What Must Providers Do When You Request Your Medical Records?

• Provide Access or Copies: Patients have the right to inspect their records, obtain copies (paper or electronic), or have the records sent to a designated third party, such as another healthcare provider or a research institution.
• Format and Delivery: Providers must provide records in the format requested by the patient (e.g., paper, electronic, or via secure email) if it’s readily producible. For example, if a patient requests their discharge summary be sent to their primary care physician using Certified Electronic Health Record Technology (CEHRT), the provider must comply.
• No Denial Without Cause: Providers cannot deny access unless the information is not part of the designated record set (e.g., psychotherapy notes or certain quality control records) or falls under specific exceptions, such as if releasing the information could endanger the patient or others.

How Long Do Providers Have to Respond?

• 30 Days for Initial Response: Providers must act on a request within 30 days of receipt. This includes providing the records, denying the request with a written explanation (if applicable), or informing the patient of any delays.
• Extension for Delays: If the provider cannot fulfill the request within 30 days (e.g., due to records being stored offsite), they may extend the deadline by an additional 30 days, but they must provide a written explanation for the delay within the initial 30-day period.
• Reasonable Fees: Providers may charge a reasonable, cost-based fee for copying or mailing records, but they cannot deny access due to unpaid fees.

Best Way to Request Records and Create a Paper Trail

1. Submit a Written Request: Always make your request in writing (email or letter) to establish a clear record. Include:
   • Your full name, date of birth, and contact information.
   • A specific description of the records you’re requesting (e.g., “all medical records from January 2023 to June 2025, including lab results, progress notes, and billing records”).
   • The format you prefer (e.g., electronic, paper, or sent to a specific recipient).
   • A signature and date.
   • If applicable, specify that you want the audit trail (metadata showing who accessed or modified the record).
2. Send via Trackable Methods: Use certified mail with a return receipt or a secure email with delivery confirmation to document that the provider received your request. Keep copies of all correspondence.
3. Follow Up in Writing: If you don’t receive a response within a week, send a follow-up email or letter, referencing the original request and reiterating the 30-day HIPAA timeline.
4. Keep a Log: Document all interactions, including dates, methods of communication, and any responses from the provider. This log can be crucial if you need to escalate the issue.
5. Avoid Verbal Requests Alone: Verbal requests are harder to prove. If you make a verbal request, follow up with a written confirmation summarizing the conversation.

Patient Options When Providers Fail to Provide Records

1. Contact the Provider Again: Send a polite but firm follow-up letter or email, citing HIPAA regulations and the 30-day timeline. Reference your original request and any proof of receipt (e.g., certified mail receipt).
2. File a Complaint with the Office for Civil Rights (OCR): The OCR, part of HHS, oversees HIPAA compliance. You can file a complaint online if the provider violates your right to access. Include:
   • Details of the request, including dates and methods of communication.
   • Copies of correspondence or proof of delivery.
   • A description of the provider’s failure to comply. File a complaint at: HHS.gov – File a Complaint.
3. Report Potential Fraud: If you suspect the delay or denial is linked to fraudulent activity (e.g., falsified records to cover up improper billing), report it to:

   • Office of Inspector General (OIG): For Medicare or Medicaid fraud, contact the OIG Hotline at 1-800-HHS-TIPS or online at OIG.HHS.gov – Submit a Hotline Complaint.

   • State Medicaid Fraud Control Unit: For Medicaid-related issues, contact your state’s unit.

   • Federal Bureau of Investigation (FBI): For broader healthcare fraud, report to tips.fbi.gov.

4. Consult a Lawyer: If you suspect fraud or malpractice (e.g., altered records to justify unnecessary procedures), a qui tam lawyer or False Claims Act attorney can help. They may file a lawsuit on behalf of the government to recover funds lost to fraud, potentially entitling you to a portion of the recovery. Learn more at Whistleblower
5. Request Records via a Third Party: If the provider is unresponsive, you can authorize another healthcare provider to request the records on your behalf for continuity of care. This can sometimes prompt action, as providers may prioritize requests from other professionals.

6. Seek State-Level Assistance: Some states have additional laws protecting patient record access. For example, Virginia’s Code (§ 32.1-127.1:03) mandates disclosure of health records, including audit trails, upon request. Check your state’s health department website for specific regulations: Virginia Health Records Privacy.

Why This Matters in the Context of Medical Fraud