|If you’ve never requested your medical records from your doctor or hospital before, the process can seem complicated. However, understanding the law and the basic requirements will ease the process.
The Record Request Process
The basic process for requesting a medical record is similar across states and provider types. Whether requesting your personal medical records from a doctor’s office or a hospital, in Hawaii or Ohio, the federal law known as HIPAA applies. HIPAA entitles every person the right to access his or her medical records, receive copies of them, and request amendments to them.
State laws, however, can add variations to the exact process for requesting records and how much facilities can charge for fulfilling them.
In addition, individual doctors’ offices and hospitals may have their own policies. These cannot contradict federal and state law, but they can add variation in the request process between facilities.
The laws and policies can add complexity, but their end goal is the same—to ensure a person’s sensitive health information remains private.
Janet Mohlenhoff, RHIA, CCS, is the manager of health information services at Richmond University Medical Center based in Staten Island, NY. Her department is in charge of fulfilling records request.
“We are not trying to be a stumbling block,” she says.”[We’re] trying to best protect the information, because this is highly confidential information and we have to be very careful about releasing it correctly.”
“You wouldn’t want this information in the wrong hands,” she says.
To ensure information is released according to the owner’s wishes, facilities are required to verify the identity of the requestor and confirm that he or she is authorized to access or transfer the records.
Complete an Authorization Form
To request your records, start by contacting or visiting your provider’s health information management (HIM) department—sometimes called the medical records or health information services department. Smaller doctor’s offices may not have an HIM department, so ask to speak to the administrative staff in charge of releasing patient records.
The first step will be completing an “authorization for disclosure of protected health information” form.
A growing number of healthcare facilities offer their authorization forms online so they can be completed ahead of time. Some facilities allow patients to mail or e-mail the form if requesting certain record services, such as transferring records to another provider or payer covered by HIPAA.
TIPS FOR RECORD REQUESTS
If you are having the records sent to another person, you will need to provide their name and contact information.
For example, a patient requesting that his or her medical records from a recent hospital stay be sent to a new physician would have to provide the physician’s full name, address, and fax number or secure e-mail address.
A completed and signed authorization form is mandatory for all record releases. An incomplete or unsigned request will not be fulfilled.
Select Your Records
The authorization form also will ask what specific information you would like to have copied.
Knowing exactly what records you want or need can be difficult. Patients who are unsure can ask an HIM professional to help them narrow down their requests, according to Jennifer Miller, MHIS, RHIA, director of HIM and compliance officer at Loma Linda University Healthcare, based in Loma Linda, CA.
A medical record can often be hundreds of pages long, so being selective is important. If you don’t know the records you want, knowing what you want them for can help an HIM professional guide you to the proper documents.
In the case of especially sensitive records, such behavioral health and HIV/STD records, state law may require additional authorization. For example, in New York, an authorization has to explicitly state that the patient wants the facility to release records containing information on an HIV diagnosis or treatment. Most authorization forms have a section that addresses this type of request, and it must be filled out by the patient or their proxy if those records are requested.
Choose a Format
Increasingly patients have the ability to request the format in which they would like to receive their records. For facilities using an electronic health record system, the medical record may be available on CD, DVD, USB flash drive, or sent via secure e-mail.
Additionally, larger facilities are increasingly creating Web-based portals that allow patients direct access to their information.
It is important to note that patients have a right to a copy of their record, not the original. The original record belongs to the healthcare facility. It is a document they must maintain for legal and business purposes.
Bring a Photo ID
If requesting records in person, you will be required to show a valid government-issued photo ID at either the time of their request or when picking up the record.
If you are picking up another person’s records, you will require additional legal documents and information to demonstrate your right to access records on another’s behalf, Miller says. Be certain to ask about these requirements in advance.
How Long Will It Take?
Fulfilling record requests can take time, so plan ahead and don’t expect to receive your records the day you request them.
In fact, HIPAA allows providers 30 days to complete a record request. It also allows a single 30-day extension, but the facility must explain the cause of the delay.
Most facilities, however, do not require that much time—many can fulfill a request in five to 10 days. Individual state laws may also dictate how quickly a facility must fulfill a request.
Fulfilling requests takes time because facilities receive many of them and processing them requires individual review. Large hospitals can get thousands of record requests a month from patients, providers, insurers, attorneys, law enforcement, and other entities, explains Anne Tegen, MHA, HRM, the director of HIM at Children’s Hospitals and Clinics of Minnesota, based in Minneapolis, MN.
Once received, each of these requests requires personal attention. Processing a record request is much more difficult than pressing print on a computer screen or walking a chart to the copy machine, says Colleen Goethals, MS, RHIA, FAHIMA, a release of information and HIM consultant with Midwest Medical Records Association, based in Schaumburg, IL.
For each request, staff must validate a requestor’s authorization signature with a signature in the medical record; locate records; select the requested documents; review the record to ensure the authorization is valid for the release all requested information (such as HIV testing, substance abuse treatment, or behavioral health records); and then prepare and send the request.
Is There a Fee?
Facilities have the right to charge fees to offset the labor involved in copying and assembling records.
Maximum fees vary widely between states. In New York, the maximum fee a facility can charge is 75 cents per page; in California it is 25 cents per page. Georgetown University’s Center on Medical Records Rights and Privacy offers a complete list of state-specific record release laws and fees.
Facilities charge different rates, also, although none may exceed the maximum set by their state law.
Oftentimes facilities will waive the fee if the information is being sent to another provider for use in care. However, the same facility may charge a fee if the patient requests a personal copy of the record.
Still other facilities do not charge for copies at all, or only charge for requests that exceed a set page limit, according Goethals. She advises requesting information on fees before submitting a record request.
When the records are ready, HIM departments will either transfer the record to the requested healthcare provider through e-mail, fax, or mail, or they will alert the requestor that the physical copies are ready for pickup.
The Value of Requesting Your Records
There are many good reasons to request a copy of your medical records. Physicians don’t always share complete patient information or exchange a patient’s health records, so if a patient is seeing a new provider it is beneficial to ensure a copy of their record is sent to the new physician, Tegen says. Also, it is beneficial for patients or caregivers dealing with multiple doctors and facilities to have all medical records in one place, which can then be used by providers to ensure thorough care.
Reviewing your record is an important way to ensure your provider has complete, correct, and up-to-date information, such as your known allergies. If you find information in your record that is incorrect or that you disagree with, contact the provider’s HIM department.
Finally, it can be good for your health to keep a copy of your medical records, Goethals says. She advises people to be an advocate for their own healthcare by tracking their preventative care and treatment. Keeping an up-to-date copy of your health information will prevent redundant care, like repeat tests, and give all your physicians essential information about your health.
“Even when patients are well, it is nice to know their immunization history, allergies, and have certain other pieces of information,” Miller says. “So by viewing or accessing copies of their records, they are able to be better informed on their healthcare.”
Special Cases: Requesting Someone Else’s Records
Requesting another person’s records is a different process from requesting your own, and it has its own requirements.
Facilities will not release a patient’s records to someone else without a direct authorization signed by the patient. If the patient is incapacitated or deemed incompetent, legal documents must be drawn up and presented at the HIM department before another person can access the records.
Healthcare proxy is a big source of confusion, says Mohlenhoff says. Documents such as powers of attorney grant different rights at different stages. Some expire at the patient’s death, and others only become effective at that point. Some may not be effective when the patient reaches “diminished capacity” and is in the greatest need of assistance managing his or her records.
The issue of diminished capacity “is an important consideration,” Miller says. “You can word your advance directives and powers of attorney to prevent [a spouse or caregiver] having to wait for diminished capacity.”
For more information, read “Sorting out Advance Directives.”
Deceased Patient Records
The process and requirements change again when a person seeks to access the records of a deceased person. The rights conveyed by a healthcare proxy or power of attorney expire upon a patient’s death, and only an executor of the estate can gain access to records.
For more information, see “Who Has Rights to a Deceased Patient’s Records?”
Parental and Spousal Rights
Married couples do not have an automatic right to one another’s records.
“You can’t necessarily request your spouse’s records. You need an advance directive, a power of attorney, or you need your spouse to sign the authorization form for you,” Miller says. “Sometimes that can be seen as cumbersome; however, it is really meant to provide privacy of the information for the patient themselves.”
For example, one estranged spouse may try to access the other’s medical records, and some patients may choose to hide certain medical treatment or testing information from their spouse or parent. HIPAA grants adult patients the right to privacy from everyone—even spouses and parents, Goethals says.
In some instances parents do not have full access their child’s medical record. There are some privacy protections for minors.
Some state laws, such as in California, allow minors as young as 12 to keep reproductive, sexually transmitted disease, and behavioral health information private from their parents. The parents would require a signed authorization from the child in order to access those records, Miller explains.
This can be a confusing and contentious issue with parents who may receive a bill for medical services given to their child but are denied access to those records.
Children age 18 and older have complete control over their medical care and records, and parents require authorization to access their records. This is true even if the child’s care is paid for by the parents’ insurance.