How to Request a Medical Record Addendum Under HIPAA

To request a medical record addendum under HIPAA, send your provider a written amendment request that identifies the specific entry you believe is wrong, states the correction you want, and explains why. The provider then has 60 days to either append the correction to your file or deny it in writing. Nothing gets erased either way. If the amendment is accepted, the original entry stays and the correction is linked alongside it; if it is denied, you have a formal right to add a statement of disagreement that travels with the record from that point on.¹

What to Put in the Written Request

A provider is allowed to require your request in writing and to require you to explain the reason for the change, as long as they told you about those requirements ahead of time.¹ Beyond that, HIPAA does not prescribe a universal form. Individual facilities use their own. Most ask for the same core information:

Your identifying details: full legal name, date of birth, and medical record or patient ID number. HIPAA itself does not require you to hand over a Social Security number to request an amendment.
The specific entry at issue: the date of service, the clinician who wrote the note, and the exact portion of the record you believe is inaccurate or incomplete.
The correction you want made: propose the specific change. If a medication name is misspelled, give the correct spelling. If a diagnosis code looks wrong, identify the code you believe belongs there if you can.
A short reason: a factual explanation of the error or omission. Something like “The record states I take lisinopril 20mg, but my prescription was changed to 10mg on March 3” is the level of detail that moves things forward.

Get the form from the facility’s Health Information Management department or its designated Privacy Officer. Many providers post it in the patient portal. Vague requests that do not point at a specific entry tend to come back for more detail, so precision here saves weeks.

Your right to amend applies to information in what HIPAA calls a designated record set: the medical and billing records your provider maintains, the enrollment, payment, and claims records a health plan maintains, and any other records a covered entity uses to make decisions about you.² The right lasts as long as the record itself is kept, so an error from years ago is still correctable if the entry is still on file.¹

How to Submit It

Getting the request to the right department, with proof of when it arrived, matters because the response clock starts on receipt.

Certified mail with return receipt creates a verifiable delivery date if the timing is ever disputed.
A secure patient portal upload is usually the fastest route and gives you a timestamp on submission.
In-person delivery works if you ask for a date-stamped copy or written acknowledgment.

Keep a copy of the completed form with the submission date. A provider cannot charge you a fee to process the amendment request.

The 60-Day Response

After receiving the request, the provider has 60 days to act. They can extend that deadline once, by up to 30 more days, but only if they give you a written explanation of the delay and a specific date they will respond by. There is no second extension. The outer limit is 90 days from receipt.¹

If the Amendment Is Accepted

The provider appends the amendment to your record or creates a link between the original entry and the new information. The original note is not deleted. The addendum sits alongside it, so any future reviewer sees both.¹

The provider must also notify you the amendment was accepted and then work with you on who else should receive the correction. The regulation requires reasonable efforts to send the amendment to two groups: people you identify as having received the inaccurate information and needing the correction, and people the provider knows have the information and might rely on it in ways that could harm you. In practice, that second group often includes health plans that used the original data for claims decisions and specialists who received referral records containing the error.¹

If the Amendment Is Denied

A denial must come in writing, in plain language, and cite a specific permissible ground. It must also explain your right to submit a written statement of disagreement and how to file one.¹

Your statement of disagreement becomes a permanent part of your medical record. The provider can set a reasonable length limit on it, though the regulation does not define one. From then on, whenever the provider discloses the disputed portion of the record, they must include your statement or an accurate summary of it. The provider can also write a rebuttal and must give you a copy if they do. The end result is that the file contains the original entry, the denial, your disagreement, and any rebuttal, and every future recipient sees all of it.¹

The Four Grounds a Provider Can Use to Deny

HIPAA lists exactly four reasons a provider can refuse an amendment:¹

The provider did not create the record. If another clinician or facility authored the entry, your current provider can generally refuse and point you back to the originating entity. The narrow exception is when the original author is no longer available to act on the request.
The record is not part of the designated record set. Information kept outside the records used to make decisions about you falls outside the amendment right.
The record is one you would not be entitled to inspect. Certain categories of protected health information are exempt from your right of access under 45 CFR 164.524, and those same records are exempt from amendment.³
The record is already accurate and complete. If the provider reviews the entry and concludes the existing documentation is correct, that is a sufficient ground on its own.

Most disputes come down to that last ground. The patient sees an error; the clinician believes the clinical evidence supports what is written. HIPAA does not give either side an automatic win on the substance, but the statement of disagreement guarantees the patient’s version travels with the record.

If the Provider Ignores the Rules

If a provider ignores your request, misses the 90-day outer deadline, or denies without a proper written explanation, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. You have 180 days from when you knew or should have known about the violation, though OCR can extend that period for good cause.⁴

Complaints go through the OCR Complaint Portal at ocrportal.hhs.gov, or by mail, fax, or email. You will need your contact information, the name and address of the entity, a description of what happened and when, and a signed consent form.

HIPAA also prohibits retaliation for filing a complaint. If a provider cuts off care, restricts access to your records, or takes any adverse action after you file, that retaliation is itself a separate violation you can report to OCR.⁴

1
eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
2
eCFR. 45 CFR 164.501 – Definitions
3
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
4
U.S. Department of Health and Human Services. How to File a Health Information Privacy or Security Complaint