Medical Record Request Rules for Arkansas

Introduction

Accessing personal health information in Arkansas requires familiarity with a specific regulatory framework that differs from neighboring states. The medical record request rules for Arkansas combine federal HIPAA requirements with state-level statutes that govern timelines, fees, and authorization procedures. Arkansas Code Annotated § 16-46-106 and related provisions establish the baseline for how healthcare providers must respond to patient requests, while HIPAA's Privacy Rule sets the federal floor that Arkansas regulations build upon.

Patients, attorneys, insurance companies, and healthcare facilities each interact with these rules differently, and misunderstanding the process leads to delays, unexpected costs, and incomplete records. Arkansas does not maintain a centralized medical records repository, meaning requests must go directly to each provider or facility that holds relevant documentation. The state permits electronic delivery but does not mandate it, creating variability in how different providers fulfill requests. Understanding these nuances before initiating a request prevents common pitfalls that delay access to critical health information.

Key Takeaways

Arkansas law requires providers to respond to medical record requests within 30 days, with a possible 30-day extension under specific circumstances.
Fees are capped at $25 for the first 25 pages and $0.50 per page thereafter, plus actual postage costs.
Written authorization using HIPAA-compliant forms is mandatory for third-party requests.
Patients may designate electronic delivery, though providers are not required to offer specific formats.
Mental health and substance abuse records carry additional authorization requirements under state and federal law.

Who Can Request Medical Records in Arkansas

Arkansas law grants several categories of individuals the right to access medical records. The patient holds primary authority and can request records without providing justification. For minors, parents or legal guardians exercise this right unless the minor has been legally emancipated or the records concern treatment the minor could consent to independently, such as certain reproductive health services.

Personal representatives of deceased patients may access records upon providing documentation of their authority, typically through probate court appointment. Attorneys may request records with proper patient authorization or through subpoena, though subpoenas without patient consent require compliance with HIPAA's procedural safeguards. Insurance companies and other third parties must present valid authorization forms signed by the patient.

Patients aged 18 and older
Legal guardians of minors
Personal representatives of deceased patients
Attorneys with proper authorization or valid subpoena
Insurance companies with signed release forms
Other healthcare providers for treatment purposes

How to Submit a Medical Record Request in Arkansas

The request process begins with identifying the correct recipient, typically the health information management or medical records department at each facility. Arkansas does not prescribe a specific state form, so most facilities use their own authorization documents that must comply with HIPAA requirements. A valid authorization must include patient identification, description of records requested, purpose of disclosure, expiration date, and signature.

Requests should be submitted in writing, either by mail, fax, or through patient portal systems where available. Verbal requests are insufficient for third-party disclosures. Facilities may require identification verification, particularly for in-person pickups.

Obtain the facility's authorization form or use a HIPAA-compliant template
Complete all required fields including date ranges and record types
Submit via certified mail to create a paper trail with delivery confirmation
Retain copies of all submitted documentation
Follow up after 15 business days if no acknowledgment is received

Response Timeframes

Arkansas follows HIPAA's 30-day response requirement for patient access requests. Providers must either fulfill the request or provide written notice of extension within this window. Extensions are limited to an additional 30 days and require written explanation to the requestor detailing the reason for delay.

The clock starts when the facility receives the request, not when it processes or logs it internally. For requests involving records stored off-site or requiring compilation from multiple departments, the 30-day period still applies. Providers who consistently miss deadlines may face complaints to the Arkansas Attorney General's office or the federal Office for Civil Rights.

Initial response deadline: 30 days from receipt
Maximum extension: 30 additional days with written notice
Extension notice must explain the reason for delay
Repeated violations may trigger regulatory investigation

Fees & Costs

Arkansas Code § 16-46-106 establishes fee caps that providers cannot exceed. The statutory maximum is $25 for the first 25 pages and $0.50 for each additional page. Actual postage costs may be added. These limits apply to paper copies; electronic copies provided on portable media may include the cost of the medium itself.

Providers cannot charge search and retrieval fees separate from the per-page costs. Patients who request records for treatment purposes from another provider within the same healthcare system should not be charged, as this falls under treatment, payment, and healthcare operations exceptions.

First 25 pages: maximum $25 total
Pages 26 and beyond: $0.50 per page
Postage: actual cost
Electronic media: reasonable cost of the medium
No separate search or retrieval fees permitted

Delivery Formats

Arkansas law does not mandate specific delivery formats, but HIPAA requires providers to accommodate reasonable format requests when feasible. Patients may request paper copies, electronic files on CD/DVD or USB drive, or transmission through secure electronic means. The requesting party should specify the preferred format in the initial authorization.

Most Arkansas hospitals now offer patient portal access where records can be downloaded directly. Smaller practices may lack electronic delivery capabilities. When electronic format is requested but unavailable, providers must offer an alternative and cannot simply deny the request.

Paper copies via mail or in-person pickup
Electronic files on portable media
Secure email transmission where available
Patient portal download
Fax transmission for urgent requests

State-Specific Exceptions or Gotchas

Arkansas maintains specific protections for certain record categories that exceed standard HIPAA requirements. Mental health records require separate authorization from general medical records under Arkansas Code § 20-46-101 et seq. Substance abuse treatment records fall under 42 CFR Part 2, requiring even more stringent consent procedures that cannot be bypassed by standard medical records authorizations.

HIV/AIDS test results carry special confidentiality protections under Arkansas Code § 20-15-903, requiring explicit authorization mentioning HIV status disclosure. Workers' compensation records may be accessible to employers and insurers without patient authorization when related to a compensable claim.

Mental health records: separate authorization required
Substance abuse records: 42 CFR Part 2 consent mandatory
HIV/AIDS records: explicit HIV-specific authorization needed
Workers' compensation: employer access permitted for claim-related records
Minors' reproductive health: may be protected from parental access

Common Problems Patients Encounter

Delays represent the most frequent complaint, often stemming from incomplete authorization forms or requests sent to incorrect departments. Facilities that have undergone mergers or name changes create confusion about where records are actually stored. Providers sometimes misapply fee schedules, charging above statutory limits or adding unauthorized fees.

Electronic delivery requests frequently encounter technical barriers, with facilities claiming inability to provide specific formats. Requests for records from closed practices require additional research, as records may have been transferred to successor practices or state archives.

Incomplete or improperly signed authorization forms
Requests misdirected to wrong facility or department
Overcharging beyond statutory fee caps
Denial of electronic format requests without valid justification
Difficulty locating records from closed or merged practices
Confusion over authorization requirements for protected record types

Conclusion

Navigating Arkansas medical record request rules requires attention to statutory fee caps, response deadlines, and special authorization requirements for protected record categories. The 30-day response window, $25 base fee for initial pages, and separate consent requirements for mental health and substance abuse records distinguish Arkansas from states with simpler frameworks.

Successful requests begin with proper documentation: complete authorization forms, clear specification of date ranges and record types, and submission to the correct facility department. Tracking submission dates and following up proactively prevents requests from falling through administrative cracks. When providers fail to comply with statutory requirements, patients may file complaints with the Arkansas Attorney General or the federal Office for Civil Rights.

Frequently Asked Questions

Can Arkansas providers deny a medical records request?

Providers may deny requests in limited circumstances, including when records contain information about another individual, when disclosure could endanger someone, or when the request involves psychotherapy notes. Denials must be in writing with explanation and appeal rights.

How long must Arkansas providers retain medical records?

Arkansas requires retention for at least 10 years from the date of last treatment for adults. Records of minors must be retained until the patient reaches age 22 or for 10 years, whichever is longer.

Can fees be waived for patients who cannot afford them?

HIPAA does not require fee waivers, but some Arkansas facilities have indigency policies. Patients should ask about financial hardship provisions before assuming fees cannot be reduced.

What if a provider no longer exists?

Closed practices must transfer records to successor providers or arrange for storage. The Arkansas State Medical Board may have information about where records from closed practices were transferred.

Sources

Arkansas Code Annotated § 16-46-106
Arkansas Code Annotated § 20-46-101 et seq.
Arkansas Code Annotated § 20-15-903
45 CFR § 164.524 (HIPAA Privacy Rule)
42 CFR Part 2 (Substance Abuse Records)
Arkansas State Medical Board Regulations