Quick answer
For a certified nursing facility, start with the resident-access rights in 42 CFR 483.10(g)(2): access within 24 hours excluding weekends and holidays, and copies on request with two working days advance notice. Reconcile those rights with HIPAA and applicable state law. A generic HIPAA 30-day queue is not a suitable nursing-facility response standard.
Put the nursing-facility clock on the request
A resident asks on Friday morning to inspect personal and medical records and obtain copies. The clerk selects “HIPAA request” and the application assigns a date 30 days away. That configuration misses the faster facility-specific rights.
42 CFR 483.10(g)(2) requires access within 24 hours excluding weekends and holidays; it permits copies upon request and two working days advance notice. It also addresses requested formats and limited cost-based copy charges. HIPAA's access rule supplies a separate framework for designated record sets, access decisions, delivery and review rights. State law can add protections. Configure a reviewed combination of applicable rules, not a single label that silently substitutes one regime for another.
For a Friday 10 a.m. request with no intervening holiday, the 24-hour clock excluding the weekend reaches Monday 10 a.m. A copy request requires its own two-working-day calculation. Have the facility's qualified reviewer establish how the applicable calendar and notice convention are implemented; do not turn that calculation into permission to delay records already available. Capture inspection and copies as separate requested outputs, with actual completion times.
Locate the record by purpose, not by screen
The resident asks for “my records,” not “the screens in the new application.” Before procurement, HIM should map the information maintained by or for the organization and identify which records fall within the applicable request. The HIPAA designated record set can include medical and billing records and other records used to make decisions about individuals. Storage outside the EHR does not by itself remove a record from scope.
Use a request-specific locator such as this original example:
| Requested component | Likely location | Completeness check | Release decision |
|---|---|---|---|
| Current clinical record | Production EHR | Encounter/date range, attachments, amended versions | Included items and any qualified exception |
| Prior admission | Retired system or archive | Correct resident linkage and readable documents | Retrieval assigned before deadline |
| Billing information | Finance application | Requested periods and account linkage | Included if within applicable scope |
| Outside records maintained locally | Document repository | Original attachments and indexing | Review actual maintained information |
| Decision-support record used about resident | Relevant operational system | Identify source and retained output | Determine designated-record-set status |
This is a discovery structure, not a rule that every object must be released. The reviewer decides scope and any permitted denial under the applicable legal framework. The system must preserve that decision and deliver accessible portions when only part of the request is denied.
Reconcile an actual delivery
In a fictional test, the locator identifies 42 clinical documents, six scanned attachments and one billing statement. The expected package has 49 items. The export contains the 42 clinical documents and the statement: 43 items delivered, with six attachments missing. Resolve those six explicitly. Even matching totals would not prove identity or completeness if one resident’s document were duplicated and another requested item omitted.
Use an item manifest with stable identifiers, date range, source, inclusion status and exception reason. Reconcile the requested population to included items, duplicates intentionally excluded and items receiving a qualified disposition. Open a sample of every format, including the oldest archive and a multipage attachment. Check that the intended recipient can use the agreed delivery method and record when access or copies actually became available. A queued email is not proof that its attachment was usable.
If the requested format is not readily producible, document the agreed alternative without restarting the original intake date. Fee configuration deserves its own review: the nursing-facility rule identifies permitted copy-cost components. A general “records processing” charge should not appear simply because the billing module supports it.
Buy a request service that survives a platform change
Require the proposed arrangement to demonstrate an oral request, a mixed current/archive request, inspection plus copies, an accessible electronic delivery, and a partial denial routed to the appropriate reviewer. Test a weekend and a holiday using the facility's approved calendar. Confirm who can retrieve records maintained by a business associate and how retrieval is tracked while the facility remains responsible for its response.
Acceptance should require a completed request history: original scope, authority verification, applicable clocks, locator, reviewed exclusions, delivery evidence and any follow-up. This gives HIM a way to prove that the resident received the requested result, rather than merely proving that staff clicked “export.”
Questions & answers
Does an EHR portal satisfy every record request?
Only if the actual request is fulfilled. Records in billing, scanned documents, archives or other designated record sets may not appear in the portal.
Can the facility require every request to use its form?
The nursing-facility rule expressly recognizes oral or written access requests. Design intake to capture an oral request without making completion of a preferred form an access barrier.
Primary sources
Use the cited source and its applicable version when making a facility-specific decision. These guides explain operational evaluation methods; they are not individualized clinical, coding, or legal advice.