Why Hospitals Are So Slow to Release Medical Records

In December 2025, federal regulators announced a $112,500 settlement with Concentra, an occupational health provider whose patient made six separate requests for his records and waited more than 13 months to get them. It was the 54th enforcement action in the Office for Civil Rights' Right of Access Initiative since 2019. Over that same stretch, OCR has been receiving roughly 31,000 HIPAA complaints a year, and access to records was the single most common issue in the complaints it resolved in 2023.

Plaintiff firms know the pattern behind those numbers. A request goes out, nothing comes back, and the file sits until someone calls to ask where things stand. The delay is not a mystery, and most of it is not even illegal. The rules give facilities 30 days plus a 30-day extension, the penalty for missing the deadline almost never arrives, and a hospital earns nothing by responding faster.

The 30-day rule is softer than it looks

Under 45 CFR 164.524, a covered entity must act on a patient's request for records within 30 calendar days. If it cannot, it may take one extension of up to 30 more days by sending a written notice that explains the delay and names a completion date (HHS FAQ 2050). That is the federal floor: up to 60 days, legally, for a single request. The extension requires no approval from anyone. The facility just sends the letter.

There is a second detail that matters more for law firms. The deadline belongs to the patient's right of access. A request that arrives from a firm as a signed HIPAA authorization is treated differently: under HHS guidance, an authorization permits, but does not require, the provider to disclose the records. Federal law attaches no deadline to it at all.

State law sometimes fills that gap. California requires copies to be transmitted within 15 days. Texas gives hospitals 15 business days from a written authorization, which does cover attorney requests. Washington allows 15 working days. But a 50-state comparison shows many states set no shorter clock, so the federal 30-plus-30 window is the practical default across much of the country.

Slow release is a business decision

A records department does not generate revenue. Every request a hospital fulfills costs staff time and vendor fees, and the amount it can collect back is capped or contested. Fast turnaround wins the facility nothing. That is not cynicism; it is the economics the industry itself described in federal court.

In Ciox Health v. Azar, one of the country's largest release-of-information vendors told the court it handles tens of millions of requests a year, and that it lost $35 million in revenue across 2017 and 2018 after HHS extended the patient fee cap to requests routed to third parties. Fulfilling attorney-bound requests at the capped rate was a money loser, so the industry sued.

The ruling split the road in two. A patient asking for their own records keeps the deadline and the fee cap. A firm requesting through an authorization gets neither, and facilities know the difference. It also explains why the HITECH-style workaround, where the patient directs the facility to send records straight to counsel, has limits: HHS's post-ruling notice confirms that pathway now covers only electronic copies of electronically maintained records, with no fee protection. Older paper charts, imaging, and separately archived materials do not have to move through it, and there is no standard process from one facility to the next.

What happens to a request inside the hospital

Ask release-of-information staff and plaintiff paralegals to describe the pipeline and the same stages come up, in the same order.

The best documented outside look at this pipeline is a 2018 study in JAMA Network Open, in which Yale researchers contacted the records departments of 83 top-ranked hospitals using a simulated patient script. What the request forms said and what staff said on the phone disagreed at most institutions. Quoted turnaround ranged from same day to 60 days, several hospitals quoted times beyond their own state's legal limits, and costs ran as high as $541.50 for a 200-page record against a $6.50 federal recommendation for electronically maintained files.

Enforcement exists, but the math favors waiting

HIPAA enforcement runs through OCR complaints rather than private lawsuits, and the funnel narrows fast. In 2023, OCR resolved 38,601 complaints and closed 79 percent of them before opening any investigation. Fourteen investigations that year ended in financial settlements across every category of HIPAA violation combined, and four involved right-of-access failures, with penalties running from $15,000 against a solo counselor to $160,000 against a multi-specialty physician group.

Set that against roughly 31,000 complaints a year and the incentive picture is plain. A facility that treats the deadline as a suggestion faces long odds of ever paying for it, and when payment comes due, it is usually five figures. OCR has signaled that right of access remains an enforcement priority for 2026, with new attention on parents blocked from their children's records. Even so, the initiative has averaged roughly eight actions a year since 2019. Patterns of repeat violations do get punished, as Concentra learned. A single stalled request almost never does.

Med-mal requests: where cooperation drops further

When a request signals malpractice exposure, the posture changes again. Attorneys who handle birth injury and hospital negligence cases report that requests on firm letterhead are read as a sign that litigation may be coming and get routed through risk management or counsel before release. The regulation hands facilities one narrow, legitimate tool here: information compiled in reasonable anticipation of litigation is excluded from the access right, though the underlying treatment records are not.

Fetal monitoring strips are the sharpest example of how this plays out. They are frequently stored in separate archiving systems rather than the main chart, and birth injury practitioners warn they are regularly missing from a standard release. Firms that work these cases request the strips by name, send preservation demands early because tracings can be lost or overwritten, and escalate to a subpoena or court order when a facility resists. The leverage runs the other way too: if strips existed and the hospital cannot produce them, courts can impose spoliation sanctions, including adverse inference instructions.

What firms can do about it

None of the fixes are exotic. They are procedural, and they work because most delay is procedural too. Calendar the deadline that actually applies in each state rather than the federal worst case. Send clean requests: a complete authorization, specific record categories including separately stored materials, and a stated delivery format. Follow up in writing before the clock runs, then escalate on a schedule, starting with a demand letter that cites the state statute and moving to an OCR complaint filed by the client or a subpoena where litigation allows.

The other option is to stop absorbing the workload internally. Firms increasingly hand the full cycle to retrieval platforms like LlamaLab that manage follow-up, escalation, and state deadline tracking; LlamaLab's published retrieval data shows records back in 4 days on average, with 30 to 40 percent returned same day.

The bottom line

Hospitals are slow with records because slow is rational. The rules allow up to 60 days, an attorney's authorization-based request often has no federal deadline at all, and the agency responsible for enforcement completes a handful of access actions in a typical year. Nothing announced for 2026 changes that arithmetic.

Firms cannot change a hospital's incentives, but they can stop donating time to them. Know the state clock, request with precision, escalate on schedule, and treat anything stored outside the main chart as its own request with its own paper trail.

Sources: HHS OCR press release on the Concentra settlement (Dec. 16, 2025), HHS Annual Report to Congress on HIPAA Compliance, CY 2023, 45 C.F.R. § 164.524, HHS FAQ 2050 on timeliness, HHS Right of Access guidance, Ciox Health, LLC v. Azar, 435 F. Supp. 3d 30 (D.D.C. 2020), HHS Important Notice on the Ciox court order, Lye et al., JAMA Network Open (2018), California Health & Safety Code § 123110, Tex. Health & Safety Code § 241.154, RCW 70.02.080, Health Information & the Law 50-state comparison, HIPAA Journal on OCR's 2023 reports, Elliott Davis healthcare alert on 2026 OCR priorities.

This article is for informational purposes only and does not constitute legal or medical advice. Consult with qualified professionals for advice specific to your situation.