HIPAA Compliance with a Medical Record Request

Often, when a facility receives a request for a copy of a resident’s medical records, complying with that request is a fairly straightforward process.  Other times, balancing the requirements set forth by HIPAA (and complementary state regulations) with an individual’s rights to access and/or receive copies of medical records, can be a bit tricky.  That is why it is important for any organization to have policies and procedures in place that provide guidance on how to comply with medical record requests.
When a request for records is received, there are several items that need to be considered:

Legal Representative

Before complying with a request for a copy of a resident’s medical records, the facility must determine if the person requesting the records has the authority to receive them. 
If the requestor is the resident or former resident, then the process is simple:  the records must be provided according to the timeframe specified by HIPAA. 
If the resident/former resident is living, and a copy of the records are being requested by an individual other than the resident, that individual must provide documentation that they are any of the following:

• Guardian or Conservator (requires a court appointment document)
• Durable or General Power of Attorney
• Medical Power of Attorney
• Health Care Surrogate

If the resident is deceased, many states require that the person requesting the decedent’s medical records produce documentation that they have been appointed as the administrator or executor of the decedent’s estate.  Other states may simply require that the requestor be “next of kin.”  Refer to your state’s guidelines to determine what your state requires.
If the request is received from an attorney’s office, the attorney must provide a HIPAA Complaint Authorization form signed by the resident or the resident’s legal representative (one of the above-referenced forms of representative, or the representative of the resident’s estate).
Absent this crucial documentation, you are not permitted, by HIPAA, to release a copy of a resident’s records.

Timeframe

When it has been determined that the individual requesting a copy of a medical record is legally authorized to receive the records, a copy of the records must be provided within 30 days from the date of receipt of the request, per the HIPAA Privacy Rule.  If the records are located off-site, the records must be provided within 60 days.  A single 30-day extension of this deadline can be requested, but the extra time needed to comply with the request must be explained in writing to the requestor, providing a date by which the records will be provided.  However, If the resident is requesting a copy of their own records and is currently residing in your facility, a copy of the records must be provided within two business days [CFR § 483.10(b)(2) (ii)].

Documentation of the Request for Records

According to AHIMA (American Health Information Management Association), “All incoming requests for Release of Protected Health Information should be logged on a Release of Information Log.”  Entry of the request for records should include the following information: 

• Date of the request
• The resident’s name
• Whether an authorization form was required (yes/no)
• Purpose of the request (if known)
• Description of the documents released
• The date the records were provided
• Whether or not a fee was charged (yes/no)

A simple spreadsheet will meet this need.
Navigating HIPAA and state-specific regulations related to the disclosure of medical records can be daunting.  Ensuring solid policies and procedures are in place as well as having reference tools available, such as checklists, can be helpful when a request for records is received.  Having a connection with a healthcare attorney or having a professional on-staff who is certified through AHIMA can be a valuable asset to your organization. 
AssuredPartners Senior Living professionals have developed a sample medical records request policy and procedure, a medical records request authorization form as well as medical records release checklists for both skilled nursing facilities and assisted living communities.  To request a copy of these helpful documents for your organization, reach out to our senior living team.