Right of access, with the clock actually running

Right of access is OCR’s most-enforced obligation, and clinics rarely fail it by refusing. They fail it because the request arrived, went to someone’s inbox, and the thirty days ran out while everyone assumed someone else had it.

The policy is composed from your clinic’s facts

Your right-of-access policy covers who may exercise the right, including parents acting for minors, what the designated record set contains, the thirty-day timing with its extension, form and format requirements, the narrow cost-based fee you may charge, the limited grounds for denial, routing to your privacy officer, and documentation. Clinics with a parent portal get a clause on how the portal fits.

The clock is computed, not remembered

Seven requirements, and three of them run the clock:

• No access request is past its recorded deadline.
• No amendment request is past its deadline.
• No accounting of disclosures request is past its deadline.
• The policy is active, adopted, reviewed within twelve months, with facts that have not drifted.

Each request carries its own due date, and the extension date if one was taken. A request whose deadline has passed while still open shows as overdue. This is the difference between a policy that mentions thirty days and a system where day thirty-one is visible.

What this is, and what it is not

The clock runs against the dates recorded on each request. The system does not know a request arrived until someone logs it, and it does not evaluate whether what you produced was complete or correct. A request marked fulfilled is a status someone set.

The failure this addresses is the common one: not a wrong answer, but no answer, because nobody was counting.

What an investigator gets

A request log with dates, deadlines, and status per request. A visible record of whether anything ran past its clock. For the obligation OCR enforces most, the ability to show that requests were tracked rather than handled by memory.