Under Arizona medical records law, any healthcare provider holding your records must give you access to them, or copies, once you send a written request. The governing statute is Arizona Revised Statutes 12-2293, which covers both your medical records and your payment records.1Arizona Legislature. Arizona Code 12-2293 – Release of Medical Records and Payment Records to Patients and Health Care Decision Makers; Definition HIPAA adds a federal deadline and a fee ceiling on top of that. Providers can only refuse in a short list of situations, and even then they owe you a written explanation.
How to Request Your Records
The request has to be in writing and directed to the provider who holds the records. “Access” under the statute means you can inspect the file in person, receive copies, or both.1Arizona Legislature. Arizona Code 12-2293 – Release of Medical Records and Payment Records to Patients and Health Care Decision Makers; Definition
Your health care decision maker has the same right. That includes anyone you’ve appointed under a healthcare power of attorney and any guardian or conservator a court has designated for you. This matters when a patient is too ill or incapacitated to advocate for themselves.1Arizona Legislature. Arizona Code 12-2293 – Release of Medical Records and Payment Records to Patients and Health Care Decision Makers; Definition
You can also direct the provider to send a copy of your records to a third party. Under the HIPAA Privacy Rule, that written direction has to identify the recipient clearly and be signed by you. The recipient can be another doctor, a lawyer, or a family member.2U.S. Department of Health and Human Services. Individuals’ Right under HIPAA to Access their Health Information
How Long the Provider Has to Respond
Arizona’s statute doesn’t set a specific number of days. HIPAA does. A covered provider must act on your access request within 30 calendar days of receiving it.3U.S. Department of Health and Human Services. How Timely Must a Covered Entity Be in Responding to Individuals’ Requests for Access
If the provider genuinely can’t meet the deadline, one 30-day extension is allowed, but only if you receive written notice explaining the reason and the expected completion date. A second extension isn’t permitted.2U.S. Department of Health and Human Services. Individuals’ Right under HIPAA to Access their Health Information
What Providers Can Charge
Arizona law lets providers charge a “reasonable fee” for reproducing records. Unless the records are needed for continuity of care, the provider can require you to pay before releasing copies.4Arizona Legislature. Arizona Code 12-2295 – Charges
The statute doesn’t set a per-page cap, so “reasonable” varies. HIPAA gives you a backstop: charges must be cost-based, covering only the labor for copying, supplies, and postage if you asked for the records to be mailed. If a quoted fee looks inflated, that’s the standard to push back against.
When a Provider Can Deny Your Request
Arizona law lists six grounds, and no others. Four of them require a health professional (not an administrator) to make the call. Two are circumstantial and can be decided by the provider itself.
Denials That Require a Health Professional’s Judgment
- Access is reasonably likely to endanger your life or physical safety, or someone else’s.1Arizona Legislature. Arizona Code 12-2293 – Release of Medical Records and Payment Records to Patients and Health Care Decision Makers; Definition
- The records refer to someone other than a health professional, and release would likely cause that person substantial harm.1Arizona Legislature. Arizona Code 12-2293 – Release of Medical Records and Payment Records to Patients and Health Care Decision Makers; Definition
- The requester is a health care decision maker rather than the patient, and access would likely cause substantial harm to the patient or another person.1Arizona Legislature. Arizona Code 12-2293 – Release of Medical Records and Payment Records to Patients and Health Care Decision Makers; Definition
- The records contain information given under a promise of confidentiality by someone who isn’t a health professional, and release would likely reveal that source.1Arizona Legislature. Arizona Code 12-2293 – Release of Medical Records and Payment Records to Patients and Health Care Decision Makers; Definition
Denials Based on Circumstances
- You agreed, as a condition of participating in a clinical research study, to suspend access to your records until the study ends, and you were told at the outset that access would be restored afterward.1Arizona Legislature. Arizona Code 12-2293 – Release of Medical Records and Payment Records to Patients and Health Care Decision Makers; Definition
- You’re an inmate, the provider is a correctional institution or acting under one, and release would jeopardize the health, safety, security, custody, or rehabilitation of you, other inmates, or staff.1Arizona Legislature. Arizona Code 12-2293 – Release of Medical Records and Payment Records to Patients and Health Care Decision Makers; Definition
Psychotherapy Notes and Litigation Materials
Two categories sit outside the general right of access under federal law. Psychotherapy notes are excluded from the HIPAA access right entirely.5eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information A provider can share them voluntarily, but doesn’t have to.
The definition is narrow. Psychotherapy notes are the therapist’s private, session-by-session analysis of a counseling conversation, kept separately from your main medical record. Medication records, session start and stop times, treatment frequency, diagnosis summaries, prognosis, and progress notes are not psychotherapy notes. Those live in your regular medical record and you have the same access rights to them as any other file.
Information compiled in anticipation of a lawsuit or legal proceeding is also excluded from the general access right under 45 CFR 164.524.5eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
What a Denial Has to Include
A provider who refuses your request has three obligations under Arizona law. It must document the denial and the reason for it in your medical record. It must give you (or your decision maker) a written explanation. And if only part of the record falls within a denial ground, the provider still has to release everything else.1Arizona Legislature. Arizona Code 12-2293 – Release of Medical Records and Payment Records to Patients and Health Care Decision Makers; Definition
That last point is where blanket denials often break down. One legitimately restricted page doesn’t justify withholding the whole file, and the written explanation you receive should give you enough to challenge it.
How to Appeal or Complain
If the denial rests on a clinical judgment call (the safety ground, third-party harm, or decision-maker harm), HIPAA gives you a right to internal review. A different licensed health care professional who wasn’t part of the original decision must review it. The provider designates the reviewer, refers your request promptly, sends you written notice of the outcome, and is bound by that determination.6eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
Some denials aren’t reviewable through that process. Psychotherapy notes, clinical research participation, correctional institution security, and confidential source protection all sit outside the internal review right.5eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
Whether or not internal review applies, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. Complaints can be filed through the OCR Complaint Portal or in writing.7U.S. Department of Health and Human Services. Filing a Health Information Privacy Complaint OCR is the federal enforcement channel for HIPAA access violations, and its investigations can lead to corrective action plans and financial penalties against the provider.