Checklist · Healthcare

Requesting Health Records and Filing an Information Blocking Complaint: A Practical Checklist

42 U.S.C. § 1320

Type
Checklist
Jurisdiction
National
Date
2025-02-04
Topic
Healthcare

This checklist covers requesting health records and escalating when a request is refused, delayed, or overpriced. It begins with identifying what to ask for and from whom, then supplies the request mechanics that trigger statutory deadlines. Separate sections cover fees, formats, third-party direction, and the narrow grounds for denial. Later sections cover escalation to the privacy officer, the federal privacy complaint, and the separate information blocking complaint for systemic problems. The final sections cover the provider side: the operational controls that prevent complaints and the documentation that defends an exception.

Requesting Health Records and Filing an Information Blocking Complaint: A Practical Checklist

Healthcare > Health Records, Interoperability, and Information Blocking | Published 4 February 2025 - Updated 11 July 2026 | UpLaw - uplaw.us

Decide what you are actually asking for

☐ Identify the episode or period, with dates, and the condition or treatment at issue. ☐ Describe the records functionally rather than by document name — "all records used in making decisions about my care for [condition] between [dates]" reaches more than "my chart." ☐ List the categories expressly: clinician notes, orders, results, imaging and reports, medication administration records, discharge summaries, correspondence about care, billing records, and any risk scores or algorithmic outputs relied on. ☐ Identify every holder. One episode of care commonly involves a hospital, several physician groups, a laboratory, an imaging center, and a pharmacy, each with separate records. ☐ Confirm whether the records are electronic, because that determines the format you may demand. ☐ Consider what you do not need. A narrower request is fulfilled faster and costs less.

Make the request correctly

☐ Put it in writing and keep proof of delivery. ☐ Specify the format — electronic, in a named format if you have one, and state that you request an electronic copy if the record is maintained electronically. ☐ Specify the delivery method — secure portal, encrypted email with an acknowledgment of risk, mail, or transmission to a named third party. ☐ For third-party direction, sign the request and clearly identify the recipient and where to send it. ☐ Cite the deadline: thirty days, with one thirty-day extension permitted only on written notice stating the reason. ☐ Ask for a fee estimate in advance, and state that you understand the fee is limited to a reasonable cost-based amount. ☐ Address the request to the correct office — health information management or the privacy officer, not the treating clinician. ☐ Note the statutory basis — the access right under the privacy framework at 42 U.S.C. § 1320d and following, implemented at 45 C.F.R. Part 164, with electronic access provisions at 42 U.S.C. § 17935.

Check the fee

☐ Confirm the fee is cost-based, covering labor for copying, supplies, and postage, plus preparation of an explanation if you requested one. ☐ ⚠️ Object to per-page pricing for an individual access request; that is a litigation-copy schedule applied to the wrong workflow. ☐ Object to search and retrieval charges, which are not chargeable to the individual. ☐ Ask which fee schedule was applied and why, in writing. ☐ Check state law, which in several states caps fees lower or prohibits them for certain purposes. ☐ Note that no fee may be charged for an individual's access under the information blocking fees exception at 45 C.F.R. Part 171.

If the request is refused or narrowed

☐ Get the denial in writing, with the specific ground and the review rights. ☐ Test the ground. Psychotherapy notes maintained separately are excluded; ordinary mental health treatment records are not. Litigation-preparation material may be withheld; the underlying clinical record may not. ☐ Request review where the denial is reviewable; it must be conducted by a licensed professional who was not involved in the original decision. ☐ Ask for the non-excluded portion, since wholesale refusal because part of a record is protected is rarely supportable. ☐ For substance use disorder records, confirm whether the program is federally assisted and governed by 42 U.S.C. § 290dd-2 and 42 C.F.R. Part 2, and obtain the proper consent form if so. ☐ For a decedent's records, provide the appointment document showing personal representative status. ☐ For a minor's records, identify whether the care falls in a minor-consent category under state law.

Escalate

☐ Contact the privacy officer identified in the notice of privacy practices. This resolves a large share of disputes within days. ☐ State the facts and the deadline, attach the original request and proof of delivery, and ask for a written response by a date certain. ☐ File the federal privacy complaint if the deadline passes. It is free, requires no attorney, and is frequently resolved through technical assistance that produces the records. ☐ File a state complaint where the state provides shorter deadlines, lower fee caps, or its own enforcement. ☐ Consider a state private remedy, which some states provide and federal law does not. ☐ Keep a communication log with dates, names, and outcomes for every contact.

File an information blocking complaint when the problem is systemic

☐ Identify the actor type — health care provider, developer of certified health information technology, or health information network or exchange. ☐ Describe the practice, not just the incident: a portal that will not export, a refusal to connect to another provider, a contract term prohibiting sharing, a fee that deters exchange, or a pattern of delay applied to some requesters and not others. ☐ Explain why it is likely to interfere with access, exchange, or use of electronic health information. ☐ Note any exception the actor has invoked and why its conditions are not met — tailoring, consistency, non-discrimination, or documentation. ☐ Attach the evidence: correspondence, screenshots, fee schedules, contract excerpts, and dates. ☐ Understand the remedy. There is no private right of action; developers and networks face civil monetary penalties, and providers face payment-program disincentives. ☐ Reference the framework at 42 U.S.C. § 300jj-51 and the rules at 45 C.F.R. Part 171, with certification requirements at 45 C.F.R. Part 170. ☐ Continue pursuing the access right in parallel, because it produces the records and the blocking complaint produces a change in practice.

Provider side: prevent the complaint

☐ Map the designated record set across every system, in writing, including legacy systems and vendor-held data. ☐ Separate access requests from litigation copies with different workflows, fee schedules, and owners. ☐ Publish the access fee methodology and audit it against the cost-based standard. ☐ Train front-line and release-of-information staff, since most improper denials happen before anyone with authority sees the request. ☐ Log every request — receipt date, records sought, format requested, fee charged, extension notice, fulfillment date. ☐ Set a response-time metric with a named owner and report it. ☐ Never condition release on payment of a treatment bill. This appears repeatedly in enforcement resolutions. ☐ Never require notarization or an in-person visit as a condition of an access request. ☐ Accept the individual's own written request rather than requiring a proprietary form. ☐ Respond to third-party direction requests by transmitting, not by evaluating the recipient. ☐ Configure the portal for minors, proxies, and sensitive categories by policy rather than case by case. ☐ Test export from every system annually and confirm another system can ingest the output.

Provider side: document the exception

☐ Preventing harm — record the specific risk, the belief and its basis, why the practice is no broader than necessary, and the review available. ☐ Privacy — record the law and provision requiring withholding, and what consent would cure it. ☐ Security — maintain a written policy that is tailored to specific risks and applied consistently to all requesters, or document the case-by-case determination. ☐ Infeasibility — perform and record the feasibility analysis considering cost, resources, and technical capability, and send the required written response to the requester within the applicable period. ☐ Health IT performance — log planned maintenance windows, their duration, and their necessity. ☐ Content and manner — record why the requested manner could not be met and what alternative was offered, following the defined order of preference. ☐ Fees — document the objective cost basis, uniform application, and exclusion of costs that may not be recovered. ☐ Licensing — document terms, the negotiation period, and non-discriminatory application. ☐ ⚠️ Contemporaneous documentation is the whole defense. An analysis performed but not written is, for practical purposes, not performed.

Contracts to review

☐ Terms prohibiting sharing screenshots, product descriptions, or performance information ☐ Terms restricting connection to competing systems or other exchange participants ☐ Terms prohibiting disclosure of pricing ☐ Interface and integration fees that are not cost-based or are applied selectively ☐ Data export terms — cost, format, timeline, and whether export is tested ☐ Termination assistance and transition obligations ☐ Ownership and license of data on termination ☐ Business associate terms and subcontractor flow-down ☐ Indemnity for vendor-caused breaches and for blocking exposure arising from vendor conduct ☐ Change-of-control provisions affecting continuity of access

Model request language

Individual access request. "I am requesting a copy of my health information. Please provide all records used in whole or in part to make decisions about my care between [dates], including clinician and nursing notes, orders, laboratory and imaging results and reports, medication administration records, discharge summaries, correspondence regarding my care, billing records, and any risk scores or algorithmic outputs relied on. Because these records are maintained electronically, I request an electronic copy in [format]. Please deliver by [method]. I understand the response is due within thirty days, with a single thirty-day extension available only on written notice stating the reason. Please provide a fee estimate in advance; I understand the fee is limited to a reasonable, cost-based amount for labor for copying, supplies, and postage."

Third-party direction. "Please transmit a copy of the records described above to [recipient name, organization, and address or electronic endpoint]. This is a signed, written direction to transmit under the individual right of access."

Fee objection. "The fee quoted appears to be calculated on a per-page basis and to include search and retrieval time. For an individual's request for access, the fee is limited to a reasonable, cost-based amount and may not include search and retrieval. Please provide the fee methodology applied and a corrected estimate."

Deadline notice. "My request was delivered on [date]. More than thirty days have elapsed and I have received neither the records nor a written extension notice stating the reason. Please produce the records within five business days or I will file a complaint with the federal enforcement office and with [state agency]."

Denial challenge. "Your denial cites [ground]. That ground does not apply because [reason]. In any event, please produce the portion of the record not subject to the asserted ground, and advise whether the denial is reviewable and how to request review."

Information blocking complaint narrative. "The actor is [type]. The practice complained of is [describe], which is likely to interfere with the access, exchange, or use of electronic health information because [reason]. The actor has asserted [exception], which does not apply because [tailoring / consistency / non-discrimination / documentation deficiency]. Evidence attached: [list]."

Special situations

☐ Imaging. Ask for the study in a standard electronic format rather than accepting a disc by mail, and object if the fee reflects media and shipping the requester did not request. ☐ Legacy systems. Ask whether the records were migrated, archived, or retired, and request the written infeasibility analysis if production is refused. ☐ Portal-only delivery. Confirm the portal export produces a complete record; portals frequently omit imaging, scanned documents, and older encounters. ☐ Records held by a vendor. The provider remains responsible; direct the request to the provider, not the vendor. ☐ Closed practices. Identify the custodian named in the closure notice; state law usually requires one, and licensing boards often maintain a registry. ☐ Deceased patients. Provide appointment documentation; personal representatives step into the individual's rights. ☐ Minors. Identify the state's minor-consent categories, and ask the provider how the portal is configured for proxy accounts. ☐ Substance use treatment. Use the specific consent form the applicable regime requires; a general authorization will be refused, correctly. ☐ Employment and disability claims. Request early; these deadlines run independently of the records timeline and are the most common source of avoidable prejudice. ☐ Litigation. Keep the individual access request separate from discovery. They have different scopes, different fee rules, and different timelines, and conflating them slows both.

📌 The two habits that resolve most records problems: ask in writing with the format and deadline stated, and escalate to the privacy officer before assuming refusal is final.

Authority quick-reference for a records dispute

☐ Access right and privacy framework — 42 U.S.C. § 1320d, definitions and standards at 42 U.S.C. § 1320d-1 and 42 U.S.C. § 1320d-2. ☐ Enforcement and penalties — 42 U.S.C. § 1320d-5; criminal exposure for knowing wrongful disclosure at 42 U.S.C. § 1320d-6. ☐ Electronic access and security amendments — 42 U.S.C. § 17931, 42 U.S.C. § 17935, 42 U.S.C. § 17937. ☐ Privacy and security rules — 45 C.F.R. Part 160 and 45 C.F.R. Part 164; transaction standards at 45 C.F.R. Part 162. ☐ Health information technology program — 42 U.S.C. § 300jj, 42 U.S.C. § 300jj-11, 42 U.S.C. § 300jj-14. ☐ Certification and information blocking rules — 45 C.F.R. Part 170 and 45 C.F.R. Part 171. ☐ Substance use records — 42 U.S.C. § 290dd-2 and 42 C.F.R. Part 2. ☐ Federal agency records — 5 U.S.C. § 552a; education records — 20 U.S.C. § 1232g. ☐ Institutional record obligations — 42 C.F.R. Part 482 for hospitals and 42 C.F.R. Part 483 for long-term care. ☐ Remedial background — Whalen v. Roe on the privacy interest; Doe v. Chao and Federal Aviation Administration v. Cooper on the limits of damages; Gonzaga University v. Doe and Alexander v. Sandoval on the absence of implied private rights; Sorrell v. IMS Health Inc. on data as speech; Loper Bright Enterprises v. Raimondo on review of agency interpretation.

Tracking the matter

☐ Open a file the day the request is sent, containing the request, proof of delivery, and the calculated deadline. ☐ Diary the thirty-day date and the extended sixty-day date. ☐ Record every communication with date, participant, and substance. ☐ Capture any fee quote in writing, including the methodology if provided. ☐ Save the produced records with their transmittal, and check completeness against the request before closing the file. ☐ Note gaps immediately and make a supplemental request rather than starting over. ☐ If a complaint is filed, keep the confirmation and calendar a follow-up at sixty days. ☐ Close with a short memorandum noting what worked, because the same requester will need the same records again.

Common mistakes on both sides

☐ Requester: asking for "my file" rather than describing the records; accepting a per-page fee without objection; letting the thirty-day date pass unremarked; sending the request to the treating clinician instead of health information management; conflating the access request with litigation discovery. ☐ Provider: applying the litigation fee schedule; requiring a proprietary form or notarization; refusing because a bill is unpaid; refusing to transmit to a third party the provider distrusts; withholding an entire record because part is protected; failing to send the extension notice; and performing an exception analysis without writing it down.

Working notes

On tone. Records requests are administrative, and the fastest results come from letters that are precise rather than adversarial. A request citing the format, the deadline, and the fee standard signals competence, and competence gets routed to the person who can act. Threats early in the process usually route the matter to counsel and slow everything down.

On completeness. The most common quiet failure is a production that looks complete and is not. Portal exports omit scanned documents, outside records, imaging, and older encounters with striking regularity. Check the produced set against the encounter list before assuming the request was fulfilled, and make a specific supplemental request naming what is missing.

On timing. Every records dispute that becomes serious does so because a separate deadline was running: an appeal, a claim, a limitations period, a second opinion before a treatment decision. Ask the client what the records are for and when they are needed, and let that answer drive urgency and escalation.

On the provider relationship. Most patients will keep receiving care from the entity they are asking. That argues for escalating within the institution before escalating outside it, and for keeping the request separate from any clinical grievance. The privacy officer is not the person the patient is unhappy with, and treating them as an ally usually works.

On systemic problems. When the same institution generates repeated failures — a portal that never exports, a vendor fee that blocks migration, a policy of refusing third-party transmissions — the individual access route will keep producing individual fixes without changing anything. That is the moment to file the information blocking complaint, because it is aimed at the practice rather than the incident.

Related Documents