Sign Up
Login
Try for Free
Login
A records request and chart copy packet is the set of documents a mental health practice produces when a client asks to inspect or copy their record: a cover letter, an itemized fee notice, a denial letter when one applies, and an internal log. US practices must act within 30 calendar days under 45 CFR 164.524. A typical packet runs 300 to 700 words.
Privacy officers, records and HIM staff, practice managers; a licensed clinician only for an endangerment-based denial
The client or their personal representative, any third party they direct records to, OCR investigators, your own compliance log
300 to 700 words across the packet · 20 to 40 minutes by hand (clinical team estimate)
Administrative response packet (compare: release of information authorization, record amendment response, subpoena response)
Whenever a client asks to inspect or copy their record; the US response clock is 30 calendar days from receipt
Timeline, fee cap, denial mechanics, and documentation are law (45 CFR 164.524); the cover letter format and clinician signature are convention
A records request and chart copy packet is the set of documents a practice generates when a client asks to inspect or obtain a copy of their own health record: a cover or response letter, a cost-based fee notice, a denial or partial-denial letter where one applies, and an internal log entry proving what happened and when. No standard-setting body invented it. The packet crystallized around the HIPAA Privacy Rule, in effect for most covered entities since April 14, 2003, and it is the operational output of the right of access at 45 CFR 164.524, which reaches everything in the "designated record set" defined at 45 CFR 164.501. Clinicians, HIM staff, and payers also call it an ROI response packet, chart copy, records release packet, access request response, or right-of-access response.
The load-bearing distinction is between an access request and an authorization-based disclosure, because confusing the two is the most common and most expensive error in this corner of practice administration. When a client exercises their own right, or directs a copy to a third party in a signed writing, the 30-calendar-day clock and the reasonable, cost-based fee limit apply. When a third party wants records for its own purposes under a signed release of information authorization, neither the access clock nor the fee cap governs, and since the January 23, 2020 Ciox Health v. Azar ruling the fee limit also no longer extends to third-party directives in non-electronic formats. One more boundary saves grief: psychotherapy notes sit outside the access right only when they are kept separate from the chart. Commingle them with progress notes and they are part of the accessible record, with their own authorization rules for anything beyond.
Any practice that holds records receives access requests: solo therapists, group practices, community clinics, hospital HIM departments, and training clinics where requests route through a supervisor. Processing is administrative by design: HIPAA lets records staff or a privacy officer handle a routine response without a clinician signature, and a licensed clinician enters only when a denial rests on professional judgment, such as likely endangerment. Reach for this packet when the client themselves is asking, when a lawyer holds a client-signed directive naming where the copy goes, and for the portal-era request that arrives as an email. When a payer, employer, or another provider wants records for its own use, that is a disclosure under a release of information, not an access response, and different fee and timing rules apply.
Request intake and the log entry. Date-stamp the request the moment it arrives, whoever receives it: the 30 calendar days run from receipt, even when the chart lives with a business associate and even while a permitted fee is unpaid. Verify identity by a reasonable method matched to how the request arrived, then open the log entry: date received, requester, records sought, format requested, due date. Pitfall: parking the clock behind a ritual. Requiring your own form, an office visit, or notarized ID before you count day one is exactly the barrier OCR's access cases punish; you may require a written request, but the received date never moves.
Scope: the designated record set. Everything used to make decisions about the client is requestable: progress notes, medication records, test results, treatment plans, discharge summaries, and the billing record. Two carve-outs only: psychotherapy notes kept separate from the chart, and information compiled in anticipation of litigation. Pitfall: treating "therapy notes" as a magic phrase. The exclusion follows storage, not labels; process notes filed in the progress-note stream are part of the accessible record.
The cover or response letter. State the date the request arrived, the date of this response, what is enclosed, and the format provided. Provide the copy in the form and format requested whenever it is readily producible; if you used the one 30-day extension, the written notice with reasons and an expected date must have gone out inside the first 30 days. Pitfall: substituting the format you prefer. Refusing to send records by email when that is what the client asked for was the most common failure in the Ciitizen access reviews, and a summary may replace a copy only when the client agreed in advance, fee included.
The fee notice. For a client's own access, a reasonable, cost-based fee only, itemized as labor for copying, supplies, postage when mailed, and a summary the client agreed to, with an estimate up front; a flat $6.50 is a recognized option for electronic copies. Prepayment may be requested, and the clock still runs. Pitfall: importing state per-page schedules. Those govern other disclosures, not access, per-page math has no place in an electronic copy pulled from an EHR, and retrieval, search, and system costs are never chargeable.
The denial or partial-denial letter. Deny narrowly, in plain language, and name the ground. An endangerment denial must rest on a licensed professional's judgment that access is reasonably likely to endanger someone's life or physical safety, and the letter must offer review by a different licensed professional who took no part in the original decision, plus how to complain to the practice and to OCR. Pitfall: the blanket "mental health records" denial. No such ground exists; expected distress does not qualify, and the unreviewable grounds are a short, specific list.
The outcome entry and retained documentation. Close the loop in the log: action date, format provided, fee charged, outcome, any extension. Keep the packet documentation six years under 45 CFR 164.530(j), alongside the standing record of your designated record sets and the titles responsible for requests that 164.524(e) requires. Pitfall: a response with no log. In an OCR complaint the log entry is the only evidence that the action date beat day 30; without it a timely response is unprovable.
RECORDS REQUEST AND CHART COPY RESPONSE PACKET Four parts: log entry, cover letter, fee notice, denial letter if a ground applies. US clock: 30 calendar days from receipt. REQUEST LOG ENTRY Date received: ____________ Received by: ______________________ Requester: [ ] client [ ] personal representative [ ] third party directed in a signed writing (attach it) Identity verified by (reasonable, no barriers): ________________ Records requested / date range: ________________________________ Format requested: [ ] electronic [ ] paper [ ] inspection Response due (30 calendar days): _______________________________ Extension: [ ] none [ ] notice sent ________ new due _________ COVER LETTER (send with the copies) Request received on: ____________ This response sent: _________ What is enclosed and the format provided: ______________________ ________________________________________________________________ Items withheld and the plain-language ground, if any: __________ Psychotherapy notes are kept separate from the chart and are not part of the record set released. Contact for questions or complaints (practice and OCR): ________ FEE NOTICE (client access: cost-based only) Labor to copy: $_____ Supplies: $_____ Postage: $_____ Summary, agreed in advance (optional): $_____ Total: $_____ [ ] Estimate given in advance [ ] Prepayment requested Never charge retrieval, search, or system costs for access. DENIAL / PARTIAL DENIAL (only when a ground applies) Ground, in plain language: _____________________________________ [ ] Unreviewable ground [ ] Reviewable: endangerment judgment by a licensed professional: ____________________________________ Review offered by a different licensed professional: ___________ How to complain to the practice and to OCR: ____________________ OUTCOME Completed on: ___________ Format: ___________ Fee: $_________ Logged by: _____________________________________________________ Keep this documentation 6 years (45 CFR 164.530(j)).
Free to use and share, no signup. The PDF includes a one-page cheat sheet with section-by-section pitfalls and a pre-sign checklist; the DOCX is the blank template, ready to adapt.
Scenario: an adult client asks by portal message for a complete electronic copy of her chart; a two-clinician private practice responds in 11 days at no charge. All details are fictional.
Records request and chart copy packet. Alder Point Counseling LLC · Client: R.V. · Request received: 07/06/2026 · Response sent: 07/17/2026
Log entry (opened 07/06/2026): Portal message from R.V. requesting a complete copy of her record, January 2024 to present, electronic format. Received by C. Marsh, office manager. Requester: the client herself. Identity verified by portal credentials and date of birth on file; no additional ID required. Response due 08/05/2026, 30 calendar days from receipt. No extension used. Routed to the privacy officer the same day.
Cover letter (sent 07/17/2026 by secure portal): Dear R.V.: We received your records request on July 6, 2026. Enclosed is a complete electronic copy of your designated record set from January 5, 2024 through July 15, 2026, provided as a searchable PDF through the secure portal, the format you requested. It includes progress notes, your treatment plan and reviews, medication and care coordination entries, test and screening results, and billing records. Psychotherapy notes are kept separate from your chart and are not part of the record set; nothing else has been withheld. If a file does not open, or you would also like a paper copy, contact our privacy officer, D. Okafor, at the practice number. You may raise concerns with us or with the HHS Office for Civil Rights; asking never affects your care.
Fee notice: Electronic copy exported from the EHR: no copying labor beyond the export, no supplies, no postage. Fee charged: $0.00. Practice policy: cost-based fees only, itemized and estimated in advance; retrieval and search are never charged.
Outcome (logged 07/17/2026): Completed on day 11 of 30. Format: searchable PDF by portal, as requested. Fee: $0.00. Items withheld: none beyond separately kept psychotherapy notes. Logged by C. Marsh; documentation retained six years per 45 CFR 164.530(j).
This sample is fictional and for educational purposes. It does not describe a real client or practice.
Writing these after every session? BastionGPT drafts complete notes from bullets, dictation, or a transcript.
Generate a note from bulletsThis packet is a live enforcement target, not paperwork theater. OCR's Right of Access Initiative, running since 2019, reached its 54th enforcement action in December 2025, and small behavioral health practices sit on the settlement list by name: Patricia King MD & Associates at $3,500, Wise Psychiatry at $10,000, Riverside Psychiatric Medical Group at $25,000, Arbour Hospital at $65,000, Beth Israel Lahey Health Behavioral Services at $70,000. Right of access was the second most common HIPAA complaint category in 2024, with 541 complaints. On outsourced records handling, OCR Acting Director Anthony Archeval put it plainly: "A covered entity's responsibility to provide timely access continues." Your defense is the log: receipt date, action date, format, fee, outcome. Retention then splits in a way that trips practices: the access documentation is HIPAA compliance documentation kept six years under 45 CFR 164.530(j), while the chart itself follows state retention law, commonly 5 to 10 years and longer for minors. Where state access law is more protective, with a shorter deadline or a lower fee, the state rule governs; read your own statute and board rules rather than assuming the federal floor is the ceiling.
Two more realities shape the frame. First, nothing here is payer-adjudicated: no CARC or RARC code exists for an access response because it is not a claim, and the permitted fee is paid by the individual, so no billing office will catch a fee mistake later; the discipline lives in this packet or nowhere. Electronic records add the information-blocking overlay at 45 CFR Part 171, under which practices that interfere with access to electronic health information face Medicare disincentives. Second, the ground is moving, so date your policies. As of July 2026, the 2021 federal proposal to shorten the response window from 30 days to 15 remains unfinalized, with a new access-timing rule projected for late 2026, and the 2024 reproductive-health privacy rule was vacated nationwide on June 18, 2025, returning practices to pre-December-2024 handling. The cover letter format is a convention; the timeline, the cost-based fee, the denial mechanics, and the documentation are the requirement. When a third party seeks records for its own purposes, step out of this packet and into the release of information workflow, and route requests aimed at separately kept process notes through a psychotherapy notes authorization.
The compliance record on this document is unusually well measured. A 2018 JAMA Network Open study of 83 top US hospitals found request handling inconsistent between authorization forms and phone staff, with some hospitals quoting more than $500 for a 200-page record against the $6.50 federal flat option for electronic copies, and 8% out of step with state processing-time limits. The Ciitizen patient-record scorecards trace the same problem over time: more than half of 210 providers scored in 2019 were initially out of compliance, 56% of telephone responses indicated noncompliance, and by the third scorecard of 820 providers the noncompliant share had fallen to 27%, with form-and-format failures the leading remaining error at 65% of the noncompliant group and only 6% still charging fees. OCR's 2024 numbers keep right of access the second most common HIPAA complaint category at 541. The BastionGPT Clinical Advisory Board sees the same errors most often in records request response reviews:
BastionGPT is specifically trained, tuned, and clinically tested on records request and chart copy packets.
See how clinicians use it day to day on the AI therapy notes page.
Many BastionGPT users report saving more than 90 minutes per day on documentation.
HIPAA-compliant with a signed BAA on every plan. Your data is never used to train models. BastionGPT drafts, you review and sign.
US practices must act within 30 calendar days of receiving the request: provide the records, deny with a proper letter, or send a written extension notice stating the reasons and the expected date, which buys one additional 30-day period at most. The clock runs from receipt even when a business associate holds the chart and even while a permitted fee is unpaid. State law can set a shorter deadline, and where it does, the shorter rule governs. A 2021 federal proposal to cut the window to 15 days had still not been finalized as of July 2026.
Only a reasonable, cost-based fee for the client's own access: labor for copying, supplies, postage when the copy is mailed, and preparation of a summary the client agreed to in advance. Retrieval, search, and system costs are never chargeable, per-page fees do not fit an electronic copy from an EHR, and a flat $6.50 is a recognized option for electronic copies. Many practices simply charge nothing; by the third Ciitizen scorecard only 6% of providers charged any fee. State per-page schedules apply to other disclosures, not to an access request.
No, and the difference sets both the fee and the deadline. A records request is the client exercising their own right of access, or directing a copy to a third party in a signed writing: the 30-day clock and the cost-based fee cap apply. A release of information authorization permits the practice to disclose records to a third party for that party's own purposes: no access clock, and fees set by state schedules or agreement. Since the 2020 Ciox ruling, the access fee cap also does not extend to third-party directives in non-electronic formats.
Only if they are not truly psychotherapy notes. Process notes kept separate from the rest of the chart are excluded from the access right, and disclosing them generally takes a specific psychotherapy notes authorization. Everything else must be released: medication management, session start and stop times, test results, diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date. Notes commingled with the progress-note stream are part of the accessible record no matter what they are called.
You may require that requests be in writing if you tell people so, and you may offer a form, but you cannot make your form a precondition, and identity verification must be reasonable rather than a barrier: matching a portal login or date of birth on file is usually enough, while an in-person visit or notarization requirement is the kind of obstacle regulators flag. The same pattern holds elsewhere: Australia's OAIC says an entity may ask a person to use a form but cannot require it, and Ontario's PHIPA lets custodians honor oral requests.
Only on narrow grounds, and almost never as a blanket matter. The main reviewable ground is a licensed professional's judgment that access is reasonably likely to endanger the client's or another person's life or physical safety; expected distress does not qualify. The denial letter must state the ground in plain language, offer review by a different licensed professional who took no part in the original decision, and explain how to complain to the practice and to OCR. The unreviewable grounds, such as separately kept psychotherapy notes and litigation-compilation material, are a short and specific list.
Canada's PIPEDA gives private-sector organizations 30 days, extendable by 30 with written notice, at minimal or no cost; Ontario's PHIPA also runs on 30 days, and its regulator reads reasonable cost recovery as $30 for the first 20 pages plus 25 cents per page after that. Australia's federal APP 12 requires access within a reasonable period, which the OAIC reads as not more than 30 days, with any charge not excessive; the Victorian and NSW health-records Acts set a harder 45-day deadline, Victoria with a regulated fee schedule updated each July and NSW with no prescribed fee scale at all.
Two different clocks. The access-request documentation itself, meaning the log, the letters, and the record-set designations, is HIPAA compliance documentation kept at least six years under 45 CFR 164.530(j). The clinical chart follows state, provincial, and professional rules instead: commonly 5 to 10 years for adults in the US and longer for minors, at least 10 years after last contact for Ontario psychologists, and 7 years from last service or until age 25 in Australia under the Victorian and NSW Acts and the APS code.
Yes. Give it the request details, meaning what was asked for, when it arrived, the format requested, and your fee inputs, and it drafts the cover letter, the itemized fee notice, and, where a ground genuinely applies, a denial letter with the review language 45 CFR 164.524 requires, plus a log entry for your compliance file. BastionGPT is HIPAA-compliant with a signed BAA on every plan, and your data is never used to train models.
Educational content, not legal or billing advice. Sample notes are fictional. Follow your organization's policies and your board, payer, and jurisdiction requirements.