Identify the holder and the records
List the provider or plan that may hold each requested record and the relevant period. Describe what you need clearly enough for the holder to understand the request. HHS explains rights of access to certain medical and billing records held by entities covered by the US HIPAA Privacy Rule, with exceptions. That is not a promise of unrestricted access to every note, nor a statement of the law in every country.
Ask for the correct route and format
Use the holder’s verified access process and ask how identity, authority, format and delivery are handled. If someone acts for another person, ask what evidence of authority the actual process requires. Do not send a full medical file to an unverified email address or upload it to this worksheet. Rights, fees, exceptions and timing should be checked with the provider and the relevant authority for the case.
Keep a minimal request log
Record a neutral reference, the scope requested, date sent, contact route and response. A log can point to a private file location without repeating diagnoses, identifiers or clinical details. Keep your own copy of the request and preserve the received originals. If a response concerns only one part of the request, mark the remaining part pending instead of treating an automated message as a complete delivery.
Reconcile what actually arrived
Compare the received dates and record types with the request. Ask the holder about an omission or an unreadable file through its proper process. A document inventory does not determine whether the clinical record is correct or interpret a test result. HHS describes a route to request amendments; do not silently edit a received original and present it as the provider’s record. Keep an authorised correction or response with the original.
Read the drawing as text
Request R1 asks for a clinical period and billing information. Delivery D1 covers the clinical portion only. Billing remains pending; the record inventory does not interpret health information.
Work through an example
An illustrative request R1 asks Provider P for records for a stated period and separate billing information. Delivery D1 contains the requested date range of clinical files, but no billing response. The tracker marks D1 received and the billing portion pending. No actual patient, diagnosis, provider response or successful rights request is represented.
Illustrative example; figures, people and organisations in the worked record are fictional.
The example record
R1 clinical period
- Received evidence
- D1 date range listed privately
- State
- Receipt recorded
R1 billing portion
- Received evidence
- No response recorded
- State
- Pending
File readability
- Received evidence
- Check before closing request
- State
- Not clinical interpretation
Amendment question
- Received evidence
- Use holder’s proper process
- State
- Keep original intact
Download blank worksheet (.csv) ↗Download worked example (.csv) ↗
Keep your own record
Use the result within its scope
Use qualified advice and the appropriate privacy authority when access is disputed. This organisational method does not provide medical interpretation, legal advice or secure storage for your records.
Reference sources
Earlier articles on this subject
- What Are The Use Of Online Health Records? ↗ — 2022-04-15, Maria Baldwin.