HIPAA requires covered entities (health plans and most healthcare providers) to provide patients, upon request, access to their protected health information (PHI) within 60 days. There is no standardized form; however, there are several sources that provide a template such as through a newly released sample form available from AHIMA.org (search Patient Request) or within this book (also an excellent HIPAA resource!): HIPAA: Plain & Simple.