This document is a HIPAA-enforced form that requires any US hospital or doctor's office to release medical records.
- All US covered entities are required to disclose the requested PHI.
- Covered entities must act on a patient access request within 30 days of receiving it.
- Covered entities may only charge reasonable, cost-based fees for patient access requests.
The US Department of Health & Human Services specifies that a Patient Access Request must "be in writing, signed by the individual, and clearly identify the designated person and where to send the PHI." Source: 45 CFR § 164.524 (c)(3)(ii).