When someone asks to see their records, correct them, or find out who you shared them with, HIPAA gives you a deadline. This register tracks each request and the clock that runs on it.
| Right | Deadline | Extension |
|---|---|---|
| Access to records — §164.524 | 30 days | one 30-day extension |
| Amendment of records — §164.526 | 60 days | one 30-day extension |
| Accounting of disclosures — §164.528 | 60 days | one 30-day extension |
| Restriction on use or disclosure — §164.522(a) | no statutory deadline | — |
| Confidential communications — §164.522(b) | no statutory deadline | — |
The deadline is calculated for you from the date you received the request — you can't type one in. Two rights carry no statutory clock at all, so they show no due date rather than an invented one, and they're counted separately in the summary rather than folded in with everything else.
Record who asked, what they asked for, and the date you received it. A received date in the future is refused, because it would start a clock that hasn't begun.
If someone filed on the individual's behalf — a personal representative under §164.502(g) — record their name too.
§164.524(c)(2)(i) lets the individual choose the form. If you hold the record electronically and they ask for an electronic copy, you must provide it that way when it's readily producible.
Record what they asked for when you log the request, and what you actually provided when you close it. If they asked for an electronic copy and received paper, the register flags it — that specific mismatch is the one the rule cares about. The reverse isn't a violation and isn't flagged.
§164.524(b)(2)(ii) permits exactly one extension, and it requires written notice to the individual. Record the date you sent that notice; the deadline moves and the extension is locked, so a second attempt is refused rather than quietly pushing the date again.
Mark it fulfilled, partially fulfilled, denied or withdrawn. A denial needs the ground it rests on — §164.524(d) and §164.526(d) require the basis in writing, so the register won't accept a denial without one. The grounds offered are the permitted ones, and for access requests the three §164.524(a)(3) reviewable grounds are labelled as such, because those carry a right to review by a licensed professional who wasn't part of the original decision.
Closing as denied or withdrawn records that nothing was provided, whatever the format field says — the register won't document a disclosure that didn't happen.
Anything past its deadline is flagged on the register and shown in the summary. Once a week, an overdue request also generates a notification to your org admins; that reminder can't be switched off in notification preferences, because missing one of these deadlines isn't an internal task slipping — it's a right the individual holds.
Export the register as CSV or PDF. Both carry the citation, both honour whatever filter is on screen, and the PDF states on its face when it's a filtered view rather than the whole register.
This register is available on every plan, including free. These duties bind every covered entity regardless of what you pay us, so it isn't gated.
Org admins only — including delegated admins. Every row names an individual who exercised a privacy right and may describe why, so contributors and auditors are refused the register and both of its exports.