How to Request a Medical Record Amendment Under HIPAA

To request a medical record amendment under HIPAA, submit a written request to the provider or health plan that created the record, identify the specific entry you want changed, state the correction, and explain why the current entry is wrong. The provider then has 60 days to either make the change or send you a written denial. Federal law gives you this right under 45 CFR 164.526, and it applies to records your provider or insurer uses to make decisions about your care.1eCFR. 45 CFR 164.526 – Amendment of Protected Health Information

What Qualifies as an Amendable Error

Factual mistakes, missing information, and misleading entries are all fair game. A wrong diagnosis date, an omitted drug allergy, an incorrect medication dosage, a misspelled name on a billing record. If the entry is inaccurate or incomplete, you can ask to have it fixed.

What you cannot force is a change to a provider’s professional judgment. If your doctor recorded a clinical observation or opinion and documented it accurately, disagreement with the assessment is not a basis for amendment. Providers can also deny a request if they didn’t create the record, if the information isn’t part of your designated record set, if it falls into a category you wouldn’t be allowed to inspect in the first place, or if they conclude the entry is already accurate and complete.1eCFR. 45 CFR 164.526 – Amendment of Protected Health Information That last one is where most disputes happen.

Your right to request an amendment lasts as long as the provider or plan keeps the information on file. The records covered include medical records, billing records, and any other records used to make decisions about your care.2GovInfo. 45 CFR 164.501 – Definitions

What to Put in the Request

Providers can require amendment requests in writing and can require you to give a reason, as long as they’ve told you about those requirements in advance.1eCFR. 45 CFR 164.526 – Amendment of Protected Health Information In practice, almost every provider does. Many post an amendment form on their website or through the medical records department. Using their form is usually the quickest route.

Form or letter, include:

  • Your full legal name, date of birth, and current contact information so the provider can locate your file and reach you.
  • The specific entry you want changed. Give the date of the visit or service, the type of record (progress note, lab result, discharge summary), and a page or entry number if you have it.
  • The exact change you want. “Change documented allergy from amoxicillin to penicillin” is far more useful than “my allergies are wrong.”
  • A brief factual explanation of why the current entry is wrong. Attach copies of supporting documents if you have them: lab results from another provider, a letter from a specialist, pharmacy records.

Keep a full copy of everything you submit, supporting documents included. If the request is denied, you’ll need it.

How to Submit It

Check the provider’s website or call the health information management department for their specific instructions. Most providers accept requests by mail to the medical records department, through a secure patient portal, or in person. Mail goes to the records department’s designated address, not the general office. Portal submissions should be saved or screenshotted for confirmation. In-person delivery works best with a dated receipt.

The 60-day clock starts when the provider receives your request, not when you send it. Delivery confirmation is worth the small effort if timing later becomes an issue.

The 60-Day Deadline

The provider must act on your request within 60 days of receiving it.1eCFR. 45 CFR 164.526 – Amendment of Protected Health Information Acting on the request means granting the amendment or issuing a written denial. Simply acknowledging receipt doesn’t count.

If they can’t finish within 60 days, they get one extension of up to 30 additional days. To claim it, they must send you written notice before the original 60 days expires, with the reason for the delay and the date they expect to complete review.1eCFR. 45 CFR 164.526 – Amendment of Protected Health Information Only one extension is allowed, so the outer limit is 90 days. If 60 days pass with no answer and no extension notice, follow up in writing and document the silence.

If the Provider Approves the Amendment

The original entry doesn’t get erased. The provider appends the corrected information or links it to the original so both are visible, preserving the record’s integrity while making the correction clear.1eCFR. 45 CFR 164.526 – Amendment of Protected Health Information

You’ll get written confirmation that the amendment was accepted. The provider must also make reasonable efforts to share the correction with anyone you identify as having received the wrong information, and with anyone they know has the inaccurate information and might rely on it to your detriment.1eCFR. 45 CFR 164.526 – Amendment of Protected Health Information If your insurer received a record with a wrong diagnosis code, tell the provider so, and they must pass along the correction.

If the Provider Denies the Amendment

A denial has to come in writing, in plain language, and identify the specific basis for the refusal. It also has to tell you that you can submit a written statement of disagreement.1eCFR. 45 CFR 164.526 – Amendment of Protected Health Information A one-line “your request is denied” doesn’t meet the standard. Push back if that’s all you receive.

Submit a Statement of Disagreement

You can write a statement explaining why you disagree with the denial and why the record should be changed. The provider must attach it to your record, so it travels with your file in future disclosures.1eCFR. 45 CFR 164.526 – Amendment of Protected Health Information The provider may write a rebuttal and attach that too, but they have to give you a copy if they do. The record still isn’t changed, but future readers see your side.

File a Complaint With OCR

If the provider ignored your request, blew past the deadline without notice, or failed to give you a proper written denial, you can file a complaint with the Office for Civil Rights at the U.S. Department of Health and Human Services.3U.S. Department of Health and Human Services. Filing a Health Information Privacy Complaint OCR investigates HIPAA Privacy, Security, and Breach Notification Rule violations by covered entities and their business associates.

Complaints generally must be filed within 180 days of the violation. OCR may extend that window for good cause, but that isn’t guaranteed.4U.S. Department of Health and Human Services. HIPAA What to Expect If a provider is stonewalling, file sooner. You can still use the provider’s internal grievance process in parallel, but that doesn’t pause the 180-day clock.