typical organization.

Suppose a patient at a regional health system is moving to another state and wants her records sent to her new cardiologist. She does not use the portal, so she writes a letter and hands it to the receptionist at her local clinic. The receptionist puts it in a tray for the practice manager, who is on leave that week. Eight days pass before the letter is scanned and emailed to the central records team. On paper, the records team received the request on day eight. Legally, the organization received it on day one. That gap is the response-clock problem in miniature.

The records team now needs to confirm she is who she says she is. Her letter includes her date of birth and address, but the team’s old policy requires a notarized form for any request to send records to a third party. They write back asking for one. She is packing up a house and takes another ten days to find a notary. Here the identity check is the problem: a reasonable goal, protecting her information, pursued with a requirement heavier than the risk called for.

Finally, the team gathers the records. Most come quickly from the electronic health record. Her echocardiogram images, however, are stored in an imaging archive from a cardiology practice the system acquired years ago, and only one person knows how to export them. The images arrive on a disc two weeks later, by mail, with an invoice from the records vendor that nobody at the health system has reviewed. The delivery path has failed three ways: slow retrieval from a system outside the main record, a physical medium where an electronic one would do, and a fee the provider did not check.

No single person in this story did anything wrong. Each followed the process in front of them. The process itself was the problem, and every part of it was within the health system’s power to change.

The same request, redesigned

Run the same request through a redesigned process. The receptionist logs the letter in the intake queue the day she receives it and gives the patient a reference number. The records team sees it the next morning, stamped with the true receipt date. The identity standard treats a request to send records to a named, verifiable cardiology practice as moderate risk. Staff confirm her details with a call to the number on file and accept a copy of her driver’s license by secure upload.

The records team sends the clinical chart electronically to the new practice within days, because that is what the cardiologist needs first. The archive behind the echocardiogram images has been migrated to a read-only store with a written export procedure, so any trained team member can retrieve them. The images go through an image-sharing link. There is no invoice, because the system does not charge for electronic copies sent at a patient’s direction to a treating provider. The patient arrives at her first appointment with her records already there.

Nothing in the redesign needed new law. It needed an intake rule, a written identity standard, a migrated archive and a contract term.

What a slow records counter costs

Records access can look like a back-office function. It touches several things a chief executive, board or general counsel cares about directly.

Regulatory risk. OCR’s enforcement initiative made slow access a source of settlements and public announcements. Because many targets were smaller providers, no organization could assume it was too small to notice. Most investigations began with a single patient complaint. Corrective action plans that came with settlements often required revised policies, training and reporting to OCR for a period, which can cost more in staff time than the payment itself.

Patient trust and experience. Patients judge an organization by the moments when they need something from it. A records request is often made at a stressful time, such as a new diagnosis or a transfer of care. Handling it well builds loyalty; handling it badly creates complaints, social media posts and lost patients.

Clinical continuity. When records arrive late at the next provider, tests may be repeated and decisions delayed. That costs money and, at worst, affects care. The patient changing cardiologists who arrives without her echocardiogram may simply have it done again.

Vendor accountability. If a vendor runs the records counter, the provider still carries the obligation. A contract without matching response-time targets and audit rights leaves the provider responsible for performance it cannot see.

Staff. Staffing ties the three points together. Release-of-information teams are often small and measured on volume. Shorter clocks, more electronic delivery and more judgment about identity call for training and clear escalation paths for unusual requests. Teams with those paths stop improvising under time pressure. They also produce better data on where requests stall, which is what leaders need to keep improving.

The counter-argument on cost

A finance leader can fairly object that OCR’s settlements in these cases have mostly been modest in dollar terms. Against that, the investment in archive migration, intake software and extra staff looks large. On a narrow penalty calculation, slow access can seem cheaper than fast access.

That calculation misses most of the cost. The records counter is also where a provider’s exposure under the information blocking rules is decided, and those rules later gained financial teeth for providers. The same archives that slow access also slow litigation holds, audits and breach investigations. And repeat tests, lost referrals and complaints rarely show up on the records department’s budget, though the organization pays for them. The case for fixing the counter rests on those, with the penalty as the smallest item.

A records counter that works

Take a mid-sized health system whose patient-access team keeps one intake log for every request, whether it arrives by portal, fax, mail, email or at a clinic desk. Each entry carries the date it first arrived anywhere in the organization. Every month the team reports its slowest tenth of requests and the systems they came from. When those reports show that most of the slow cases involve an imaging archive inherited from an acquired practice, the system spends its effort on retrieval from that archive rather than on overtime.

The same system has a one-page identity standard. Patients signed in to the portal can request and download records without further paperwork. Phone and mail requests need matching details and a copy of identification, but no notarization. Requests from personal representatives, requests involving minors, records flagged for safety concerns, and requests to send records to a new address go to a named escalation contact. Electronic delivery is the default. Fees are posted, and each quarter someone compares the posted schedule with what the vendor actually billed. The vendor contract sets response-time targets that match the system’s own obligations and requires reports the system can audit.

Owners and evidence

Ownership is usually the gap. The privacy officer owns the policy, health information management owns the process, IT owns the portal and interfaces, and procurement owns the vendor contract. Somebody has to own the outcome: the time it takes a patient to get what they asked for. Organizations that name a single executive owner for patient access, often in health information management or patient experience, tend to close gaps faster.

The evidence an investigator would ask for is predictable. It includes the written access policy and identity standard, training records, and the intake log for the request in question. It also includes correspondence with the patient, the fee charged and how it was calculated, and any vendor’s business associate agreement. A team that can produce those in a day is in a strong position. One that has to reconstruct them from email is not.

How it differs by type of organization

The same design adapts by setting. A health plan’s access requests concern claims, enrollment and payment records, and its intake runs through member services. Its identity checks can lean on member portal credentials. An ambulatory network with many acquired practices will find its long tail in practice management systems and should prioritize archive consolidation. A behavioral health provider must also apply 42 CFR Part 2 to substance use disorder treatment records, whose rules were partly aligned with HIPAA by a 2024 final rule, with compliance required from February 2026. A small practice may need nothing more than a shared log, a written standard and a vendor contract it has actually read.

The organizations that struggle tend to get the same things wrong:

• Treating the legal limit as the goal. A process designed to finish on day 29 will regularly finish on day 31.
• Starting the clock late. Counting from when the records team sees a request, rather than when the organization received it, hides real delays.
• Blaming the team for system problems. Pushing staff harder rarely fixes slow retrieval from archives and legacy systems.
• One-size-fits-all identity checks. Either everyone faces heavy paperwork, which blocks legitimate patients, or nobody faces careful checks, which exposes vulnerable ones.
• Outsourcing and forgetting. Handing the counter to a vendor without matching targets, fee audits and reporting leaves the provider accountable for something it cannot see.
• Inconsistent channels. A portal, an app connection and a records desk that give different answers to the same request invite complaints under both HIPAA and the information blocking rules.

What the records team should be able to show

A board or audit committee does not need to understand release-of-information software to hold this function to account. It needs a small set of measures, reported regularly, and a few questions that expose whether the measures are honest. The questions below are the ones we would put to a records team today.

1. From the moment a records request reaches any part of our organization, how many days does it take us to respond, on average and for the slowest tenth?
2. Which systems are behind our slowest responses, and what would it take to speed up retrieval from them?
3. What exactly do we ask patients to provide to prove who they are, and is it written down and proportionate to the risk?
4. What do patients pay for copies, is that schedule posted, and does it match what our vendor actually bills?
5. If the same patient asked for the same record through the portal, an app and the records desk, would they get the same answer?

Behind each answer should be a report, not an anecdote. Response times should come from the intake log. Slow systems should come from the slow-tail analysis. The identity standard should be a dated document with an owner. Fees should be reconciled against vendor invoices. Channel consistency can be tested directly, by having staff submit the same request through each channel and comparing the results.

Every one of these questions can be answered without a final rule. December 2020 made that clear: the places where patient access succeeds or fails were already in plain view, and the fixes were already in providers’ hands.

With hindsight

The December 2020 proposal was not finalized under the following administration. It stayed on HHS’s regulatory agenda year after year without reaching a final rule. In January 2026 HHS held a tribal consultation on it, a formal process for consulting tribal governments on federal actions that affect them, and OCR’s mid-2026 regulatory agenda slated a final rule for August 2026. That date passed, and as of this writing we have not seen a final rule published. A regulatory agenda is a statement of intended timing, not a commitment, and target dates often move. Even once published, a final rule would normally give covered entities months before compliance is required.

So the 15-day clock, the right to photograph records and the formal bar on notarization have still not become law. The 30-day limit, with one 30-day extension, remains the rule. The proposal’s most lasting effect was descriptive: it named the friction points, and enforcement and other rules kept pressing on them.

Pressure on access came from elsewhere. OCR’s right of access initiative kept producing enforcement actions through every change of administration. In March 2025 OCR announced a civil money penalty against Oregon Health & Science University, a public academic health center, under the initiative. A settlement with Concentra, an occupational health provider, followed in late 2025. In October 2026 OCR announced its 56th enforcement action under the initiative, a settlement with a dental practice. Many of the targets have been smaller providers. That steady run of enforcement was a clearer signal than any proposed rule: slow or obstructed access was already something regulators acted on.

The information blocking rules began applying in April 2021. Their scope widened in October 2022 to cover electronic health information broadly, rather than a defined core data set. In 2024 HHS finalized disincentives for providers found to have engaged in information blocking, tied to Medicare programs. A hospital referred by the HHS Office of Inspector General can lose part of its annual payment update. Clinicians can lose credit in a quality payment program. Participants in the Medicare Shared Savings Program can be barred from it for at least a year. Disincentives gave the rules practical consequences for providers. In September 2025 HHS announced it would step up enforcement of information blocking, naming the Inspector General and the national coordinator’s office as the leads.

The payer side moved too. CMS withdrew its December 2020 proposal and issued a new one in December 2022. The rule it finalized in January 2024 requires many health plans in federal programs to expand their patient access APIs. They must also build provider access, payer-to-payer and prior authorization APIs. In July 2025 CMS launched a health technology ecosystem initiative with industry pledges, in which apps that retrieve records for patients were to use verified digital identity credentials. That put identity assurance, the second friction point, at the front of federal access policy.

Patient access through portals and apps became an expectation. Patients who could check their bank balance or track a parcel on their phone increasingly expected the same from their health records, and many providers moved in that direction. The release-of-information desk did not disappear, though. Images, older records, legal requests and records for patients without portal accounts still run through it.

What held up was the diagnosis. What did not was the assumption, common in 2020, that a final rule would arrive soon and force the issue. The organizations that fared best had built a single intake log, a written proportionate identity standard and electronic delivery by default, none of which required waiting for the 2020 proposal. Regulation often describes a problem years before it settles on a rule. The organizations that read the description and act on it, rather than waiting for the final text, end up ahead on compliance, on cost and on the trust of the people they serve.