Case Management
How do I handle a request for a patient's records?
Organization ApprovedSource Verified
Summary
A written HIPAA-compliant request must be answered within 30 business days (internal target 15). Verify identity, confirm treatment status and lien, then send only what was requested — original x-ray films are never released.
- 1Any outside source requesting records in writing on a HIPAA-compliant authorization form must receive those records within 30 business days; the internal target is 15 days.
- 2This does not apply to phone calls about account balances — use the telephone scripts for balance inquiries.
- 3If multiple accounts share the same patient name, verify identity using date of birth and/or social security number before releasing anything.
- 4Confirm treatment status: if the patient is still treating, email the request to Quality Assurance for the standard active-treatment reply letter (this exception does not apply to Med-Pay/PIP accounts).
- 5If the patient is released from care with a lien on file, read the request carefully and send only the items actually requested.
- 6If a request arrives without a HIPAA-compliant authorization, call the carrier and ask them to resend with a compliant authorization.
- 7Confirm a Notice of Medical Lien is filed before releasing information, but do not wait more than 30 days to send records; advise Quality Assurance if a lien still needs to be secured.
- 8Billing Code 1: verify the request relates to the claim the clinic holds a bill for; if related, obtain claim information and send to verifications to secure the lien. If Code 1 exists due to no coverage, email verifications to reverify.
- 9If a Billing Code 1 balance is zero due to a prior write-off, contact Quality Assurance to adjust the account back onto the Collections Report; never disclose a zero balance that was not paid in full without Quality Assurance guidance.
- 10Billing Code 5 (Med-Pay/PIP): fax the Confidential Patient Information, Assignment of Benefits, and Travel Card to the carrier immediately.
- 11Billing Code 6 (attorney) and Code 7 (no attorney): check whether the Final Packet was already sent; if so, call to confirm receipt, verify the fax number, and resend if needed.
- 12Only after confirming all required items are in order should the CA proceed with the Final Packet process; the clinic always retains original documents.
- 13A patient's own written request for a bill or records also has a 30-business-day response window.
Important
Original x-ray films are never released to anyone — the clinic must maintain x-rays for 7 years. Anyone needing copies of original films must use a duplicating service at their own cost; digital x-rays may be copied to a disk and mailed with the records.
Citation
CA Manual, Request for Records, p. Patient Records · Revised 2/9/26Answers source the CA Manual first; the Medisoft guide is used only where the CA Manual does not cover the task.