HIPAA Medical Records Request Template

For each request, record who is asking and in what capacity, what came with it, who gets the copy, and in what format. Those four facts give you the legal basis.

A request from another clinician for the patient's care is a treatment disclosure. It needs no authorization and no minimum necessary review. A referral letter with the relevant records is often more useful to them than the whole chart.

One request is easy to misfile: a patient's signed letter asking you to send their records to someone else.

Date-stamp every request the day it arrives, by portal, fax, mail or front desk. For a patient's own request, the HIPAA Privacy Rule requires you to act within 30 days of receipt²: provide the records or send a written denial. A request left in a fax tray for nine days has 21 days left.

You get one extension of up to 30 more days. It counts only if you write to the patient within the first 30 days, giving the reason for the delay and the date you will finish. The March 4 request above could then run to May 3. Decide by about day 20 whether you need the letter.

Confirm the identity of anyone you don't know, and the authority of anyone acting for the patient, such as a parent or health care agent. A patient who wants a copy sent elsewhere must ask in writing, sign the request, and name the recipient and where to send it.

When a third party holds an authorization, check it element by element. HIPAA lists the core elements of a valid authorization³, and a form that is incomplete, expired or revoked isn't valid. It needs:

• A specific description of the information to release
• Who may release it, and who may receive it
• The purpose, or "at the request of the individual" if the patient started it
• An expiration date or event
• The patient's signature and date, or a representative's with their authority described
• Statements on revoking it, whether care depends on signing, and redisclosure

Read the form's description of what to release closely: minimum necessary doesn't apply to authorizations, so the description is the only limit. And never hand a patient who wants their own records an authorization to sign. Theirs is still an access request.

A subpoena on its own is not a court order. Before you release anything, get written assurance with documentation⁴ from the requesting party. It must show that the patient was sent notice and the time to object has passed, or that a qualified protective order was sought.

A patient's right of access covers their designated record set: the medical and billing records you keep, plus any others you use to make decisions about them. Psychotherapy notes and information compiled for a legal proceeding are excluded.

Most disclosures you make without the patient's request or authorization fall under the minimum necessary standard⁵: send only what the purpose needs. A court order sets its own limit: one covering a single injury gets those records, not the whole chart.

To withhold anything from a patient's own request, send a written denial in plain language within the same deadline. Give the basis, any review rights, and how to complain to you or to HHS, with a contact and phone number. Release the rest, and if you know who holds records you don't, say where to ask.

For a patient's own copy, the fee must be reasonable and cost-based. It may include only four costs²: copying labor, supplies, postage if they asked for mail, and preparing a summary they agreed to in advance. So a flat retrieval, search or processing charge comes off every patient invoice.

HHS has long held that copying labor excludes searching for and retrieving records⁶. For electronic copies of records kept electronically, its 2016 access guidance also offered a simpler option: a flat fee of $6.50, covering labor, supplies and postage.

Third-party copies work differently. In 2020, in Ciox Health v. Azar, a federal court removed the patient fee limit from copies a patient directs to someone else⁶, and HHS did not appeal. Even so, keep the charge to a reasonable, cost-based fee for preparing and sending the records, or a fee another law expressly allows. Charging more can turn the release into a sale of health information⁵.

Patients can ask for an accounting of disclosures⁷ covering the past six years: releases such as subpoenas, court orders and public health reports. Releases to the patient, under an authorization, or for treatment, payment and operations are left out. You have 60 days to provide one, and the first in any 12 months is free.

Each entry needs the date, the recipient and their address if known, what went, and why. Log those details the day each release leaves, since an accounting can't be rebuilt from memory. If you send copies by portal or email, your security risk assessment should cover that route.

Write the procedure down: HIPAA requires you to document your designated record sets and who handles access requests. The HIPAA policies and procedures template covers your other privacy policies. To clear an open queue faster, open this template in River, which sorts each request by type and shows which ones carry a HIPAA deadline.