When a nursing home won’t release medical records, the facility is almost always violating federal law, not exercising a legitimate right to refuse. A current resident is entitled to inspect their records within 24 hours of asking and to receive copies within two working days. Anyone else with legal authority to request records, including former residents and personal representatives, has a right to a response within 30 days under HIPAA. If those windows have passed and you’re still waiting, you have four escalation paths, and the last two carry penalties serious enough that most facilities fold long before an investigator arrives.
The Deadlines the Facility Is Missing
Two different federal rules apply, and knowing which one covers your situation tells you how overdue the facility already is.
Under 42 CFR 483.10, any Medicare- or Medicaid-certified nursing home must let a resident view their personal and medical records within 24 hours of a request, excluding weekends and holidays. The request can be verbal or written. Copies of records must be provided within two working days.1eCFR. 42 CFR 483.10 – Resident Rights The same 24-hour inspection right sits in the underlying federal statute for skilled nursing facilities.2Office of the Law Revision Counsel. 42 USC 1395i-3 – Requirements for, and Assuring Quality of Care in, Skilled Nursing Facilities
HIPAA’s Privacy Rule sets a longer window: 30 calendar days after the facility receives the request.3U.S. Department of Health & Human Services. How Timely Must a Covered Entity Be in Responding to Individuals’ Requests for Access to Their PHI? A single 30-day extension is allowed if records are archived or off-site, but only if the facility notifies you in writing within the first 30 days, explains the delay, and gives a specific delivery date. Silence during that window is itself a violation.
The 24-hour and two-day deadlines govern when the person asking is a current resident. HIPAA’s 30-day window governs when you’re a personal representative, when the resident has already left the facility, or when records need to go to a third party. Whichever applies to you, if the window has closed, the facility is out of compliance and you can start escalating.
Whether You Have the Right to Ask
Before assuming the facility is stonewalling, confirm you actually have legal standing to make the request. This is the one legitimate reason a nursing home refuses that isn’t a violation.
The Resident
A current or former resident can request their own records directly, including physician notes, lab results, medication records, care plans, and billing records. A current resident’s verbal request triggers the 24-hour and two-working-day deadlines.1eCFR. 42 CFR 483.10 – Resident Rights
Personal Representatives
A personal representative is someone with legal authority to make healthcare decisions for the resident, usually through a healthcare power of attorney or court-appointed guardianship. HIPAA requires the facility to treat this person the same as the patient for records access.4HHS.gov. Personal Representatives Attach a copy of the authorizing document to your request.
One narrow exception: a facility may refuse a personal representative if it has reason to believe that person is subjecting the resident to abuse or neglect, or that honoring the request would endanger the resident.5Department of Health & Human Services. Personal Representatives and Minors
Family Members Without Legal Authority
This is where most families get stuck. A spouse, adult child, or sibling has no automatic right under federal law to a living resident’s medical records. Without a healthcare power of attorney, guardianship, or written authorization from the resident, the facility can and should refuse. If the resident can still communicate, have them sign a written request naming you as the recipient. If they can’t, you may need to seek guardianship through a local court.
After the Resident’s Death
HIPAA protections continue for 50 years after death. During that period, the personal representative of the estate, such as an executor or administrator appointed by a probate court, has the right to access records.6HHS.gov. Health Information of Deceased Individuals Bring letters testamentary or letters of administration when you request records.
Family members who were involved in the deceased person’s care but aren’t the estate’s representative sit in a gray zone. HIPAA permits, but doesn’t require, a facility to share relevant information with them, provided doing so doesn’t conflict with a preference the deceased expressed while alive.6HHS.gov. Health Information of Deceased Individuals Because the facility has discretion, becoming the estate’s formal representative is often the only way to guarantee access.
The Narrow List of Legal Reasons for Denial
If the facility denies your request, it must do so in writing, explain the basis, describe your right to have the decision reviewed, and tell you how to file a complaint with HHS.7U.S. Department of Health & Human Services. Under What Circumstances May a Covered Entity Deny an Individual’s Request for Access to the Individual’s PHI? A denial without that written explanation is already a violation.
The valid grounds are short:
- The requester hasn’t shown they are the patient or a legally authorized representative.
- A licensed healthcare professional concludes, in professional judgment, that releasing the records is reasonably likely to endanger the life or physical safety of the patient or another person.7U.S. Department of Health & Human Services. Under What Circumstances May a Covered Entity Deny an Individual’s Request for Access to the Individual’s PHI?
What isn’t a legal reason: an unpaid bill for care. A facility cannot condition records access on payment.8HHS.gov. May a Health Care Provider Withhold a Copy of an Individual’s PHI? Also not a legal reason: suspicion that you plan to use the records for a lawsuit. HIPAA prohibits requiring a reason for your request in the first place, and knowing your purpose is not a valid basis to deny.7U.S. Department of Health & Human Services. Under What Circumstances May a Covered Entity Deny an Individual’s Request for Access to the Individual’s PHI?
Identity verification is allowed, but HIPAA sets no specific form of it. A facility that keeps demanding new documents as a stalling tactic is creating an unreasonable barrier, which is itself a violation.9U.S. Department of Health & Human Services. Individuals’ Right under HIPAA to Access their Health Information 45 CFR 164.524
Put the Request in Writing and Send It Certified
A current resident can request records verbally, but written requests are the smart move for anyone who might need to escalate. A written record starts the legal clock and gives you evidence to hand to an investigator later.
Ask whether the facility has its own release form. If not, write a letter including the resident’s full name, date of birth, and dates of residence, along with a clear description of the records you need. “All records” is a valid request; specifying a date range or type (nursing notes, medication administration records, physician orders) can speed things up. Personal representatives should attach the document granting their authority.
Send it by certified mail with return receipt requested. That receipt is your proof of when the facility got the request, and it fixes the date the 24-hour, two-working-day, or 30-day clock started running.
The Escalation Ladder
When the deadline passes with no records and no adequate written response, you have four escalation paths. Each one applies more pressure than the last.
Start With the Facility’s Privacy Officer
Every facility covered by HIPAA must designate a privacy official responsible for compliance and a contact person for complaints.10U.S. Department of Health & Human Services. Summary of the HIPAA Privacy Rule – Section: Administrative Requirements Ask to speak with that person by name. Sometimes the records department is simply disorganized, and a direct conversation with the person whose job depends on compliance resolves things fast. Put your internal complaint in writing and keep a copy.
Contact the Long-Term Care Ombudsman
Every state has a Long-Term Care Ombudsman program under the Older Americans Act. Ombudsmen investigate and mediate complaints between residents and facilities, including complaints about residents’ rights.11ACL Administration for Community Living. Long-Term Care Ombudsman FAQ They can often move a records dispute without you having to file a federal complaint, and they can point you to legal remedies if mediation fails. Find your local program through the Eldercare Locator at 1-800-677-1116 or the Administration for Community Living’s website.
File a Complaint With the HHS Office for Civil Rights
The Office for Civil Rights (OCR) enforces HIPAA. Complaints go through the OCR Complaint Portal and must be filed within 180 days of when you learned about the violation, though OCR can extend that deadline for good cause.12HHS.gov. How to File a Health Information Privacy or Security Complaint
Identify the facility, describe when you submitted your request, what response you received or didn’t, and why you believe your rights were violated. If OCR accepts the case for investigation, it notifies both you and the facility. OCR has pursued dozens of enforcement actions specifically for records-access violations, with financial penalties from $15,000 to over $200,000 per case.
File With the State Survey Agency
Because the 24-hour and two-working-day timelines come from CMS nursing home regulations rather than HIPAA, a HIPAA complaint alone may not capture a violation of those faster deadlines. Each state has a survey agency that inspects nursing homes and investigates regulatory violations, working with the Centers for Medicare and Medicaid Services.13CMS. Contact Information for State Survey Agencies The agency can issue deficiency citations that affect the facility’s Medicare certification. A facility that risks losing federal reimbursement tends to move quickly.
What the Facility Risks
HIPAA civil penalties scale with the facility’s culpability. For 2026, the per-violation ranges are:
- No knowledge of the violation: $145 to $73,011
- Reasonable cause, not willful neglect: $1,461 to $73,011
- Willful neglect, corrected within 30 days: $14,602 to $73,011
- Willful neglect, not corrected within 30 days: $73,011 to $2,190,294
The annual cap for all violations of the same provision is $2,190,294, and HHS adjusts these figures each year. A facility that knowingly ignores records requests and refuses to fix the problem lands in the top tier, and OCR has imposed six-figure penalties on providers for exactly that pattern.
On the state side, a survey agency finding that a facility violated residents’ access rights can result in deficiency citations, mandatory corrective action plans, and, in serious cases, conditions on the facility’s continued participation in Medicare and Medicaid. For any nursing home that depends on federal reimbursement, that last consequence can be existential, and naming it in your escalation letter often gets attention when nothing else has.