Blog · Law
Medical Record Retrieval Turnaround Time Guide
State-by-state medical record retrieval response deadlines and HIPAA defaults, with citations and state notes.
By Tavrn Team · · 3 min read
Summarise with ChatGPT, Claude or Perplexity
Medical record retrieval turnaround time is governed by the federal HIPAA Privacy Rule and state-specific access statutes. HIPAA sets a 30-day response baseline, with one permitted 30-day extension.
State statutes overlay this federal floor. Where a state imposes a shorter window, the state deadline controls, while operational factors remain separate from the legal outside limit.
This guide summarizes the HIPAA baseline, state-by-state response periods, day-counting rules, delivery factors, enforcement options, and the related retrieval workflow.
How HIPAA and State Law Set Record Retrieval Deadlines
Under 45 C.F.R. § 164.524(b)(2)(i), a covered entity must act on a request within 30 calendar days of receipt by granting access or issuing a written denial. The regulation permits one extension per request under 45 C.F.R. § 164.524(b)(2)(ii), subject to written notice within the original 30-day window.
HHS OCR guidance confirms that a covered entity subject to a shorter state-law access period must provide access within that shorter period. That analysis turns on the applicable state deadline, the more stringent law under 45 C.F.R. § 160.202, and the preemption rule in 45 C.F.R. § 160.203.
Where a state has no numeric deadline, 30 calendar days is the outside limit for covered entities under the HIPAA baseline.
State-by-State Medical Record Retrieval Deadlines: All 50 States Plus DC
As of July 2, 2026, the table below lists the stated response deadline, governing citation, and notes for each jurisdiction. Where state law provides no shorter numeric deadline for covered entities, the HIPAA baseline remains the operative outside limit.
Jurisdiction | Operative Response Deadline / State Deadline Status | Governing Citation | Notes |
|---|---|---|---|
Federal (HIPAA baseline) | 30 calendar days + one 30-day extension | 45 C.F.R. § 164.524 | Calendar days; federal floor; 60-day maximum with written notice |
Alabama | HIPAA baseline (30 days) | Ala. Admin. Code r. 540-X-9-.10 | Rule addresses retention, active patient definition, and notification |
Alaska | HIPAA baseline (30 days) | Alaska Stat. § 18.23.005 | No numeric state deadline listed |
Arizona | HIPAA baseline (30 days) | Ariz. Rev. Stat. § 12-2293 | Covers patient access to medical and payment records |
Arkansas | 30 calendar days | Ark. Code Ann. § 16-46-106 | Calendar days; electronic records |
California | 5 working days (inspection); 15 calendar days (copies) | Cal. Health & Safety Code § 123110 | Mixed day types; state deadline controls |
Colorado | HIPAA baseline (30 days) | Colo. Rev. Stat. § 25-1-802 | Statute requires access at reasonable times and upon reasonable notice; no numeric state deadline; HIPAA baseline applies for covered entities |
Connecticut | 30 calendar days | Conn. Gen. Stat. § 20-7c, § 19a-490b | Calendar days |
Delaware | HIPAA baseline (30 days); 45 days from closure or completion of the record | Del. Code Ann. tit. 24, § 1761 | Physician deadline runs from record closure or completion unless faster response is medically necessary |
Florida | Timely manner | Fla. Stat. § 456.057(6), § 395.3025 | HIPAA 30-day baseline applies for covered entities |
Georgia | 30 days | Ga. Code Ann. § 31-33-2 | Day type not specified in statute |
Hawaii | 10 working days | Haw. Rev. Stat. § 622-57 | Working days; state deadline controls |
Idaho | HIPAA baseline (30 days) | No general numeric state deadline for covered entities; hospital electronic record access may be faster under state hospital rules | |
Illinois | 30 days (60-day maximum) | Response due within 30 days; 60-day statutory maximum with written notice of delay under 735 ILCS 5/8-2001(e) | |
Indiana | 30 days + 30-day extension | Day type not specified in statute | |
Iowa | 30 days | Iowa Code § 622.10 | Day type not specified in statute |
Kansas | 30 days | Day type not specified in statute | |
Kentucky | HIPAA baseline (30 days) | No response timeline specified | |
Louisiana | 15 calendar days | La. Rev. Stat. § 40:1165.1; La. Admin. Code tit. 48, § I-9387 | Calendar days; state deadline controls |
Maine | HIPAA baseline (30 calendar days) | Me. Rev. Stat. tit. 22, § 1711 | Calendar days for covered entities; reasonable time otherwise |
Maryland | 21 working days | Md. Code, Health-Gen. § 4-309 | Working days; shorter than HIPAA; provider may not refuse disclosure beyond 21 working days |
Massachusetts | HIPAA baseline (30 days) | Board references two to three weeks and HIPAA deadlines | |
Michigan | 30 days (60 days if records off-site) | Mich. Comp. Laws § 333.26265 | Michigan law and HIPAA both require 30-day response; limited extensions |
Minnesota | Promptly (no fixed statutory day count) | Minn. Stat. § 144.292 | Statute requires records be furnished promptly; no numeric deadline; HIPAA 30-day baseline applies for covered entities |
Mississippi | HIPAA baseline (30 days) | 45 C.F.R. § 164.524 | HIPAA baseline applies for covered entities |
Missouri | Reasonable time | HIPAA baseline applies for covered entities | |
Montana | 10 days (standard); 21 days (if in use or delayed) | Mont. Code Ann. § 50-16-541 | Day type not specified in statute |
Nebraska | 30 calendar days | Neb. Rev. Stat. § 71-8403 | Copies deadline listed; inspection deadline may be shorter |
Nevada | 10 working days (inspection) | Nev. Rev. Stat. § 629.061 | Working days for physical inspection; 30-day deadline applies to copies supporting a benefits claim; HIPAA baseline otherwise |
New Hampshire | 30 days | N.H. Rev. Stat. Ann. § 332-I:1 | Day type not specified in statute |
New Jersey | 30 days | N.J. Rev. Stat. § 45:9-22.27; N.J.A.C. 13:35-6.5 | Licensee must provide records no later than 30 days after request |
New Mexico | Timely manner (general); 30 calendar days (disability requests only) | HIPAA baseline applies for general covered-entity access requests | |
New York | 10 days (inspection); reasonable time (copies) | N.Y. Pub. Health Law § 18 | 10-day inspection deadline; reasonable time for copies |
North Carolina | HIPAA baseline (30 days) | N.C. Gen. Stat. § 90-411 | Fees only in statute |
North Dakota | HIPAA baseline (30 days) | N.D. Cent. Code § 23-12-14 | HIPAA baseline applies for covered entities |
Ohio | Reasonable time | Ohio Rev. Code § 3701.74 | HIPAA baseline applies for covered entities |
Oklahoma | HIPAA baseline (30 days) (general); 30 days (mental health facilities) | Okla. Stat. tit. 76, § 19; OAC § 450:15-3-62 | General access statute; 30-day mental health facility rule |
Oregon | 14 calendar days (dental/diagnostic); 30 days (OMB guidance) | Or. Admin. R. 818-012-0032 | Calendar days for dental/diagnostic; OMB guidance references 30 days |
Pennsylvania | Reasonable time | 49 Pa. Code § 25.213 | HIPAA baseline applies for covered entities |
Rhode Island | HIPAA baseline (30 days) | 45 C.F.R. § 164.524 | HIPAA baseline applies for covered entities |
South Carolina | 45 calendar days (post-discharge or post-request, whichever later) | S.C. Code Ann. § 44-7-325 | State deadline is longer than HIPAA; HIPAA deadline applies for covered entities |
South Dakota | HIPAA baseline (30 days) | 45 C.F.R. § 164.524 | HIPAA baseline applies for covered entities |
Tennessee (non-hospital) | 10 working days | Tenn. Code Ann. § 63-2-101 | Working days; state deadline controls |
Tennessee (hospitals) | 30 calendar days | Tenn. Code Ann. § 68-11-304 | Calendar days |
Texas | 15 business days | Tex. Occ. Code § 159.006(d) | Business days; runs from receipt of written request and any applicable fees unless denied; TMB Rule 163.3 implements |
Utah | 30 calendar days | Utah Code § 78B-5-618 | Calendar days; matches HIPAA |
Vermont | HIPAA baseline (30 days) (charges only in statute) | 18 V.S.A. § 9419 | No response deadline confirmed in statute |
Virginia | 30 days + 30-day extension | Va. Code §§ 32.1-127.1:03, 8.01-413 | Day type not uniformly specified for access response |
Washington | 15 working days (to 21 with written notice) | Working days; state deadline controls | |
West Virginia | Reasonable time | W. Va. Code § 16-29-1 | Statute requires production within a reasonable period; no numeric deadline; HIPAA 30-day baseline applies for covered entities |
Wisconsin | Reasonable time (upon reasonable notice) | Wis. Stat. § 146.83 | Statute provides access upon reasonable notice; no numeric deadline; HIPAA 30-day baseline applies for covered entities |
Wyoming | 30 days or reasonable period, whichever shorter | Physicians only | |
District of Columbia | 30 calendar days (60-day maximum with notice) | D.C. Code § 3-1210.12 | 30-day deadline; D.C. day definition confirms calendar days |
How Calendar, Business, and Working Days Affect Compliance Dates
Day type changes the actual compliance date. A calendar-day deadline includes weekends and holidays, while business-day or working-day language excludes weekends and typically holidays.
Maryland's 21 working days under Md. Code, Health-Gen. § 4-309 equates to roughly four to five calendar weeks once weekends and holidays are excluded. Texas illustrates the same effect because its deadline under Tex. Occ. Code § 159.006(d) is 15 business days and applies after receipt of any applicable fees, unless the request is denied.
Arkansas provides that electronic-format medical records must be produced within thirty days after receipt under A.C.A. § 16-46-106, unless a different deadline is established under the Arkansas Rules of Civil Procedure or by the court. Where a statute does not specify day type, treating the period as calendar days identifies the earliest possible compliance date, subject to jurisdiction-specific counting rules.
Why Actual Delivery Can Differ From Statutory Turnaround Time
Actual delivery timelines reflect provider capacity, record format, and coordination across multiple providers. Those operational factors do not change the statutory deadline.
Common delivery variables include multiple electronic health record systems, document repositories, scanned files, multi-provider coordination, release-of-information queues, and authorization resubmissions. The HIPAA 30-day clock starts when the covered entity receives the request, so business-associate coordination uses part of the allotted window. Firms that treat prompt record collection as a case-management priority reduce the gap between the statutory deadline and real-world delivery.
Enforcement Options for Missed Medical Record Deadlines
When a provider fails to produce records within the applicable deadline, enforcement may proceed through federal administrative complaints or litigation compulsion. Understanding the provider compliance obligations that attach to a valid request clarifies when a delay becomes actionable. State attorney general and health department authority may also apply.
Federal HIPAA Enforcement
The federal track runs through the HHS Office for Civil Rights Right of Access Initiative. Any person who believes a covered entity violated HIPAA access rights may file a complaint through the OCR Complaint Portal.
Recent civil monetary penalties include a $200,000 penalty against OHSU enforcement on March 6, 2025. Civil monetary penalty tiers under 42 U.S.C. § 1320d-5 vary by culpability tier, with per-violation amounts set by regulation.
Under HITECH, state attorneys general may bring civil actions on behalf of state residents to obtain damages or enjoin further violations of the HIPAA Privacy and Security Rules.
State-Law Remedies
State-law remedies vary by jurisdiction. Louisiana's La. R.S. 40:1165.1 exposes a noncompliant provider to liability for reasonable attorney fees after a 5-day notice of failure, and New York's N.Y. Public Health Law § 18 permits appeal of denial to a Medical Record Access Review Committee.
HIPAA itself provides no private right of action.
Where the Statutory Timeline Framework Stands
Medical record retrieval turnaround time is governed by the interaction of the federal HIPAA 30-day baseline and state access statutes. The shorter deadline controls, and record production fees remain a separate issue addressed in state medical fees.
Applicable timelines depend on provider type, request type, day-counting language, and any state-specific extension rule. Legal AI tools support medical records, defensible chronologies, and documentation workflows tied to case preparation.
To learn more, book a demo.
