Posted By Chris Dimick on March 1, 2012
Updated by Mary Butler on March 1, 2017**
**Editor’s Note: This post was updated on March 1, 2017 to reflect changes in laws and regulations that have taken place since this content was originally posted.
The Record Request Process
The basic process for requesting a medical record is similar across states and provider types. Whether requesting your personal medical records from a doctor’s office or a hospital, in Hawaii or Ohio, the federal law known as HIPAA applies. HIPAA entitles every person the right to access his or her medical records, receive copies of them, and request amendments to them.
State laws that provide individuals with greater access rights than what is afforded under the HIPAA Privacy Rule are not preempted by HIPAA and therefore can add variations. However, state laws that are in contravention to the HIPAA Privacy Rule, such as certain costs associated with fulfilling patient access are not permissible. For further information, click here to read the guidance from HHS, “Individuals’ Right under HIPAA to Access their Health Information.”
The laws and policies can add complexity, but their end goal is the same—to ensure a person’s sensitive health information remains private, while keeping the bar low for patients to access their information.
Janet Mohlenhoff, MPA, RHIA, CCS, is the manager of health information services at Richmond University Medical Center based in Staten Island, NY. Her department is in charge of fulfilling records request.
“We are not trying to be a stumbling block,” she says.”[We’re] trying to best protect the information, because this is highly confidential information and we have to be very careful about releasing it correctly.”
“You wouldn’t want this information in the wrong hands,” she says.
To ensure information is released according to the owner’s wishes, facilities are required to verify the identity of the requestor and confirm that he or she is authorized to access or transfer the records.
Complete a Patient Access Request/Authorization Form
To request your records, start by contacting or visiting your provider’s health information management (HIM) department—sometimes called the medical records or health information services department. Smaller doctor’s offices may not have an HIM department, so ask to speak to the administrative staff in charge of releasing patient records.
The first step will be completing an “Patient Access Request (or similarly titled)” form.
A growing number of healthcare facilities offer their Patient Access Request forms online so they can be completed ahead of time. Some facilities allow patients to mail or e-mail the form if requesting certain record services, such as transferring records to another provider or payer covered by HIPAA.
If you are having the records sent to another person, you will need to provide their name and contact information For example, a patient requesting that his or her medical records from a recent hospital stay be sent to a new physician would have to provide the physician’s full name, address, and fax number or secure e-mail address.
A completed and signed authorization form may be mandatory for all record releases, dependent upon the providers policies. An incomplete or unsigned request will not be fulfilled.
Personal representatives of patients are empowered by HIPAA to be able to complete patient access requests in the place of a patient. These personal representatives are specifically defined to be the parties that make healthcare decisions for a patient under state law. If a person has been given medical power of attorney for an individual, they have the right to request access to another person’s medical records. The person asking for access on another person’s behalf may be required to fill out a request form or make the request in writing.
Select Your Records
The access request form also will ask what specific information you would like to have copied.
Knowing exactly what records you want or need can be difficult. Patients who are unsure can ask an HIM professional to help them narrow down their requests, according to Jennifer Miller, MHIS, RHIA, director of HIM and compliance officer at Loma Linda University Healthcare, based in Loma Linda, CA.*
A medical record can often be hundreds of pages long, so being selective is important. If you don’t know the records you want, knowing what you want them for can help an HIM professional guide you to the proper documents.
In the case of especially sensitive records, such as behavioral health, substance abuse and HIV/STD records, state law may require additional authorization form. For example, in New York, an additional an authorization/patient request form has to explicitly state that the patient wants the facility to release records containing information on an HIV diagnosis or treatment. Most patient access request forms have a section that addresses this type of request, and it must be filled out by the patient or their proxy if those records are requested.
Patients have the ability to request the format in which they would like to receive their records. For facilities using an electronic health record system, the medical record may be available on CD, DVD, USB flash drive, or sent via secure e-mail.
Additionally, larger facilities are increasingly creating web-based portals that allow patients direct access to their information.
It is important to note that patients have the right to a copy of their record, not the original. The original record belongs to the healthcare facility. It is a document they must maintain for legal and business purposes.
Bring a Photo ID
If requesting records in person, you will be required to show a valid government-issued photo ID at either the time of their request or when picking up the record.
If you are picking up another person’s records, you will require additional legal documents and information to demonstrate your right to access records on another’s behalf, Miller says. Be certain to ask about these requirements in advance.
How Long Will It Take?
Fulfilling record requests can take time, so plan ahead and don’t expect to receive your records the day you request them.
In fact, HIPAA allows providers 30 days to complete a record request. It also allows a single 30-day extension, but the facility must explain to the requestor the cause of the delay.
Most facilities, however, do not require that much time—many can fulfill a request in five to 10 days. Individual state laws may also dictate how quickly a facility must fulfill a request.
Fulfilling requests takes time because facilities receive many of them and processing them requires individual review. Large hospitals can get thousands of record requests a month from patients, providers, insurers, attorneys, law enforcement, and other entities, explains Anne Tegen, MHA, HRM, the director of HIM at Children’s Hospitals and Clinics of Minnesota, based in Minneapolis, MN.
Once received, each of these requests requires personal attention. Processing a record request is much more difficult than pressing print on a computer screen or walking a chart to the copy machine, says Colleen Goethals, MS, RHIA, FAHIMA, a release of information and HIM consultant with Midwest Medical Records Association, based in Schaumburg, IL.*
For each request, staff must validate a requestor’s patient access request signature with a signature in the medical record; locate records; select the requested documents; review the record to ensure the authorization is valid for the release all requested information (such as HIV testing, substance abuse treatment, or behavioral health records); and then prepare and send the request.
Is There a Fee?
Facilities have the right to charge fees to offset the labor involved in copying the records. However, a provider cannot deny you a copy of your records because you have not paid for the treatment services you received.
HIPAA has set the amount organizations can charge for patient record access fees. State law dictates how much organizations can charge for third party authorizations, such as to attorneys, or other access not requested directly by the patient or their proxy.
Some facilities provide record copies to patients for continued care for free, while others may charge a HIPAA based fee for patient access request records—and none of these fees can be more than the maximum allowed by law. According to the US Department of Health and Human Services’ Office for Civil Rights (OCR) guidance, for any request from an individual, a provider may calculate the allowable fees for providing individuals with copies of their PHI by calculating actual allowable costs to fulfill each request; or by using a schedule of costs based on average allowable labor costs to fulfill standard requests. Alternatively, in the case of requests for an electronic copy of PHI maintained electronically, an organization can charge a flat fee not to exceed $6.50 (inclusive of all labor, supplies, and postage). Charging a flat fee not to exceed $6.50 per request is therefore an option available to entities that do not want to go through the process of calculating actual or average allowable costs for requests for electronic copies of PHI maintained electronically.
Oftentimes facilities will waive the fee if the information is being sent to another provider for use in continued care. However, the same facility may charge a fee if the patient requests a personal copy of the record.
Still other facilities do not charge for copies at all, or only charge for requests that exceed a set page limit, according Goethals. She advises requesting information on fees before submitting a patient access to records request.
That said, the federal government is encouraging providers to give patients copies of their own electronic health information free of charge, according to recent guidance. The guidance has the following recommendations on when and how patients should be charged for electronic copies:
- Patients should not be charged a fee for patient portal access through certified electronic health records (EHRs).
- There cannot not be “per page” fees for electronic copies.
- There cannot not be “surprise” fees; providers must inform an individual in advance of the approximate fee that may be charged.
When the records are ready, HIM departments will either transfer the record to the requested healthcare provider through e-mail, fax, or mail, or they will alert the requestor that the physical copies are ready for pickup.
The Value of Requesting Your Records
There are many good reasons to request a copy of your medical records. Physicians don’t always share complete patient information or exchange a patient’s health records, so if a patient is seeing a new provider it is beneficial to ensure a copy of their record is sent to the new physician, Tegen says. Also, it is beneficial for patients or caregivers dealing with multiple doctors and facilities to have all medical records in one place, which can then be used by providers to ensure thorough care.
Reviewing your record is an important way to ensure your provider has complete, correct, and up-to-date information, such as your known allergies. If you find information in your record that is incorrect or that you disagree with, contact the provider’s HIM department.
Finally, it can be good for your health to keep a copy of your medical records, Goethals says. She advises people to be an advocate for their own healthcare by tracking their preventative care and treatment. Keeping, or having accessible on-line an up-to-date copy of your health information will prevent redundant care, like repeat tests, and give all your physicians essential information about your health.
“Even when patients are well, it is nice to know their immunization history, allergies, and have certain other pieces of information,” Miller says. “So by viewing or accessing copies of their records, they are able to be better informed on their healthcare.”
Special Cases: Requesting Someone Else’s Records
Requesting another person’s records is a different process from requesting your own, and it has its own requirements.
Facilities will not release a patient’s records to someone else without a direct authorization to disclose records to a third party form signed by the patient. This form is different than the form used by patient’s to request their own records. If the patient is incapacitated or deemed incompetent, legal documents must be drawn up and presented at the HIM department before another person can access the records.
Healthcare proxy, another type of form used in record requests, is a big source of confusion, says Mohlenhoff says. Documents such as powers of attorney grant different rights at different stages. Some expire at the patient’s death, and others only become effective at that point. Some may not be effective when the patient reaches “diminished capacity” and is in the greatest need of assistance managing his or her records.
The issue of diminished capacity “is an important consideration,” Miller says. “You can word your advance directives and powers of attorney to prevent [a spouse or caregiver] having to wait for diminished capacity.”
For more information, read “Sorting out Advance Directives.”
Deceased Patient Records
The process and requirements change again when a person seeks to access the records of a deceased person. The rights conveyed by a healthcare proxy or power of attorney expire upon a patient’s death. An executor of the estate can gain access to records, along with quitter a few other legal mechanism for the access. It is also possible for next of kin to request copies of the records based upon documentation contained in the patient’s record, if they were designated to receive copies. For an individual to gain access to another adult’s medical records, they must file a petition with the court to become a personal representative of the estate.
This can be done in a probate court or other court of appropriate jurisdiction, and the requestor must be able to provide documentation proving their relationship to the deceased. And this isn’t necessarily a lengthy process.
For more information, see “Who Has Rights to a Deceased Patient’s Records?”
Parental and Spousal Rights
Married couples do not have an automatic right to one another’s records.
“You can’t necessarily request your spouse’s records. You need an advance directive, a power of attorney, or you need your spouse to sign the authorization form for you,” Miller says. “Sometimes that can be seen as cumbersome; however, it is really meant to provide privacy of the information for the patient themselves.”
For example, one estranged spouse may try to access the other’s medical records, and some patients may choose to hide certain medical treatment or testing information from their spouse or parent. HIPAA grants adult patients the right to privacy from everyone—even spouses and parents, Goethals says.
In some instances parents do not have full access their child’s medical record. There are some privacy protections for minors.
Some state laws, such as in California, allow minors as young as 12 to keep reproductive, sexually transmitted disease, and behavioral health information private from their parents. The parents would require a signed authorization from the child in order to access those records, Miller explains.
This can be a confusing and contentious issue with parents who may receive a bill for medical services given to their child but are denied access to those records.
Children age 18 and older have complete control over their medical care and records, and parents require authorization to access their records. This is true even if the child’s care is paid for by the parents’ insurance.
Setting up and Accessing Records from an Electronic Patient Portal
The “meaningful use” electronic health record (EHR) Incentive Program helped lead to the proliferation of patient portals—secure online websites that gives patients access to their personal health information and medical records at their convenience. According to ONC’s patient portal guidelines, using a secure username and password, patients can access the portal to review information pertaining to:
- Recent doctor visits
- Discharge summaries
- Lab results
Some patient portals also allow patients to:
- Exchange secure e-mail with their health care teams
- Request prescription refills
- Schedule non-urgent appointments
- Check benefits and coverage
- Update contact information
- Make payments
- Download and complete forms
- View educational materials
If a healthcare provider—including hospitals and physician practices—has an EHRs, they may also offer a patient portal. Patients typically find out about the portal from their physician, from their physician’s office staff, from a nurse, admissions personnel, or from their physician’s front office staff. If this information isn’t volunteered, patients should feel empowered to inquire on their own, according to an ONC fact sheet.
EHRs give patients another opportunity to access or request their records in a more convenient format. As ONC guidance states, “the Privacy Rule requires a covered entity to provide the individual with access to the PHI in the form and format requested, if readily producible in that form and format, or if not, in a readable hard copy form or other form and format as agreed to by the covered entity and individual.” This goes for electronic record requests, too.
“Where an individual requests an electronic copy of PHI that a covered entity maintains electronically, the covered entity must provide the individual with access to the information in the requested electronic form and format, if it is readily producible in that form and format. When the PHI is not readily producible in the electronic form and format requested, then the covered entity must provide access to an agreed upon alternative readable electronic format,” the guidance states.
One of the ways patients can gain access to their online medical records is by taking advantage of the Blue Button Movement. The Blue Button symbol is an icon that appears on the patient portals of Veterans Administration beneficiaries, and originated as a way for VA patients to collect all their health records in one, easy-to-access location. ONC launched an online tool, Blue Button Connector, which would help patients identify which providers participate in the Blue Button program.
Click here for the government’s most recent guidance around patients’ privacy rights.
TIPS FOR RECORD REQUESTS
Read online or call the facility’s HIM department for information specific to your request for access or copies of your records. This will give you time to collect the required information and documentation before you arrive. If you are requesting another person’s records, you can confirm in advance that you will have authorization.
Provide as much information as you can on the patient access request form. This will speed up request processing by giving HIM professionals sufficient data to track down your records. If you have a common last name, provide extra information about yourself, such as your date of birth or the last four digits of your Social Security number.
Bring a valid government issued photo ID and all other required legal documents with you when you pick up a record request. HIM professionals by law must deny requests where the individual cannot prove his or her identity or his or her right to access the records.
Discuss with HIM staff the exact parts of the records you can request. Or, if you don’t know which parts to request, tell the HIM staff how you plan to use the records. HIM professionals can help ensure you receive the records you need—and not the ones you don’t. The set of records one should request for personal use, for example, can be different from the set of records sent to a doctor for continuing care. A person’s medical record can be hundreds of pages long, so requesting your entire record may be too much, especially if the facility charges a per-page fee for compiling and reproducing it.
Indicate if the request is urgent… Many facilities triage their record requests, putting the most time-sensitive and continued care-oriented requests first.
…but allow as much time as you can. Not all facilities honor rush requests, however; some fulfill orders in the order in which they were received. When possible, make your request well before you need the documents (between five and 15 days out).
Don’t request your records before you leave the hospital, but do make sure to get discharge instructions and basic information from the stay. If you need records from your hospital stay sent to a physician for follow-on care, you can request the transfer before you are discharged. This will ensure all of your records are sent, including the discharge summary. If records are transferred during an inpatient stay, they will likely be incomplete when sent.
If you’ve submitted a written request for records for yourself, or for a designated representative to receive records for you, and have not received a response, feel free to call the provider and confirm or double check that they’ve received your request.
If you feel that your privacy has been violated or that a provider has denied your requests, feel free to file a complaint with the Office for Civil Rights. Click here to learn more about that process.
Journal of AHIMA has published several articles that patients and caregivers may find useful in their efforts to better understand and manage their personal health information—whether looking for guidance on how to get the records request ball rolling or simply wanting to find some general information on privacy rights.
*Titles and organizations have changed for Jennifer Miller and Colleen Goethals since the original publication of this article. At the time of this update, their new information is as follows:
- Jennifer Miller, MHIS, RHIA, director of HIM at the University of Texas MD Anderson Cancer Center
- Colleen Goethals, MS, RHIA, FAHIMA, Director, Health Information Management at R1 RCM
Chris Dimick (email@example.com) is editor-in-chief at Journal of AHIMA.
Mary Butler (firstname.lastname@example.org) is associate editor at Journal of AHIMA.