Right of access: the 30-day clock on a records request

A parent emails on the first of the month asking for their child’s complete file: every session note, every progress report, the whole thing. The clinic is not sure what it is allowed to share. Someone worries that the clinical notes are private. The email gets forwarded twice and then forgotten. Forty days later the parent, who never got a reply, files a complaint with the Office for Civil Rights. That complaint is the single most common way a small clinic meets OCR, and it started with a request nobody answered.

Right of access is not an obscure corner of HIPAA. It is the most-enforced obligation in the entire rule, and it is the one an ordinary parent can trigger from their kitchen table, though it is only the first of several rights a parent holds.

What the right actually is

An individual has the right to inspect and obtain a copy of their protected health information held in a designated record set (45 CFR 164.524). A designated record set is broad: the records you use to make decisions about the person, which in an ABA clinic means intake, assessments, treatment plans, session notes, progress data, and billing. The right is expansive on purpose, and OCR has run a standing Right of Access enforcement initiative for years precisely because clinics get it wrong so often.

Who is asking

In ABA the client is usually a child, and the person asking is usually a parent. For a minor, the parent is generally the child’s personal representative and exercises the right of access on the child’s behalf (45 CFR 164.502(g)). There are state-law wrinkles and narrow exceptions, so this is not automatic in every case, but the default posture is simple: when a parent asks for their young child’s record, treat it as the child’s right of access being exercised, not as a favor you are choosing to grant.

The clock

Here is the part clinics miss. A request starts a clock. You must act on it no later than 30 days after you receive it (45 CFR 164.524(b)(2)(i)). You may take one extension of up to 30 more days, but only if, within the first 30, you give the individual a written statement of the reason for the delay and the date you will finish, and you get only that one extension (45 CFR 164.524(b)(2)(ii)).

A records request is a clock, not a favor. “We will get to it” is not a response the rule recognizes. Either you produce the records inside the window, or you send a proper written denial inside the window, or you send the one permitted extension notice inside the window. Silence for forty days is the violation, and it is the exact fact pattern in a large share of OCR’s access settlements.

The psychotherapy-notes myth, which is where ABA clinics fail

The most common reason an ABA clinic wrongly withholds records is a misunderstanding of one term. Someone believes the session notes are “psychotherapy notes” and therefore private. They are almost never psychotherapy notes, and the definition is the proof.

“A records request is a clock, not a favor.”

Psychotherapy notes (45 CFR 164.501) are a narrow, specific thing: notes a mental health professional records to document or analyze the contents of a counseling-session conversation, kept physically separate from the rest of the record. And the definition explicitly excludes the treatment plan, functional status, symptoms, prognosis, progress to date, the modalities and frequencies of treatment, session start and stop times, and test results.

Look at what that exclusion list contains. It is almost the entire contents of an ABA record. Your session notes, your progress data, your treatment plan, your graphs of target behaviors, these are the treatment plan and the progress to date, which the definition specifically excludes from being psychotherapy notes. So they are not psychotherapy notes. They are ordinary protected health information in the designated record set, and they must be produced. HHS says this directly: clinical case notes and progress notes are accessible; only true psychotherapy notes, kept separate, are not.

Two things have to both be true for a note to be a psychotherapy note, and ABA notes fail both: the content has to be a therapist’s analysis of a session conversation rather than the treatment record itself, and it has to be kept in a genuinely separate place. A progress note in the chart is not a psychotherapy note no matter what you title it.

The form, and the fee

You must provide the records in the form and format the individual asks for, if you can readily produce it, and if you keep the record electronically and they ask for an electronic copy, you generally must provide it electronically (45 CFR 164.524(c)(2)).

The fee is tightly limited, and overcharging is itself an enforced violation. You may charge a reasonable, cost-based fee that includes only the labor to copy the information, the supplies, and postage if they want it mailed (45 CFR 164.524(c)(4)). You may not bill for the time your staff spent searching for and retrieving the record. A large per-page fee, or a charge for “record retrieval,” is exactly the kind of thing OCR has pursued.

And if the individual asks you, in a signed written request, to send the copy directly to a third party, a school, a new provider, a lawyer, you must do it (45 CFR 164.524(c)(3)).

When you can actually say no

The grounds for denial are narrow. Psychotherapy notes and information compiled for litigation are outside the right entirely (45 CFR 164.524(a)(1)). A short list of reviewable grounds exists, mostly where a licensed professional judges that access is reasonably likely to endanger someone (45 CFR 164.524(a)(3)), and even then the individual can demand review by a different professional. “We are busy,” “we would rather not,” and “those are our clinical notes” are not on the list.

How it dies

The request lands in an inbox and nobody owns it. There is no named person whose job is to catch a records request, start the clock, and answer it. So the 30 days pass unwatched, the parent gets nothing, and the first time anyone in the clinic thinks about it is when OCR forwards the complaint. Right of access is the most-enforced obligation in HIPAA for exactly this reason: it is the easiest one to fail by simply not answering.

The bottom line

A records request is a deadline, not a discretionary favor. Know who owns it the day it arrives, know that your ABA session notes and progress data are part of the record you must produce, charge only what the rule allows, and answer within 30 days or send a proper denial or the one written extension. The clinic that treats the request as a clock it is watching never meets OCR over it. The clinic that treats it as a favor it will get to eventually meets OCR over almost nothing else.