Patient right of access requests

How do we fulfil a patient's request for their own records with the identity verified and the records delivered within the HIPAA access timeline, with the delivery recorded?

Treat the right of access as a clock with a verified requester. When a patient (or their personal representative) asks for their records, Callvu verifies their identity (the portal's authentication, or a document check for a request by letter or phone), takes the request on a secure screen (the records wanted, the date range, the format, the delivery method, a third party to send to where directed), classifies what is in the designated record set and what is excluded (psychotherapy notes, information compiled for litigation), pulls the records from the EHR in the format requested where readily producible, chases a missing identity proof or an ambiguous request, routes a denial ground or a representative's authority question to the privacy office in the Decision Desk, delivers within the timeline with the permitted fee, and records the delivery against the record. Live at Ministry of Health, under national rules outside the US.

Live at Ministry of HealthSimpleCallvu moves: chase and verify, write back

Talk to an expert Try it in the sandbox

Last updated November 7, 2026.

The problem today

The patient asked for their records in March, was told to come in and fill a form, and received a paper copy in June with a bill.

Today, without Callvu

The patient's right to their own records is the most enforced provision of the Privacy Rule in recent years: late responses, demands for in-person forms, fees above the limit, refusals to send to a third party the patient directs, and paper when the patient asked for electronic. Each is a complaint the regulator takes up, and the settlements are public.

The rule is clear: the request may be made in any channel the entity allows, identity must be verified, the records in the designated record set must be provided within 30 days (one extension of 30 with notice), in the form and format requested where readily producible, with a fee limited to the reasonable cost-based amount, including to a third party the patient designates in writing, with limited denial grounds. The process should make the timeline a clock, the format a choice, and the fee a rule.

A patient who can ask from their phone and receive within days is the rule working as written.

How it runs

From the requestto the system of record.

A patient or their personal representative requests their records through the portal, by letter, by phone or in person. Callvu opens the request and starts the clock.

Patient or personal representative: Verifies identity, specifies the records, the format and the delivery, and receives them.
Health information management: Prepares records the EHR cannot produce directly and decides exceptions with the privacy office in the Decision Desk.
Callvu: Verifies, takes the request, classifies, pulls, chases, routes, delivers and records.

Verify and take the request
The requester's identity is verified (the portal's authentication for a logged-in patient; a document check through a link for a letter or phone request; the representative's authority document for a personal representative); the request is taken on a secure screen: the records wanted (or the whole designated record set), the date range, the form and format (electronic in the format the EHR can produce, or paper), the delivery method, and a third party to send to where the patient directs in writing.
Classify and pull
The request is classified against the designated record set: what is included (the medical and billing records, the results, the images where requested), what is excluded (psychotherapy notes, information compiled for a legal proceeding), and what needs preparation (images, legacy records, records held by a business associate); the records are pulled from the EHR in the format requested where readily producible, and the delivery date is set within the timeline.
Chase and verify, and decide
A missing identity proof or an ambiguous request is chased from the requester with the specifics (without restarting the clock improperly); a denial ground (a licensed professional's determination that access would endanger life or safety, a representative's authority in question, a record not in the designated record set) goes to the privacy office in the Decision Desk with the request and only the allowed outcomes (provide, provide in part with the written denial of the rest and the review rights, or deny with the written reasons and the complaint rights).
Deliver and write back
The records are delivered in the format and channel requested within 30 days (or the extended date with the written notice of the reason and the date), the fee is limited to the permitted cost-based amount where one is charged (and the patient told it in advance), a third-party delivery is sent as directed, and the delivery is recorded against the record with the date, the method, the format and the fee.

Where it ends: The patient asked from their phone, was verified, received their records in the format they chose within the timeline with the fee limited, and the delivery is on the record. The Decision Trace shows the verification, the classification and any decision; the Audit Trace shows the request, the pulls and the delivery with time.

Runtime enforcement

What is enforcedwhile the work runs.

The regulations preloaded in Callvu Studio and the bank's own policies, applied as steps that run, not lines in a binder. A step that breaks a rule does not run, so a completed run was compliant.

Regulations

US requirements shown. Ministry of Health runs this process under national rules outside the US; Callvu loads each market's rules as policies the same way.

HIPAA Privacy Rule right of access (45 CFR 164.524): An individual has a right to access and obtain a copy of their protected health information in a designated record set (excluding psychotherapy notes and information compiled for legal proceedings); the covered entity must act within 30 days of the request, with one extension of up to 30 days on written notice of the reasons and the date; must provide the copy in the form and format requested if readily producible (including electronic copies of electronic records), or in a readable hard copy or another agreed form; may charge only a reasonable, cost-based fee for the labor of copying, the supplies and the postage; must transmit the copy to a third party the individual designates in a signed written request; and may deny only on the listed grounds, some with a right to review by a licensed professional.
The information blocking rules (45 CFR 171) and the state medical records access laws: A provider that unreasonably delays or interferes with a patient's access to electronic health information may be information blocking under the Cures Act rules; state laws may set shorter response periods and lower fee caps, which apply where stricter.
Identity verification (45 CFR 164.514(h)) and personal representatives (45 CFR 164.502(g)): The entity must verify the identity and authority of the requester before disclosure, with reasonable procedures; a personal representative with authority under state law is treated as the individual, with the minor and the deceased patient rules applied.

Company policies

The request may be made in any channel; the patient is never required to come in or use a specific form.
The clock starts at receipt and is on the case; an extension carries the written notice.
The format is the patient's choice where readily producible, and the fee is the cost-based limit told in advance.
The EHR is the system of record, and the delivery is recorded against it.

Controls

Identity and authority verification.
Secure request capture with format and third-party direction.
Designated record set classification.
EHR pulls in the requested format.
Decision Desk for denial grounds and authority questions.
Timed delivery, fee rule and delivery record.

Clocks and deadlines

Response: Within 30 days of the request.
Extension: One, up to 30 days, with written notice of the reasons and the date.
Fee notice: The permitted fee told before the delivery where one is charged.

Documents and checks

The request with the verification
The classification
The records as delivered, in the format
Any decision and written denial
The delivery record and the fee

In the Decision Trace

The verification and the authority.
The classification of the record set.
Any decision and the person.

In the Audit Trace

The request with receipt time.
The pulls.
The delivery with time, method and fee.

The handoff

Between the front doorand the back office.

The front door

The portal, a letter, a call or a visit, with a link for identity and the request details.

The back office

Health information management prepares only what the EHR cannot produce; the privacy office decides only denial grounds.

The Decision Desk

A denial ground, a representative's authority question or a record outside the designated record set goes to the privacy office in the Decision Desk with the request and only provide, provide in part with written denial, or deny with written reasons and rights.

Proof

Live at Ministry of Health.Published results only.

Each result is a published claim, with its code on agents.callvu.com, where its status, source and last verified date are kept.

The Ministry of Health hospital network runs 23 hospitals on Callvu and keeps adding more, with 3x faster procedure approvals, 78% faster patient consent and more than 1M pages of paper eliminated.

HLT-01 · Self-asserted · verified 2026-11-05

At the Ministry of Health, Callvu integrated with very old legacy systems at several hospitals, and brings ERP, CRM and EHR data into one experience.

HLT-05 · Customer-attested · verified 2026-11-05

PHI masking is tested and live.

ENF-08 · Self-asserted · verified 2026-11-02

Questions

What buyers ask next,answered plainly.

How long does the hospital have?

Thirty days from the request, with one extension of up to 30 days on written notice of the reason and the date; the clock is on the case from receipt.

Can the patient choose the format?

Yes, where readily producible, including an electronic copy of electronic records, and can direct the copy to a third party in a signed written request.

What can be charged?

Only a reasonable, cost-based fee for copying labor, supplies and postage, told to the patient in advance; state caps apply where lower.

Related processes

Release of information requests Record amendment requests Accounting of disclosures requests HIPAA authorizations Try it in the sandbox All healthcare processes

Bring this process, or the one that costs you most.

We build it against your policies and your systems, train your team and stay with you through launch. You are live in weeks.