OCR provided technical assistance to the physician, explaining that, in general, the Privacy Rule requires that a covered entity provide an individual
access to their medical record within 30 days of a request, regardless of whether or not the individual has a balance due.
Another comment suggested that a requirement
to file a complaint with the Secretary
within 180 days of the alleged noncompliance is a problem because a patient may, because of his or her
medical condition, be unable
to access his or her
records within that time frame.