Records requests to healthcare providers can be for a variety of distinct reasons, in diverse ways and for different purposes. Records requests may be submitted by other treating physicians, family members, police, courts, administrative bodies (Healing Arts Boards), insurance companies, attorneys, medical record collection companies working for attorneys, government agencies, or the patients themselves. These requests may arrive via text, email, fax, mail, by hand-delivery or even verbally. No matter how a record request is made, if the request is made with the proper authorization, court order or authority, then you must respond to them in a timely manner. Failure to respond to a valid request in a timely manner may result in professional, ethical, or legal penalties.
The Health Insurance Portability and Accountability Act (HIPAA) has always recognized the importance of providing individuals with the ability to access and obtain a copy of their health information. This includes the right of the individual to obtain a copy of their health information and to transmit a copy of their health information to designated persons or entities. This includes medical records, billing records, payment records, insurance information, clinical laboratory tests, medical images, clinical notes obtained from other providers, and other information used to make medical decisions about the individual. The individual patient, the patients properly appointed personal representative (person designated with authority under state law to make health care decisions for the patient), or those individuals granted authority by the patient in writing by a proper release documented in the patient records may request information or records from the healthcare provider. The health care provider may require a written request be provided or may offer the option of using electronic means (web portal) to requests for access to information provided this does not create a barrier or unreasonable delay on the individual seeking access.
Prior to providing access, you should take reasonable steps to verify the identity of the individual making the request. Verification may be done orally and/or in writing depending on the case. Verification may include obtaining basic information that the person seeking access is the personal representative of the patient or otherwise authorized by the patient to have access to health information. If you are unable to verify the identity of the person seeking access, they should avoid even confirming the person in question is a patient.
Any request received should be evaluated and verified as soon as possible. A response date should also be calendared if there is a specific time to respond, and if not, then the response should be made within 30 days of receiving the request.
The basic elements of a release for medical information should include: 1) the name of the healthcare provider or entity being authorized to make the disclosure, 2) the patient’s name, 3) the name of the individual or entity to which the disclosure may be made, 4) the specific information be authorized to be disclosed, 5) the purpose of the disclosure, 6) the signature of the patient or legal authorized representative properly dated, 7) a date upon which the authorization expires, and 8) notice that the authorization is subject to revocation.
With regard to judicially mandated records requests, a court order is issued by a judge, following a hearing on the issues involved in a formal proceeding. The order should properly identify the parties subject to the order, the records that the court is ordering be disclosed, the parties that the records are to be disclosed to, and the time by which disclosure is to occur. A properly issued court order authorizes the disclosure of information and shields the healthcare provider from liability. Failure to comply with the court order can result in a contempt of court.
The healthcare provider may also receive a subpoena for the records. A subpoena is a legal document used to obtain testimony (records and/or oral testimony) within the confines of a legal proceeding. A subpoena may seek written information (subpoena duces tecum) or may seek oral information and documentation for either deposition or in court appearance.
A subpoena will state a date for testimony or a deadline to provide documents, and it is important to be mindful of these dates because failure to appear or comply may have legal consequences. The subpoena alone is insufficient to disclose health care information; a proper release of medical information authorization must also be provided. If a subpoena is received without a proper medical authorization, you should request one immediately, either from the patient or the party issuing the subpoena.
Valid subpoenas require a timely response even if no information is released or testimony is provided. Notice of the subpoena should also be provided to the patient in a timely manner. If the subpoena is accompanied by a proper written authorization, and there is not any objection by any party to the civil action, then you should respond in the time and manner provided by the requesting party. It is important to provide only the exact information sought, and not more than necessary to comply with the subpoena. Also consider other laws that may limit compliance, i.e., mental health records or psychotherapy notes or a protective order issued by a court.
It is imperative to have policies and procedures in place to carefully review, assess and respond appropriately to any record request received.
It is also advisable to inform your professional liability insurance carrier if you believe the request may relate to an incident or potential claim. You should also consult with your insurer relative to complying with any unique or atypical records request.
