You have already received information on Open Notes, which is part of the CURES Act.  There is another section which is called Information Blocking, which has eight reasons for not giving patients access to their Medical Records.  Here is a summary of the two concepts for your information.

Disclosure of Patient Information – Open Notes and Information Blocking

There are now two additional HIPAA considerations when disclosing patient information: Open Notes and Information Blocking.

Open Notes builds on the right of patients to have access to their medical record. On 2 November 2020, new federal rules will implement the bipartisan 21st Century Cures Act that, in part, “. . . promotes patient access to their electronic health information, supports provider needs, advances innovation, and addresses industry-wide information blocking practices.” The rules forbid health care organizations, information technology vendors, and others from restricting patients’ access to their electronic health care data, or “information blocking”, except for the eight reasons that Information Blocking allows. Although the Health Insurance Portability and Accountability Act gave patients the legal right to review their medical records, the new ruling goes further by giving them the right to access their electronic health records rapidly and conveniently via secure online portals. Providers must share not only test results, medication lists, and referral information but also the notes written by clinicians. Over the past decade, this practice innovation—known as “open notes”— has spread widely, and today more than 50 million patients in the United States are offered access to their clinical notes."  (https://www.opennotes.org/research/new-u-s-law-mandates-access-to-clinical-notes-implications-for-patients-and-clinicians/)

Information Blocking outlines the information in the medical record which can be “blocked” from disclosure to the patient.  There are eight reasons for engaging in information blocking: to prevent harm to the patient; to comply with state regulations on privacy; to comply with state regulations on security; infeasibility, e.g., natural disaster prevents sharing medical record; when medical records are unavailable due to electronic maintenance or other reasons; lack of interoperability with patient electronic systems; inability of patient to pay agreed-upon fees to access their record; and delays due to the organization licensed to provide the medical record (https://journal.ahima.org/understanding-the-eight-exceptions-to-information-blocking/)