The HIPAA right of access
- Timing. "The covered entity must act on a request for access no later than 30 days after receipt of the request."
- Format. An electronic copy must be provided "in the electronic form and format requested by the individual, if it is readily producible in such form and format."
- Sending to a third party, such as your app. If the individual directs the copy to another person, "the covered entity must provide the copy to the person designated by the individual." The request "must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy."
- Fees. Limited to "a reasonable, cost-based fee" covering listed costs such as copying labor and supplies.
Source: 45 CFR 164.524. This page is a summary, not legal advice; check current HHS OCR guidance before relying on it.
Certified EHR APIs
Certified health IT must support a standardized API for patient and population services under 45 CFR 170.315(g)(10). App registration documentation must be "available via a publicly accessible hyperlink without any preconditions or additional steps."
Source: 45 CFR 170.315(g)(10).
Payer Patient Access APIs
CMS's Interoperability and Patient Access final rule (CMS-9115-F) "includes policies which require or encourage payers to implement application programming interfaces (APIs)," and adopted the content and vocabulary standards from ONC's 21st Century Cures Act final rule. Under the later prior authorization rule (CMS-0057-F), payers must meet certain provisions "by January 1, 2026," and "have until primarily January 1, 2027, to meet the application programming interface (API) requirements." Medicare Advantage organizations must also report "aggregated, de-identified" Patient Access API usage to CMS, beginning in 2026.
Sources: CMS-9115-F; CMS-0057-F; 42 CFR 422.119.
Information blocking
"Information blocking means a practice that except as required by law or covered by an exception ... is likely to interfere with access, exchange, or use of electronic health information." The knowledge standard differs by actor; for health IT developers and HINs/HIEs it is "know, or should know." Exceptions start at § 171.200, such as the preventing harm exception. ASTP/ONC offers a claim form "to report alleged information blocking practices."
Sources: 45 CFR 171.103; ASTP/ONC information blocking page.
TEFCA and Individual Access Services
"In December 2023, TEFCA surpassed a major milestone when the first Qualified Health Information Networks® (QHINs™) were designated." The RCE's current exchange purposes are treatment, payment, health care operations, public health, government benefits determination and Individual Access Services (IAS). Read the RCE's IAS documents for the requirements on IAS providers.
Sources: ASTP/ONC TEFCA overview; Sequoia Project RCE, Exchange Purposes.
What it means for startups
Our reading (editorial, not from a source): pick the route that matches your data needs. Provider records can come through certified EHR APIs or a written HIPAA access request, claims through payer Patient Access APIs, and network-wide records through TEFCA IAS. Each route has its own onboarding and identity requirements.
Related resources
Frequently asked questions
How long does a provider have to answer a HIPAA access request?
The covered entity must act on a request no later than 30 days after receiving it, under 45 CFR 164.524.
Can a patient send their records to an app?
Yes. If the individual directs the copy to a designated person in a signed, written request, the covered entity must send it there.
When do the CMS-0057-F API requirements apply?
CMS says impacted payers have until primarily January 1, 2027 to meet the rule's API requirements, with certain other provisions due January 1, 2026.
Scope it in 30 minutes
Book a scoping call and we'll name the smallest engagement that moves you forward. Most teams start with the fixed-scope Initial Audit.
Book a 30-min scoping callPrefer to write? Send a short note.