Arizona Medical Records Law: Requests, Denials, and Appeals

Under Arizona medical records law, any healthcare provider holding your records must give you access to them, or copies, once you submit a written request. The governing statute is Arizona Revised Statutes 12-2293, and it covers both your medical records and your payment records.¹ A provider can only refuse on six specific grounds, and when the refusal involves a clinical judgment call, federal law gives you the right to have it reviewed.

The right extends to your health care decision maker as well, meaning anyone legally authorized to make medical decisions for you, such as an agent under a healthcare power of attorney or a court-appointed guardian.¹ “Access” can mean inspecting the records in person, getting copies, or both.

How to Request Records and What It Costs

The request has to be in writing. Arizona’s statute doesn’t give the provider a specific number of days to respond, but HIPAA does: a covered entity must act on your access request within 30 calendar days of receiving it.² One 30-day extension is allowed if the provider can’t meet the deadline, but only after sending you written notice of the reason and the new expected date. No second extension is permitted.³

Arizona lets providers charge a “reasonable fee” for reproducing your records, and except where the records are needed for continuity of care, the provider can require payment before releasing copies.⁴ The statute sets no per-page cap, so what one office charges can look very different from another. If a quote seems high, HIPAA is your lever: it limits charges to a cost-based fee covering labor for copying, supplies, and postage if you asked for mailed copies.

When a Provider Can Deny Access

Arizona law lists six grounds, and a provider cannot invent others. Four of them require a health professional (not an office administrator) to personally make the call:

Access is reasonably likely to endanger your life or physical safety, or someone else’s.
Your records reference someone other than a health professional, and release would likely cause that person substantial harm.
A health care decision maker is making the request, and granting it would likely cause substantial harm to you or another person.
The records contain information given under a promise of confidentiality by someone other than a health professional, and release would likely identify that source.¹

The other two don’t require a clinical judgment:

You agreed, as a condition of joining a clinical research study, to suspend access to your records during the study, and you were told access would be restored once it ended.
You’re an inmate, the provider is a correctional institution or acting under one’s direction, and release would jeopardize the health, safety, security, custody, or rehabilitation of you, other inmates, or staff.¹

What a Lawful Denial Looks Like

A provider refusing your request has three obligations. The denial and the reason for it must be documented in your medical record. You must receive a written explanation of why access was denied. And if only part of your record falls under one of the six grounds, the provider must still release everything else.¹

That last point matters. A reason to withhold one page is not a reason to withhold the whole file. If you get a blanket denial, the written explanation should give you enough to push back.

Appealing a Denial

If the denial rests on one of the three clinical-judgment grounds (safety, third-party harm, or harm by the decision maker), HIPAA gives you the right to a review by a different licensed health care professional who was not involved in the original decision. The covered entity designates the reviewer, must refer your request promptly, must give you written notice of the determination, and is bound by whatever the reviewer decides.⁵

Some grounds aren’t reviewable under HIPAA: psychotherapy notes, clinical research participation, correctional institution security, and confidential source protection.⁶ You don’t get the internal reviewer in those cases, but you still have the complaint route.

Whether or not a denial is reviewable, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. Complaints go through the OCR Complaint Portal or in writing.⁷ OCR investigates covered entities and can impose corrective action plans and financial penalties.

Psychotherapy Notes Are Treated Differently

One category of record sits outside the Arizona access rules entirely. Under 45 CFR 164.524, psychotherapy notes are excluded from the general right of access.⁶ A provider may share them but doesn’t have to.

The definition is narrow. Psychotherapy notes are the therapist’s private session-by-session notes analyzing what was discussed in counseling, and they must be kept separate from your main medical record. Medication records, session start and stop times, treatment frequency, diagnosis summaries, prognosis, and progress notes are not psychotherapy notes. Those sit in your regular medical record, and you have the same right to see them as any other record.

1
Arizona Legislature. Arizona Code 12-2293 – Release of Medical Records and Payment Records to Patients and Health Care Decision Makers; Definition
2
U.S. Department of Health and Human Services. How Timely Must a Covered Entity Be in Responding to Individuals’ Requests for Access
3
U.S. Department of Health and Human Services. Individuals’ Right under HIPAA to Access their Health Information
4
Arizona Legislature. Arizona Code 12-2295 – Charges
5
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
6
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
7
U.S. Department of Health and Human Services. Filing a Health Information Privacy Complaint