If you are a primary care physician, you have probably experienced the following situations:
- You receive a request for medical record release from another physician, an attorney office, or governmental agency.
- You are referring or sending a patient to a consultant or a specialist.
What do you need to send? Do you need your patient's authorization? Will sending records violate the Health Insurance Portability and Accountability Act (HIPAA)?
If your front office staff is in charge of copying medical records, they should be able to answer the following questions:
- What does the record request indicate?
- Who is the record request from?
- What is important?
- Do I share sensitive information?
- Do I include electronic versions of lab reports?
Is there a process?
Appropriate staff training on what to and how to release records from your electronic health records (EHR) system can be cumbersome and confusing. Training staff on how to read and decipher the record release is important. However, producing the records from your EHR system should be designed to not copy or send anything that is "protected" or which was not requested.
If the patient is referred to a specialist, your office should have standard procedures with step-by-step procedures for records staff members indicating what to print and send to the consultant or department.
Teach staff members to read exactly who the request is from. Does the request have company letterhead? Does it have contact information? Is it signed by the patient or the patient's legal representative?
What do I print?
When printing the record, staff must have a thorough understanding of which items to select for printing. Be sure not to select any confidential information such as HIV, psychiatric records, mental health records, and addiction records etc., unless the authorization specifically indicates that these records may be released.
Be consistent and thorough in your standards. Teach staff to send the same items every time for all routine records requests. Encourage them to ask questions on unusual requests or requests from legal offices and attorneys.
Can I make an electronic copy of the EHR?
Under HIPAA guidelines, a patient or medical office can request the records to be sent in this type of format. The office should devise a system to provide this, either via compact disc (CD), USB Flash Drive, HIPAA-secure patient portal, or encrypted e-mail system.
Authored by
Joseph Wager and Allan Ridings
Senior Risk Management & Patient Safety Specialists
If you have questions about this article, please contact us. This information should not be considered legal advice applicable to a specific situation. Legal guidance for individual matters should be obtained from a retained attorney.