ChartRequest is Proudly Partnered With
The Arizona HB 2557 medical records deadline is not one universal seven-business-day rule. The final law adds a seven-business-day access requirement for written requests from patients and health care decision makers. It also establishes 10-business-day, 15-business-day, and 30-calendar-day response timeframes for defined medical record request categories.
The operational challenge starts at intake. Staff must identify who submitted the request, whether it is written, why the records are needed, and whether it seeks medical records, payment records, or both. They also need the record age and current EHR status.
The obvious response is to shorten the retrieval target. That will not solve a request that reaches HIM late, enters the wrong workflow, or waits without an owner.
HB 2557 takes effect September 12, 2026. Arizona providers should establish one receipt record, counsel-approved classification rules, and a clear escalation path before then.
What Did Arizona HB 2557 Change About ARS 12-2293?
Before HB 2557, ARS 12-2293 required providers to give patients or their health care decision makers access to medical records and payment records after a written request. The statute did not state a specific turnaround time.
The chaptered text of HB 2557 adds two timing provisions:
Subsection A requires providers to give access or copies promptly and within no more than seven business days.
Subsection E requires providers to respond within 10 business days, 15 business days, or 30 calendar days for specified medical record request categories.
The distinction between “provide access or copies” and “respond” matters. Chapter 98 does not define a sufficient subsection E response. It also does not clearly resolve requests involving current treatment, records divided between age categories, or records split between current and legacy systems.
The law defines upcoming medical treatment as a scheduled or anticipated service or consultation but does not define “anticipated.” Providers should have Arizona counsel approve the information staff need before selecting that category. They also should not treat every response timeframe as a deadline for completing the release unless counsel approves that interpretation.
Which Arizona HB 2557 Medical Records Deadline Timeframe Applies?
| Request Category | Statutory Requirement |
| Written request by a patient or health care decision maker under subsection A | Provide access or copies promptly and within no more than seven business days, subject to the statutory denial provisions |
| Request by a patient or health care decision maker for upcoming medical treatment, with medical records less than 12 months old and maintained in the current EHR | Respond within 10 business days after receipt |
| Request by a patient or health care decision maker for upcoming medical treatment, with medical records at least 12 months old and maintained in the current EHR | Respond within 15 business days after receipt |
| Request for medical records for a purpose other than upcoming medical treatment | Respond within 30 calendar days |
The table preserves the statute’s different verbs. The 30-calendar-day category expressly includes litigation, personal copies not identified as necessary for upcoming medical treatment, life insurance, payor and school requests, deceased-patient records, and other requests unrelated to current or upcoming medical treatment. A provider-payor contract may specify another timeframe.
These timing provisions do not independently authorize disclosure. Providers must still apply the authorization, privacy, and disclosure rules that govern the request.
Payment records need separate attention. Subsection E addresses medical records only, while subsection A also covers payment records. Staff therefore need to identify whether a request seeks medical records, payment records, or both. Providers should have counsel confirm how to handle combined requests.
Subsection F states that the response-timeframe provision does not require providers to create or compile records that do not otherwise exist.
When Does the Arizona HB 2557 Medical Records Deadline Take Effect?
HB 2557 was approved by the governor on June 4, 2026, and filed with the secretary of state on June 5 as Chapter 98. Arizona’s official general effective-date table lists September 12, 2026, as the effective date for the session.
Policy review, system configuration, testing, and staff training should be complete before that date.
HHS Right of Access timing guidance generally requires covered entities to act on an individual access request within 30 calendar days after receipt. HIPAA permits one additional 30-day extension with timely written notice.
Several Arizona timeframes are shorter, but this is not a simple seven-day versus 30-day comparison. HB 2557 varies by request purpose, record type, record age, and record location. More broadly, state medical record laws can add requirements beyond the federal baseline.
Where Are Arizona Workflows Most Likely to Miss the Medical Records Deadline Timeframe?
The greatest risk is a request that becomes visible too late.
A request may remain at the front desk, sit in a general portal inbox, or move to a practice manager without the original receipt date. HIM may retrieve clinical records while payment records remain with another department. In smaller practices, these responsibilities may sit with a practice manager, front desk lead, billing team, or privacy contact.
Staff need to answer six questions at intake:
- Is the request written?
- Who submitted it, and what authority does the requestor have?
- Does it seek medical records, payment records, or both?
- Are the records needed for current or upcoming medical treatment?
- How old are the records?
- Are they maintained in the current EHR?
Late answers create rework, patient status calls, rushed review, and a weaker record of how the provider handled the request. Identity verification, privacy review, and potential denials also need named owners.
Federal Right of Access enforcement cases show how unclear ownership and inconsistent follow-up can turn an ordinary request into a compliance issue.
What Denial Grounds Do Providers Retain?
HB 2557 preserves six narrow denial provisions within four practical categories:
- Access that is reasonably likely to endanger someone’s life or physical safety, plus the statute’s two specific substantial-harm situations
- Information obtained from someone other than a health professional under a promise of confidentiality when access is likely to reveal the source
- A temporary research-related restriction accepted during consent when the patient was told access would return after the research ends
- Inmate access when the provider is a correctional institution or acts under its direction and the specified health, safety, security, custody, rehabilitation, or transportation risks are present
A denial must be documented, and the patient or health care decision maker must receive a written explanation. The provider must still release information for which subsection B provides no basis to deny access.
Potential denials need a defined clinical or privacy review path rather than informal approval in the general queue.
How ChartRequest Helps Arizona Providers Keep Requests Moving
Preparing for the Arizona HB 2557 medical records deadline requires more than a shorter retrieval target. Providers need request dates, progress, and exceptions visible from intake through completion.
We help move release work out of disconnected inboxes, spreadsheets, and local tracking systems. Providers can manage fulfillment in-house with our release of information software or use managed ROI services when staffing capacity is part of the problem. Depending on the solution, requestors can also receive real-time status visibility, reducing manual updates and status calls.
Providers and counsel remain responsible for interpreting HB 2557 and making disclosure or denial decisions. We help carry those decisions through a documented workflow with audit history and request-level accountability supported by SOC 2 Type II audited controls.
Schedule an operational review to map your process, identify where requests lose time, and prioritize the automation or staffing support needed to beat request deadlines.
Frequently Asked Questions
Does Every Request Have a Seven-Business-Day Deadline?
No. Subsection A requires access or copies within seven business days after a written patient or health care decision maker request. Subsection E separately establishes 10-business-day, 15-business-day, and 30-calendar-day response timeframes for defined medical record requests.
Does HB 2557 Address Litigation and Payor Requests?
Yes. Subsection E places litigation-purpose and payor requests in the 30-calendar-day category. A provider-payor contract may specify another timeframe. The timing provision does not authorize disclosure by itself. Other authorization, privacy, and disclosure requirements still apply.
How Should Providers Handle Payment Record Requests?
Subsection A covers payment records and requires access or copies within seven business days after a written patient or health care decision maker request. Subsection E addresses medical records only. Providers should have counsel approve the rule for combined medical and payment record requests.
What Should Arizona Providers Do First?
Start with intake. Confirm that every request receives a documented receipt date, an assigned owner, and enough information to identify its approved response path.
Facebook
Twitter
LinkedIn
Stay Updated
100% Privacy. No spam guaranteed.
