# Can a practice withhold patient records because a bill is unpaid?

Canonical: https://prospyrmed.com/resources/practice-answers/patient-record-access
Sources reviewed: 2026-09-16 · Prepared by Prospyr

For HIPAA-covered entities, an unpaid treatment bill is not a basis to deny a patient access to their protected health information. Process the request under applicable access rules, including timing, format and permitted fees. Handle collections as a separate workflow.

## Identify the requested record set

HHS access guidance addresses information in a designated record set, which can include more than the main chart. Assess the actual scope, including relevant billing records and other information used to make decisions about the person. Do not require the patient to settle treatment charges first.

Source: [HHS: Individuals’ right to access health information](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html) — HIPAA access guidance
Source: [HHS: Unpaid bills do not remove record access rights](https://www.hhs.gov/hipaa/for-professionals/faq/2065/is-a-health-care-provider-permitted-to-deny/index.html) — HIPAA access FAQ

## Track the response deadline

HIPAA generally requires action within 30 calendar days, with a limited extension process under specified conditions. State law can impose shorter timelines or additional obligations. Record request receipt, scope, response, any permitted extension and delivery method.

Source: [HHS: Individuals’ right to access health information](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html) — HIPAA access guidance

## Practical checklist

1. Log the date received and verify identity without unnecessary barriers.
2. Identify the requested designated-record-set information.
3. Apply the relevant deadline, format and fee rules.
4. Document secure delivery separately from the collection account.

## Worked example

A former patient requests records while a balance remains overdue. Route the access request to the records workflow and the balance to collections. Do not make the release contingent on paying the outstanding treatment bill.

## Mistakes to avoid

- Withholding records as leverage for collection.
- Exporting only the visible chart without reviewing the request scope.
- Treating 30 days as permission to ignore a shorter applicable state deadline.

## Related questions

- [Does HIPAA require keeping every medical record for six years?](https://prospyrmed.com/resources/practice-answers/medical-record-retention)
- [Can a med spa post before-and-after photos with treatment consent?](https://prospyrmed.com/resources/practice-answers/patient-photo-marketing-authorization)
- [Are treatment consent, an ABN and a good faith estimate interchangeable?](https://prospyrmed.com/resources/practice-answers/consent-versus-financial-notices)

Prepared by Prospyr from the cited primary sources. These are educational workflow resources, not individualized clinical, coding, legal or tax advice. No clinician, certified-coder or attorney review is claimed. Confirm current code instructions, payer terms and applicable law for the actual service and date. CPT is a registered trademark of the American Medical Association; this is not a substitute for a licensed current code set.