Records requests are among the most regulated documents a practice receives by fax, and among the easiest to mishandle. They come from patients, other providers, insurers, attorneys and agencies. They arrive on the same number as everything else. And each kind of requester is treated differently, while a patient's own request carries a federal deadline that starts when the fax arrives, not when someone notices it.
This article sets out how a practice can receive, verify, track and answer records requests that arrive by fax. It summarizes federal requirements. State law can be stricter, and your release of information policy, written with your compliance adviser, is what your staff should follow.
Know who is asking
The first step with any records request is to identify the kind of requester, because that decides what the practice must, may or may not do.
- The patient, or the patient's personal representative, exercising the right of access.
- A third party the patient has designated to receive a copy, such as another provider or an app the patient uses.
- Another health care provider requesting records for the patient's treatment.
- Others, such as attorneys, insurers, employers or agencies, whose requests generally depend on the patient's written authorization or another basis the Privacy Rule recognizes.
Your release of information policy should map each type to the steps your staff take. When a request does not clearly fit, it should go to the person who owns release of information rather than being answered by whoever opened the fax.
A patient's request has a deadline
The right of access is set out in 45 CFR 164.524. Three parts of it matter most for a practice handling requests by fax.
Timing
A covered entity must act on a request for access no later than 30 days after receipt of the request. If it cannot, it may extend the time once, by no more than 30 days, provided that within the original period it gives the individual a written statement of the reasons for the delay and the date by which it will complete its action. State law may require a shorter period.
For a faxed request, "receipt" is when the fax arrives. A request that waits a week in a shared tray has used a week of the deadline. That is the strongest reason to route records requests to a dedicated destination.
Form and format
The practice must provide access in the form and format the individual requests, if it is readily producible in that form and format, or otherwise in a readable form agreed with the individual. Fees for copies are limited to a reasonable, cost-based amount defined in the same section.
Sending to a designated person
If the individual's request directs the practice to transmit the copy directly to another person, the practice must do so. That request must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy. When that destination is a fax number, it is the patient who chose it, and your staff should send to exactly that number.
Verify before you disclose
Before any permitted disclosure, a covered entity must verify the identity of a person requesting protected health information and the authority of that person to have access, if they are not already known to the practice. The requirement is in 45 CFR 164.514(h). A faxed request on letterhead does not by itself establish who sent it. Your policy should say how staff verify, for example by calling the requester at an independently confirmed number, or by matching identifying details against the chart.
Verification also protects against the most damaging records error: sending a complete record to the wrong place. Our article on preventing misdirected faxes covers the sending controls that apply to every outgoing response.
Disclosures for treatment
When another provider requests records to treat the patient, the disclosure is permitted for treatment, and it is one of the exceptions to the minimum necessary standard in 45 CFR 164.502(b). Many practices still send a focused set of records rather than the entire chart, because it is faster for both sides to work with. Your policy can set that default.
Track every request
A release of information log is the single most useful tool for records requests. For each request, record:
- the date and time the fax was received;
- the requester and the type of request;
- how identity and authority were verified;
- the due date, calculated from the date of receipt;
- any extension notice, and the date it was sent;
- what was sent, in what form, to whom and when; and
- the transmission confirmation for any faxed response.
Review open requests daily, nearest due date first. Our guide to naming, filing and tracking faxed documents explains how to keep the log, the request and the response linked, and our article on electronic fax audit trails covers why the transmission record is worth keeping alongside them.
Route records requests to one place
Because the deadline starts on arrival, records requests should never depend on someone noticing them in a general inbox. Give them a dedicated destination owned by your release of information staff, with a named backup. Put the dedicated fax number on your request forms and your patient portal, and keep the main number's triage rule clear about forwarding any request that arrives there immediately.
Where LABUSA eFaaS fits
LABUSA eFaaS delivers each incoming fax as a digital document to the recipients you designate, so records requests can go directly to your release of information staff instead of waiting in a tray. Responses are sent from email, and every transmission leaves a queryable record with status and delivery confirmation, which helps you show when a request arrived and when it was answered. Where your documents fall under HIPAA or state records law, the obligation to meet those rules stays with your practice, and eFaaS supplies named accounts and access control, encrypted transmission and storage, and retention you configure.
See how this fits a medical office on our medical practices page, read how eFaaS works, try LABUSA eFaaS free for 30 days, or request a workflow consultation. You can also contact our team.