Checklist · Healthcare

Obtaining, Correcting, and Protecting Medical Records: A Practical Checklist

42 U.S.C. § 17935

Type: Checklist
Jurisdiction: National
Date: 2024-03-26
Topic: Healthcare

This checklist walks a patient or advocate through obtaining a complete medical record, correcting what is wrong in it, controlling who else receives it, and putting decision-making documents in place before they are needed. The access phase covers what to request, the deadline, the format and fee rules, and the responses that signal a provider is out of compliance. The amendment phase sets out the request that works and the statement of disagreement that follows a denial, which frequently outperforms the correction. Control phases address authorizations and how to narrow them, subpoenas and the written objection that keeps records out of a case, and the categories that carry heightened protection. Response phases cover breach notices, medical identity theft, and the complaint routes that actually produce records. Decision-making phases cover informed consent, advance directives, proxies, and surrogate rules. A final phase addresses emergency care, language access, and disability accommodations. A deadline table, a division of responsibility, and fifteen ranked failure modes close the document.

Obtaining, Correcting, and Protecting Medical Records: A Practical Checklist

Healthcare > Patient Rights and Medical Records | Published 26 March 2024 - Updated 6 March 2025 | UpLaw - uplaw.us

Do Phase 1 while nothing is pending. By the time a record matters — a disability claim, a custody case, an insurance application — it is too late to fix it.

Use with Patient Rights and Medical Records: A Comprehensive Guide to Access, Amendment, Privacy, and Consent and The Patient Rights and Medical Records Toolkit.

Phase 1 — Request the complete record

☐ Request the designated record set, in writing, citing 45 CFR Part 164.

☐ ⚠ Do not accept a patient portal as the answer. A portal is a curated subset that frequently omits notes, images, and older material.

☐ Specify what you want:

☐ All physician, nursing, and consultation notes
☐ All laboratory and pathology results
☐ Imaging reports and the images themselves
☐ Discharge summaries and operative reports
☐ Problem list, medication list, allergy list, immunization record
☐ Social history and family history
☐ Care plans and correspondence
☐ Billing and coding records
☐ Device and remote-monitoring data the provider maintains
☐ Any other records used to make decisions about you

☐ Ask for electronic format where records are maintained electronically — 42 U.S.C. § 17935.

☐ Direct a copy to a third party in the same letter if useful — a new physician, a lawyer, a family member.

☐ Note the deadline: 30 days, with one 30-day extension on written notice stating the reason.

☐ Fee: a reasonable cost-based fee for copying labor, supplies, and postage. ⚠ Search and retrieval charges are not permitted, and a state per-page schedule frequently does not govern your own request.

☐ ⛔ Access may not be conditioned on paying an unrelated bill.

☐ A summary is permitted only if you agree in advance to the summary and the fee.

☐ Request from every provider you have seen more than twice, not just the primary.

☐ If the practice closed, ask the state licensing board where the records went.

Phase 2 — Read it

☐ The problem list. ⭐ This is where a rule-out diagnosis lives forever. ☐ The medication and allergy lists. Errors here are clinically dangerous, not just administrative. ☐ The social history — employment, housing, substance use, relationship entries that were entered once and carried forward. ☐ The narrative notes for phrases that will be read by adjudicators: "no acute distress," "appears comfortable," "non-compliant," "poor historian," "drug-seeking." ☐ The family history, for entries belonging to a different patient. ☐ Identifiers — name, date of birth, and record number on every page. ☐ Care you did not receive. ⚠ This is medical identity theft and it is the most damaging error in a chart. ☐ Note every error with the date, page, and author.

Phase 3 — Amend what is wrong

☐ Submit an amendment request — 45 CFR Part 164. 60 days to act, one 30-day extension.

☐ The request that works:

☐ Identify the record, date, page, and author
☐ Quote the exact statement
☐ State why it is inaccurate or incomplete
☐ State the proposed correction
☐ Attach evidence — a competing result, a specialist letter, corrected identifiers
☐ Ask that everyone who received the erroneous information be notified
☐ ⭐ State in advance that a statement of disagreement will follow any denial

☐ ⭐ If denied, submit the statement of disagreement. The provider must include it, or a summary of it, with every future disclosure of the disputed record.

☐ Write the statement carefully and without anger. It will be read by disability adjudicators, insurers, and future physicians, and its persuasiveness is entirely a function of tone.

☐ ⚠ Amendment cannot delete a clinical opinion — but it can correct a fact, and the statement can attach your account to an opinion permanently.

☐ Request the record again afterward to confirm the amendment or the statement was actually filed.

Phase 4 — Find out who has it

☐ Request an accounting of disclosures for the period the rules allow — the date of each, the recipient, what was disclosed, and the purpose.

☐ Request a copy of the notice of privacy practices, which identifies the privacy officer.

☐ Request confidential communications — that you be contacted only at a particular address or number.

☐ Request restrictions on use and disclosure. ⭐ One must be honored: a restriction on disclosure to a health plan for an item you paid for entirely out of pocket — 42 U.S.C. § 17935.

Phase 5 — Control what you sign

☐ Read every authorization before signing.

☐ A valid authorization must state: what information · who may disclose it · who may receive it · the purpose · an expiration date or event · the right to revoke and how · that treatment is generally not conditioned on signing.

☐ ⭐ Narrow it. Cross out and initial:

☐ Limit the date range — "records from 1 January 2023 to the present," not "all records ever created"
☐ Limit the subject matter — "records relating to the [knee] injury only"
☐ Limit the recipient
☐ Set a short expiration
☐ ⛔ Strike any authorization for psychotherapy notes or substance use records unless you intend it

☐ ⚠ Never sign a blanket "release all records forever" form for an insurer, an employer, or an opposing party. Providers accept narrowed authorizations routinely.

☐ Invoke the minimum necessary standard where a non-treatment request seeks an entire lifetime record for a limited purpose.

☐ Revoke in writing when the purpose has ended, and keep the copy.

Phase 6 — Subpoenas and litigation

☐ ⚠ A subpoena alone is generally not enough. A provider may disclose in a proceeding only on a court order, or on satisfactory assurances that you were notified with an opportunity to object, or that a qualified protective order was sought.

☐ ⭐ If you receive notice, object in writing by the stated deadline. Send it to the issuing party and to the provider.

☐ The objection should say:

☐ The condition is not at issue in the proceeding
☐ The request is overbroad in time and subject matter
☐ ⛔ Any portion is substance use disorder treatment records under 42 CFR Part 2, which require a court order with specific findings
☐ Any portion is psychotherapy notes, requiring separate specific authorization
☐ In the alternative, a qualified protective order limiting use and requiring return or destruction

☐ Assert the privilege where applicable — Jaffee v. Redmond.

☐ ⚠ Understand waiver. Putting your own condition in issue waives protection as to that condition — not your whole history. Argue the scope.

☐ Where testing serves a law enforcement purpose, note Ferguson v. City of Charleston.

☐ For records held by federal agencies, use 5 U.S.C. § 552a and 5 U.S.C. § 552; compare Whalen v. Roe on government health databases.

Phase 7 — Heightened-protection categories

☐ ⭐ Substance use disorder records — 42 CFR Part 2. Stricter than general privacy rules; ⚠ a general medical authorization does not reach them, and re-disclosure is restricted.

☐ Psychotherapy notes — narrowly defined, excluded from the access right, and requiring separate authorization. ⚠ Providers frequently over-claim this category — the medication record, session times, diagnosis, treatment plan, and progress summaries are not psychotherapy notes.

☐ Genetic information — additional restrictions in employment and insurance contexts.

☐ HIV, reproductive health, and mental health information — ⭐ frequently more protected by state law than by federal law. Check the state statute.

☐ Long-term care residents — access to their own records, participation in care planning, notice before transfer or discharge, and grievance procedures under 42 CFR Part 483. ⭐ Routinely unknown to families.

☐ Research records — 45 CFR Part 46, 21 CFR Part 50.

☐ Minors — ⭐ where a minor lawfully consented to the care alone, the minor generally controls that record. State law governs.

Phase 8 — Breaches and identity theft

☐ Read the breach notice: what happened, when, what information, what the entity is doing, what you should do — framework at 42 U.S.C. § 17931.

☐ Request the accounting of disclosures.

☐ Place a fraud alert or credit freeze if identifiers were involved.

☐ ⭐ Check the record for care you did not receive. Medical identity theft is the most damaging form, because false clinical information affects later treatment.

☐ Request amendment of every entry generated by someone else's use of your identity, and ask that prior recipients be notified.

☐ ⚠ Remedies: there is generally no private right of action under the federal privacy rules. Enforcement is administrative under 45 CFR Part 160; criminal penalties for wrongful disclosure sit at 42 U.S.C. § 1320d-6. ⭐ Private claims arise under state law.

Phase 9 — If a provider refuses

☐ Ask for the refusal in writing, with the reason and the regulatory basis.

☐ Check whether the ground is one the rules permit — psychotherapy notes, litigation-compiled material, a reviewable endangerment determination. ⭐ A reviewable denial entitles you to review by another licensed professional. Ask for it.

☐ Escalate to the privacy officer, identified on the notice of privacy practices. ⭐ Most disputes resolve here.

☐ File a complaint with: the federal enforcement office · the state licensing board · the state attorney general's health care or consumer division · the facility's grievance process · the long-term care ombudsman, for facility residents · the accrediting body.

☐ Attach the request, proof of delivery, and all correspondence.

☐ ⭐ Access denials are the most commonly enforced violation in this field, and a documented complaint frequently produces the record within weeks.

☐ Document any adverse change in care that follows a complaint — retaliation is prohibited.

Phase 10 — Decision-making documents

☐ ⭐ Execute a health care power of attorney naming an agent. The single most valuable document a family can have.

☐ Execute an advance directive or living will stating wishes about life-sustaining treatment. The clear-and-convincing-evidence framework of Cruzan v. Director, Missouri Department of Health is the reason to write it down.

☐ Execute a separate records authorization for the agent — decision-making authority and records access are not identical.

☐ Ask about a portable medical order if you have a serious illness — a physician order that travels across settings.

☐ Document organ donation wishes.

☐ ⚠ Distribute copies — to the agent, the primary care provider, the hospital, and the family. A directive in a drawer at home is useless at 2 a.m.

☐ Re-execute after a move, a divorce, or a change in the agent's availability.

☐ Know the surrogate priority list in your state, and whether it matches your actual relationships. ⚠ It frequently does not.

☐ ⭐ Ask for an ethics consultation by name if a decision-making dispute arises. Available at most hospitals, free, and almost never requested.

Phase 11 — Consent, emergency care, and access

☐ Informed consent requires a conversation, not a signature: the nature of the procedure, the risks and benefits, the alternatives including doing nothing, and the risks of refusing.

☐ Ask for the after-visit summary and the note in writing rather than recording, where policy or state law makes recording contentious.

☐ ⭐ Emergency care: a hospital with an emergency department must screen and stabilize regardless of insurance or ability to pay — 42 U.S.C. § 1395dd. ⚠ Screening may not be delayed for an insurance inquiry. Related conditions of participation at 42 U.S.C. § 1395cc.

☐ Demand qualified interpretation — 42 U.S.C. § 18116, 45 CFR Part 92. ⚠ A family member is not compliance, and it produces clinical error.

☐ Request auxiliary aids and accessible equipment — 29 U.S.C. § 794, 42 U.S.C. § 12182. Includes accessible examination tables and scales, and effective communication for deaf and hard-of-hearing patients.

☐ Acknowledge receipt of the notice of privacy practices if asked — ⚠ acknowledgment is not consent, and refusing to sign does not authorize a denial of care.

The deadline table

Item	Deadline	Consequence
Access request	30 days, one 30-day extension with written notice	Escalate and complain
Amendment request	60 days, one 30-day extension	Escalate and complain
Statement of disagreement	On denial	⭐ A permanent annotation
Accounting of disclosures	60 days	—
Objection to a subpoena	⚠ As stated in the notice — short	The records are produced
Breach response	Promptly	Identity theft compounds
Revoking an authorization	Any time, in writing	Continued disclosure
Emergency screening	Immediate	—

Who does what

You, this month. Request the record from every provider. Read it. Amend one thing. You, before anything is pending. The proxy, the directive, and the records authorization. The privacy officer. Where most access disputes resolve. A patient advocate or ombudsman. Facility-level problems, especially in long-term care. Your lawyer. Subpoena objections, waiver scope, and state-law claims after a breach. Your agent. Needs the documents, the copies, and the conversation — in advance.

Failure modes, ranked

Never reading your own record.
Accepting the portal as the record.
Paying a per-page or retrieval fee without objecting.
Believing access can be denied over an unpaid balance.
Never requesting an amendment.
⭐ Not submitting a statement of disagreement after a denial.
Signing a blanket authorization without narrowing it.
Ignoring a subpoena notice and letting the deadline pass.
Not identifying 42 CFR Part 2 records in an objection.
Not checking a record for care you never received.
Assuming a breach notice creates a federal lawsuit.
Having no health care power of attorney.
Executing a directive and leaving it in a drawer.
Accepting a family member as an interpreter.
⚠ Not knowing the emergency screening obligation.

Appendix A — The record review worksheet

Work through the record with this page beside you.

Section	What to check	Errors found
Identifiers	Name, DOB, and record number on every page
Problem list	⭐ Rule-out diagnoses never removed; resolved conditions still active
Medication list	Discontinued drugs still listed; dosages; duplicates
Allergy list	Missing allergies; allergies you do not have
Immunizations	Missing entries
Social history	Employment, housing, substance use, relationship entries carried forward from years ago
Family history	⚠ Entries belonging to a different patient
Narrative notes	"No acute distress" · "appears comfortable" · "non-compliant" · "poor historian" · "drug-seeking"
Laboratory and imaging	Results attributed to the wrong patient; missing results
Encounters	⚠ Care you did not receive — medical identity theft
Billing and coding	Diagnoses added for billing that were never made clinically
Consent forms	Procedures you did not consent to; signatures that are not yours

☐ ⭐ Rank the errors by consequence, not by annoyance. Amend the ones that will be read by a disability adjudicator, an underwriter, or the next physician.

Appendix B — The three letters

1. Access

Pursuant to my right of access under 45 CFR Part 164, I request a copy of my complete designated record set — all physician, nursing, and consultation notes; all laboratory and pathology results; all imaging reports and the images themselves; discharge summaries and operative reports; the problem, medication, allergy, and immunization lists; social and family history; care plans; correspondence; billing and coding records; and any other records used in whole or in part to make decisions about me. I request electronic format. I understand the fee is limited to a reasonable cost-based fee for copying labor, supplies, and postage, and may not include search or retrieval costs. Please advise if it will exceed $[__]. I understand you must act within 30 days.

2. Amendment

Pursuant to 45 CFR Part 164, I request amendment of the following. Record: [type], dated [date], page [__], author [name]. Statement at issue, quoted: "[text]". Why it is inaccurate: [ ]. What it should say: [ ]. Attached: [specialist letter / test result / corrected identifiers]. Please notify the following recipients of the erroneous information: [ ]. I understand you must act within 60 days. ⭐ If this request is denied, please provide the denial in writing with the reason; I will submit a statement of disagreement to be included with any future disclosure.

3. Subpoena objection

I object to production of my medical records in response to the subpoena dated [date]. My condition is not at issue in this proceeding; the request is overbroad in time and subject matter; ⛔ portions are substance use disorder treatment records governed by 42 CFR Part 2, requiring a court order with specific findings; portions are psychotherapy notes requiring separate authorization; and I assert the psychotherapist-patient privilege recognized in Jaffee v. Redmond. In the alternative, I request a qualified protective order limiting use to this litigation and requiring return or destruction at its conclusion. I do not consent to disclosure.

Appendix C — The four documents to execute this month

☐ 1. Health care power of attorney. Names an agent to make decisions if you cannot. ⭐ The highest-value document on this page.

☐ 2. Advance directive / living will. States your wishes about life-sustaining treatment. The reason to write it down is Cruzan v. Director, Missouri Department of Health and the clear-and-convincing-evidence standard it upheld.

☐ 3. A records authorization for your agent. ⚠ Separate from decision-making authority. Without it, your agent may be able to decide but not to read.

☐ 4. A portable medical order, if you have a serious illness — a physician order that travels between home, hospital, and facility.

Then: ☐ Give copies to: the agent · the alternate agent · your primary care provider · the hospital you would use · one family member who is not the agent. ☐ Photograph them and keep the images on your phone. ☐ Have the conversation. ⭐ A document your agent has never discussed with you is a document they will hesitate to follow. ☐ Re-execute after a move, a divorce, or a change in the agent's availability.

Appendix D — The four-step month

☐ Week 1. Send the access request to your primary care provider and to every specialist you have seen more than twice.

☐ Week 2–3. Read the record with Appendix A. Rank the errors by consequence.

☐ Week 4. Send one amendment request for the most consequential error. Execute the four documents in Appendix C.

☐ Ongoing. Request the record again every two to three years, and after any hospitalization, any change of provider, and any breach notice.

⭐ That is the whole practice. It costs almost nothing, takes a month of small steps, and it is the difference between a record that describes you and one that merely happened to you — read by adjudicators, underwriters, evaluators, and physicians who will never meet the version of you that is not in it.

Obtaining, Correcting, and Protecting Medical Records: A Practical Checklist

Phase 1 — Request the complete record

Phase 2 — Read it

Phase 3 — Amend what is wrong

Phase 4 — Find out who has it

Phase 5 — Control what you sign

Phase 6 — Subpoenas and litigation

Phase 7 — Heightened-protection categories

Phase 8 — Breaches and identity theft

Phase 9 — If a provider refuses

Phase 10 — Decision-making documents

Phase 11 — Consent, emergency care, and access

The deadline table

Who does what

Failure modes, ranked

Appendix A — The record review worksheet

Appendix B — The three letters

Appendix C — The four documents to execute this month

Appendix D — The four-step month

Related Documents