---
title: "Log a request for personal information the practice holds"
url: "https://ailawframework.com/obligations/confidentiality-and-client-information/respond-to-a-request-for-access-to-personal-information-the-practice-hol/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A51-MA20261022-12-US"
practice_area: "Confidentiality & client information"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Log a request for personal information the practice holds

> Record the date the request arrived, who sent it, and what it asks for, in the request's words. Do not produce the file and do not start a 30-day count unless you decide the health-privacy rule applies.

Canonical page: https://ailawframework.com/obligations/confidentiality-and-client-information/respond-to-a-request-for-access-to-personal-information-the-practice-hol/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Confidentiality & client information](https://ailawframework.com/obligations/confidentiality-and-client-information.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | Record the date the request arrived, who sent it, and what it asks for, in the request's words. Do not produce the file and do not start a 30-day count unless you decide the health-privacy rule applies. |
| What the lawyer must review | You decide which rule governs. For protected health information in a designated record set, 45 CFR § 164.524(b)(2) says the covered entity must act on an access request no later than 30 days after receipt, with one extension of no more than 30 days if it gives a written statement of the reasons and the completion date within the original time. You read paragraph (b)(2)(ii) before you use the extension, and paragraphs (a)(2) and (a)(3) before you deny access. That rule is for a covered entity and for protected health information. It is not a general right to a law-firm file. Other information relating to a representation stays under Model Rule 1.6 until you decide a permission applies. You do not produce either category from this log. |
| Written for | United States |
| Applies to | [Respond to a request for access to personal information the practice holds](https://ailawframework.com/obligations/confidentiality-and-client-information/respond-to-a-request-for-access-to-personal-information-the-practice-hol.md) |

## Checking plan

- What the AI does: Record the date the request arrived, who sent it, and what it asks for, in the request's words. Do not produce the file and do not start a 30-day count unless you decide the health-privacy rule applies.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- The 30 days run only if you decide § 164.524 applies.
- A client asking for the file is a different question from an individual's request for a designated record set.

## Sources

- [45 CFR § 164.524 (access of individuals to protected health information)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524) (checked 2026-10-22)
- [ABA Model Rule 1.6, Confidentiality of Information](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/) (checked 2026-10-22)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-10-22)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*