Risk Management

Medical Record Requests

Hans Bruhn, MHS, OMIC Senior Risk Management Specialist

Digest, Fall 2007

Medical record requests (MRR) are made for various business reasons (e.g., billing matters) as well as for ongoing patient care (e.g., referral to another physician or specialist). These requests require written authorization from the patient. The only exceptions to this rule involve requests pursuant to subpoenas, search warrants, or court orders, and certain mandatory reporting obligations where the law expressly allows for disclosure within the physician’s discretion.

Sometimes, an MRR is the first indication that a patient is dissatisfied with the treatment rendered and intends to file a lawsuit. This issue’s Closed Claim Study demonstrates that the medical record is an important defense against allegations of improper consent or poor overall management of care and underscores the need to respond carefully to an MRR.

Q  My practice regularly receives requests for medical records from various parties (patients, attorneys, etc.). Do I have to release the patient’s records to anyone he or she designates?

A  Yes, but each request for medical information should be evaluated carefully. Federal and state laws and regulations clearly specify that patients have the right to decide who has access to their medical information. HIPAA is the primary source for federal regulations on access to medical information and your state medical society can provide you with state requirements. Physicians should only release a patient’s medical information upon receipt of written authorization from the patient or the patient’s legal representative. The written request should meet HIPAA standards. (see www.omic.com for a sample medical record authorization.)

Q  Should I designate a specific person in my practice to respond to these requests?

A  Yes, in order to ensure that an MRR is handled properly, only authorized staff members in a physician’s practice should handle these requests. A written procedure should be developed for the practice and reviewed regularly with staff so it is clear who is authorized to handle these information requests. Be sure that these designated staff members are familiar with access laws and regulations as well as what can or cannot be done in the process of preparing a file for release to another party. For example, no “clarifying” remarks or statements should be added to the records prior to release. While these comments may be well intentioned, they will invariably furnish plaintiff attorneys with an opportunity to question the motive, and potentially damage the defensibility of your care. Of course, alteration of records is illegal and should never be done. If you feel that clarifying statements are needed, a separate file should be created. This is the appropriate place for statements clarifying chart entries, elaborations on your customs and practices for treatment, and recollections of your decision-making process. If a formal claim is made, your defense attorney may find this information helpful.

Q  Can I release the “original” medical record?

A  While a patient is given authority to control access to his or her medical information, the physician or surgical facility retains ownership of the record. Therefore, a physician should never release original records to a patient, a patient’s representative, or any other third party. Copies or a summary of treatment should be provided instead. Original medical records should only be released in appropriate instances (e.g., valid search warrant, court order, or subpoena). Contact OMIC’s Risk Management Hotline at (800) 562-6642, ext. 651 or 662, if you are unsure whether original documents or copies should be released, or if you have other questions related to record releases.

Q  Do I need to release records we have received from other physicians? How about letters from the patient and billing records?

A  Yes, anything related to patient care and treatment is considered part of the medical record, and should be released unless the authorization specifies more limited information. For additional information on confidentiality, see “Confidentiality/Privacy issues and Malpractice Claims” in the Risk Management Recommendations section of www.omic.com.