The short answer
For HIPAA-covered entities, an unpaid treatment bill is not a basis to deny a patient access to their protected health information. Process the request under applicable access rules, including timing, format and permitted fees. Handle collections as a separate workflow.
Identify the requested record set
HHS access guidance addresses information in a designated record set, which can include more than the main chart. Assess the actual scope, including relevant billing records and other information used to make decisions about the person. Do not require the patient to settle treatment charges first.
Track the response deadline
HIPAA generally requires action within 30 calendar days, with a limited extension process under specified conditions. State law can impose shorter timelines or additional obligations. Record request receipt, scope, response, any permitted extension and delivery method.
Your practical checklist
- Log the date received and verify identity without unnecessary barriers.
- Identify the requested designated-record-set information.
- Apply the relevant deadline, format and fee rules.
- Document secure delivery separately from the collection account.
A worked example
A former patient requests records while a balance remains overdue. Route the access request to the records workflow and the balance to collections. Do not make the release contingent on paying the outstanding treatment bill.
Illustrative workflow example; not a patient case or individualized recommendation.
Mistakes to avoid
- Withholding records as leverage for collection.
- Exporting only the visible chart without reviewing the request scope.
- Treating 30 days as permission to ignore a shorter applicable state deadline.