Your practice most certainly knows that when you get a medical record request, you must fulfill it, according to the HIPAA laws. What happens next is often different at every practice. Some practices give patients immediate access to their paper records, others wait almost a month, while some don’t even process the requests the same way every time. The truth is, as long as you meet the legal requirements, you don’t have to follow the exact same pattern as everyone else — if you know the laws.
Check out seven legal requirements you must know before you fulfill your next medical record request.
1. Patients Can Inspect and Obtain Medical Record Copies
The patient right to get medical records applies to everything from lab results and office visits to billing records and radiology reports. This includes paper and electronic health records about the patient or their care.
2. Patients May Request Records for Others
Medical record requests don’t necessarily have to come from patients themselves. Instead, you may receive a medial request from a designated third party. If a record request comes in from a third party and you aren’t clear on whether that party has the legal right to request the records, send it to your practice attorney for clarity.
3. You Have 30 Days to Respond
Federal law says you must respond within 30 days of receiving a medical record request. However, one 30-day extension is allowed if the patient is notified in writing of the delay — in addition, you must tell them why it’s running late.
Important: Some states require faster responses (such as 10-15 days), so always check your state law and follow that if it’s sooner than the 30-day requirement.
4. You Can Charge for Records
It’s legal to charge for patient records, but keep in mind that you can only charge cost-based fees, such as labor for copying, supplies or postage. You can’t charge per-page fees for electronic records. If patients request it, you must provide an estimate of fees ahead of time.
5. Verify Identity
You must verify the identity of the requester to prevent unauthorized disclosures. For instance, if a patient asks for their own records, ask them for a photo ID or other identification. If the records are being sent to a third-party (such as another doctor), get a signed authorization from the patient or their representative.
6. Send Records in Requested Format
If it’s readily available, you must provide the patient’s medical records in the format requested. For instance, they may want a PDF, printed copies, secure mail or USB. If this format isn’t readily available, you must provide a reasonable alternative.
7. If Denying the Request, Share Why
In limited cases, you can deny a patient’s medical record request, such as for legal proceedings. However, you must provide a written denial with the reason you’re denying it. You must also explain how the patient can appeal the denial if they choose to do so.
Best Practices for Medical Record Requests
To meet the medical record request requirements, your practice will need a process for fulfilling them, especially since several may come in at once. For instance, you might choose to launch an online record request portal or a to print out a standard form so you don’t have to handle such requests over the phone.
Educate your staff and patients, and train your team on how to handle requests consistently and respectfully. Post clear instructions for patients online or in waiting rooms.
Always document all medical record requests, the date and receipt of your practice’s response, any correspondence about the request, and fees that you charged. Every few months, track metrics like average fulfillment time, number of requests you received, errors you made and more. Then use that data to optimize staffing and workflow for future requests.
| Stepping outside the lines is not appreciated when it comes to healthcare laws. Let attorney Osato F. Chitou, Esq., help you stay within the legal regulations during her online training, Expertly Utilize Healthcare Laws to Boost Government Reimbursement. Sign up today! |