What is the patient right of access?
The federal right that lets a patient get their own records, and direct them anywhere, is the legal spine of patient-mediated access.
Your medical records are legally yours. That is not a slogan, it is federal law. And yet the standard way to get them is still a signature, a fax, and a two-week wait for a stack of scanned pages sorted by no one.
The law that makes them yours is the patient right of access. If you are building a product that depends on a patient's record, it is also the most important sentence of regulation you will work with, because it is what lets a patient hand you a complete history without a contract with every provider who ever treated them.
What the right of access actually says
Under HIPAA (45 CFR 164.524), an individual can get a copy of their own protected health information from any provider or health plan that holds it. It covers the full designated record set, in the form the patient asks for where feasible. The covered entity has to act within 30 calendar days (one 30-day extension allowed), and it can only charge a reasonable, cost-based fee.
The part that matters most for a product: the patient can direct that copy to a third party they name. The record does not have to come back to the patient and stop there. They can send it onward, to an app, a new care team, or a firm representing them.
What the Cures Act added
The 21st Century Cures Act put teeth behind all of this. Its information-blocking rules prohibit providers, health IT developers, and exchanges from unreasonably getting in the way of electronic health information, and they push that information to move through standardized APIs instead of paper. The right of access says the record is the patient's. Cures says it has to actually flow.
Why this is the spine of patient-mediated access
A right on paper still leaves someone chasing records portal by portal. Patient-mediated access is what turns the right into a record you can build on.
The patient verifies their identity, authorizes the request once, and Hubble retrieves their history across every system they have touched, then returns it normalized into one structure. No per-provider contract, no integration project, no fax. Specially protected records (substance use, psychotherapy notes, and others) are never swept into a general request. They require their own specific authorization.
If your product waits on a complete record, the right of access is how you stop waiting. You can test it yourself on test data.
Frequently asked questions
What is the patient right of access?
The patient right of access is the individual's right under HIPAA (45 CFR 164.524) to get a copy of their own medical records from any provider or health plan that holds them, and to direct that copy to a third party they name. It applies to records in almost any form and covers the whole designated record set.
What did the 21st Century Cures Act change?
The Cures Act added information-blocking rules that prohibit providers, health IT developers, and exchanges from unreasonably interfering with access to electronic health information, and it pushed that information to flow through standardized APIs. Together with the HIPAA right of access, it means a patient can authorize an app or company to retrieve their record without a fax or a special-effort request.
How long does a provider have to respond to a right-of-access request?
Under HIPAA, a covered entity must act on a request no later than 30 calendar days after receiving it, with one 30-day extension allowed. The fee it can charge is limited to a reasonable, cost-based amount.
How does patient-mediated access use the right of access?
Patient-mediated access operationalizes the right of access. The patient verifies their identity, authorizes the request once, and Hubble retrieves their record across every system they have touched and returns it in one normalized shape, with the patient directing where it goes.