Toolkit · Healthcare

The Patient Rights and Medical Records Toolkit

42 U.S.C. § 17935

Type
Toolkit
Jurisdiction
National
Date
2023-10-25
Topic
Healthcare

This toolkit supplies the letters and worksheets a patient or advocate needs to obtain a complete medical record, correct it, control who receives it, and put decision-making documents in place. It opens with an access request letter written to the federal right of access, a fee objection for the charges providers most often impose unlawfully, and a record review worksheet that turns a stack of pages into a list of correctable errors. Amendment and statement-of-disagreement templates follow, with drafting guidance on the tone that makes a statement persuasive to the adjudicators and physicians who will read it. Control modules cover the accounting of disclosures request, an authorization narrowing guide, and a subpoena objection that identifies the categories requiring a court order. Response modules handle breach notices and medical identity theft. A decision-making package covers the proxy, the directive, the agent records authorization, and the distribution step families skip. Complaint and escalation modules, an emergency rights card, and an authority card close the toolkit.

The Patient Rights and Medical Records Toolkit

Healthcare > Patient Rights and Medical Records | Published 25 October 2023 - Updated 9 October 2024 | UpLaw - uplaw.us

Tool 1 this week. Tool 11 this month. Everything else responds to what those two produce.

Pair with Patient Rights and Medical Records: A Comprehensive Guide to Access, Amendment, Privacy, and Consent and Obtaining, Correcting, and Protecting Medical Records: A Practical Checklist.

Tool 1 — The access request

[Date] · [Provider], attn. Medical Records / Privacy Officer Patient: [name] · DOB: [date] · MRN: [number] · Telephone: [ ]

Re: Request for access to protected health information

Pursuant to my right of access under 45 CFR Part 164, I request a copy of my complete designated record set, including:

  1. All physician, nursing, therapy, and consultation notes
  2. All laboratory, pathology, and diagnostic results
  3. All imaging reports and the images themselves
  4. Operative reports, anesthesia records, and discharge summaries
  5. Problem list, medication list, allergy list, and immunization record
  6. Social history and family history
  7. Care plans, referrals, and correspondence
  8. Billing, coding, and claims records
  9. Any device or remote-monitoring data you maintain
  10. Any other records used, in whole or in part, to make decisions about me

Format. I request electronic format [PDF / portable media], which I understand you maintain. If any portion is not readily producible in that format, please advise.

Fee. I understand the fee is limited to a reasonable, cost-based fee for labor for copying, supplies, and postage, and may not include search or retrieval costs. Please advise of the amount before proceeding if it exceeds $[__].

Timing. I understand you must act within 30 days, with one 30-day extension available on written notice stating the reason.

[Optional:] Please also send a copy directly to: [name, address].

[Signature · printed name · date of birth · address]

☐ ⚠ If offered the patient portal: the portal is not the designated record set. Repeat the request. ☐ ⛔ If told a balance must be paid first: access may not be conditioned on payment of an unrelated bill. ☐ Send by a method that produces proof of delivery.

Tool 2 — The fee objection

[Date] · Re: Records request dated [date] — fee

I received an invoice of $[], described as [$ per page / a retrieval fee / an administrative fee].

Under the individual right of access at 45 CFR Part 164, the permissible fee is limited to a reasonable, cost-based fee for (a) labor for copying, (b) supplies, and (c) postage. ⛔ Costs of searching for and retrieving records may not be charged.

Please provide: the basis for the fee, itemized by component; the hourly labor rate used and the time charged; and confirmation that no search or retrieval cost is included.

I am requesting electronic delivery, for which the cost-based fee should be minimal.

If the fee is not revised, I intend to file a complaint with the federal enforcement office and the state licensing board.

Tool 3 — The record review worksheet

Section Check for Errors found (date / page)
Identifiers Name, DOB, MRN on every page
⭐ Problem list Rule-out diagnoses never removed; resolved conditions still active
Medication list Discontinued drugs; wrong dosages; duplicates
Allergy list Missing allergies; allergies you do not have
Immunizations Missing entries
Social history Employment, housing, substance use, relationship entries carried forward
Family history ⚠ Entries belonging to another patient
Narrative notes "No acute distress" · "appears comfortable" · "non-compliant" · "poor historian" · "drug-seeking"
Labs and imaging Results attributed to the wrong patient; missing results
⚠ Encounters Care you did not receive — medical identity theft
Billing / coding Diagnoses added for billing that were never made clinically
Consent forms Procedures not consented to; signatures that are not yours

☐ ⭐ Rank errors by consequence, not by annoyance. Amend what a disability adjudicator, an underwriter, or the next physician will read.

Tool 4 — The amendment request

[Date] · Request for amendment of protected health information Patient: [name] · DOB: [date] · MRN: [number]

Pursuant to 45 CFR Part 164, I request amendment of the following information, which is inaccurate or incomplete:

1. The record: [type], dated [date], page [__], authored by [name]. 2. The statement at issue, quoted exactly: "[text]" 3. Why it is inaccurate or incomplete: [two or three sentences, factual]. 4. What it should say: [proposed correction]. 5. Supporting documentation attached: [specialist letter dated __ · laboratory result dated __ · corrected identifiers · prior records]. 6. Notification. Please notify the following persons and entities, who received the erroneous information: [list]. 7. Timing. I understand you must act within 60 days, with one 30-day extension on written notice. 8. ⭐ If this request is denied, please provide the denial in writing with the reason. I will submit a statement of disagreement to be included with any future disclosure of the disputed record.

[Signature · printed name · DOB · date]

Tool 5 — The statement of disagreement

⭐ The most under-used instrument in patient rights practice. Even a denied amendment produces a permanent annotation.

STATEMENT OF DISAGREEMENT To be included with all future disclosures of the record identified below Patient: [name] · DOB: [date] · MRN: [number] · Date: [ ]

The record: [type], dated [date], page [__], author [name]. The statement at issue: "[quoted text]"

On [date] I requested amendment of this entry. The request was denied on [date] on the ground that [reason].

I disagree, for the following reasons:

  1. [Fact, with support.]
  2. [Fact, with support.]
  3. [Fact, with support.]

Attached: [documentation].

I request that this statement, or an accurate summary of it, be included with any future disclosure of the disputed information, as 45 CFR Part 164 provides.

☐ ⭐ Write it measured and factual. It will be read by disability adjudicators, insurers, and future physicians, and persuasiveness is entirely a function of tone. ☐ Keep it under one page. A long statement is skimmed; a short one is read. ☐ Request the record again afterward to confirm the statement was filed with it.

Tool 6 — The accounting of disclosures request

Pursuant to 45 CFR Part 164, I request an accounting of disclosures of my protected health information for the [six] years preceding this request, including for each: the date · the name and address of the recipient · a description of the information disclosed · and the purpose or a copy of the written request.

If any disclosures are excluded from the accounting requirement, please identify the category of exclusion relied upon.

I also request: a copy of the current notice of privacy practices; the name and contact information of your privacy officer; and a list of business associates with access to my information.

☐ Also useful to request at the same time:

  • ☐ Confidential communications — contact me only at [address / number]
  • ☐ ⭐ A restriction on disclosure to a health plan for services I paid for entirely out of pocket, which must be honored — 42 U.S.C. § 17935

Tool 7 — The authorization narrowing guide

Never sign a form as printed. Cross out, write in, and initial each change.

The form says Change it to
"All medical records" "Records relating to [the knee injury / treatment on 14 March 2024] only"
"From the beginning of time" "From [1 January 2023] to the present"
"To [insurer] and its agents, affiliates, and assigns" "To [named person] at [named entity] only"
"For any purpose" "For the sole purpose of [evaluating claim no. __]"
"This authorization does not expire" "This authorization expires on [date] or on final determination of the claim, whichever is earlier"
Silence on psychotherapy notes ⛔ "This authorization does not extend to psychotherapy notes"
Silence on substance use records ⛔ "This authorization does not extend to records governed by 42 CFR Part 2"
Silence on genetic information "This authorization does not extend to genetic information"
Silence on re-disclosure "The recipient may not re-disclose this information to any third party"

☐ A valid authorization must state: what information · who discloses · who receives · the purpose · an expiration · the right to revoke and how · and that treatment is generally not conditioned on signing. ☐ ⭐ Invoke the minimum necessary standard where a non-treatment requester seeks an entire lifetime record for a limited purpose. ☐ Revoke in writing when the purpose ends, and keep the copy. ☐ ⚠ Providers accept narrowed authorizations routinely. The form is a default, not a requirement.

Tool 8 — The subpoena objection

☐ ⚠ Calendar the deadline the day the notice arrives. Send the objection to the issuing party and the provider.

[Date] · To: [Counsel who issued the subpoena] · cc: [Provider, attn. Privacy Officer]

Re: Objection to subpoena for medical records — [case caption, case no.]

I object to production of my medical records in response to the subpoena dated [date], and I do not consent to disclosure.

1. Relevance. My [medical / mental health / substance use treatment] condition is not at issue in this proceeding. [If partially at issue:] Only my [specific condition] is at issue; the subpoena seeks records far beyond it.

2. Overbreadth. The subpoena seeks [all records ever created], without limitation as to time, provider, or subject matter.

3. Substance use disorder records. ⛔ Portions of the requested records are governed by 42 CFR Part 2, which requires a court order containing specific findings. A subpoena is insufficient, and the provider may not produce them on satisfactory assurances.

4. Psychotherapy notes. Portions constitute psychotherapy notes requiring separate, specific authorization, which I have not given.

5. Privilege. I assert the psychotherapist-patient privilege recognized in Jaffee v. Redmond.

6. Alternative relief. If any production is ordered, I request a qualified protective order limiting use to this litigation, prohibiting re-disclosure, and requiring return or destruction at its conclusion.

To the provider: please do not produce these records absent a court order or an order resolving this objection.

☐ ⚠ Understand waiver scope. Placing your own condition in issue waives protection as to that condition — not your entire history. Argue the scope, not the principle. ☐ Where testing served a law enforcement purpose, note Ferguson v. City of Charleston. ☐ For federal agency records, use 5 U.S.C. § 552a and 5 U.S.C. § 552; compare Whalen v. Roe.

Tool 9 — The breach and identity theft response

On receiving a breach notice — framework at 42 U.S.C. § 17931, rules at 45 CFR Part 164:

☐ Save the notice. Record what happened, when it occurred, when it was discovered, and what information was involved. ☐ Request the accounting of disclosures (Tool 6). ☐ Place a fraud alert or credit freeze if identifiers were involved. ☐ Request your complete record (Tool 1) and check it against Tool 3. ☐ ⭐ Look specifically for care you did not receive. Medical identity theft is the most damaging form, because false clinical information affects your later treatment, not just your credit. ☐ For every fraudulent entry, file an amendment request (Tool 4) and ask that all prior recipients be notified. ☐ Ask the provider to flag the record so the fraudulent history is not relied on clinically. ☐ Request an accounting again in six months, to see where the information went. ☐ ⚠ Remedies. No general private right of action under the federal rules; enforcement is administrative under 45 CFR Part 160, with criminal penalties at 42 U.S.C. § 1320d-6. ⭐ Private claims arise under state law — negligence, breach of confidentiality, state privacy statutes, consumer protection acts.

Tool 10 — The complaint and escalation ladder

  1. ☐ The privacy officer, named on the notice of privacy practices. ⭐ Most disputes end here.
  2. ☐ The practice manager or hospital patient advocate.
  3. ☐ The facility grievance process, in writing.
  4. ☐ The long-term care ombudsman, for facility residents — see 42 CFR Part 483.
  5. ☐ The federal enforcement office, for access and privacy violations.
  6. ☐ The state licensing board, for the provider.
  7. ☐ The state attorney general — health care or consumer division.
  8. ☐ The accrediting body.
  9. ☐ Counsel, for state-law claims.

Complaint template Covered entity: [name, address] · Privacy officer: [name] · Patient: [name] · Request date: [ ] · Method: [ ] What happened: On [date] I requested access to my designated record set. On [date] the entity [refused · provided only a portal summary · demanded $__ described as a retrieval fee · conditioned access on an unrelated balance · did not respond]. Why it violates the access right: [cite 45 CFR Part 164]. Attached: the request, proof of delivery, and all correspondence. Relief requested: production of the complete record in the requested format at a cost-based fee.

☐ ⭐ Access denials are the most commonly enforced violation in this field. A documented complaint frequently produces the record within weeks. ☐ Document any adverse change in care that follows a complaint — retaliation is prohibited.

Tool 11 — The decision-making package

⭐ The highest-value hour any family will spend.

☐ 1. Health care power of attorney. Names an agent and an alternate. The most important document here. ☐ 2. Advance directive / living will. States wishes about life-sustaining treatment, artificial nutrition and hydration, ventilation, dialysis, resuscitation, and comfort care. The reason to write it down is the clear-and-convincing-evidence framework upheld in Cruzan v. Director, Missouri Department of Health. ☐ 3. A records authorization naming the agent. ⚠ Separate from decision-making authority — without it the agent may be able to decide but not to read. ☐ 4. A portable medical order, for anyone with serious illness — a physician order that travels between home, hospital, and facility. ☐ 5. Organ donation documentation.

Then — the steps families skip: ☐ Distribute copies: the agent · the alternate · the primary care provider · the hospital you would use · one family member who is not the agent. ☐ Photograph them; keep the images on your phone. ☐ ⭐ Have the conversation. A document your agent has never discussed with you is one they will hesitate to follow. ☐ Re-execute after a move, a divorce, or a change in the agent's availability. ☐ Know your state's surrogate priority list, and whether it matches your actual relationships. ⚠ It frequently does not — which is the whole point of the proxy. ☐ ⭐ If a decision dispute arises, ask for an ethics consultation by name. Free at most hospitals, and almost never requested.

Tool 12 — The emergency and access rights card

Print this and keep it in a wallet.

☐ ⭐ Emergency care. A hospital with an emergency department must provide a medical screening examination and stabilizing treatment regardless of insurance or ability to pay — 42 U.S.C. § 1395dd. ⚠ Screening may not be delayed for an insurance inquiry. Related conditions of participation: 42 U.S.C. § 1395cc.

☐ Interpretation. "I am requesting a qualified interpreter in [language]." — 42 U.S.C. § 18116, 45 CFR Part 92. ⚠ A family member is not compliance.

☐ Auxiliary aids and accessible equipment. "I am requesting [an ASL interpreter / written materials in large print / an accessible examination table or scale]." — 29 U.S.C. § 794, 42 U.S.C. § 12182.

☐ Informed consent. "Before I sign: what is the procedure, what are the risks, what are the alternatives including doing nothing, and what happens if I decline?" ⭐ The conversation is the consent; the form is only evidence of it.

☐ Research. "Is this treatment or a study?" — 45 CFR Part 46, 21 CFR Part 50. Participation is voluntary and refusal carries no penalty in ordinary care.

☐ Records. "I am requesting my complete designated record set under 45 CFR Part 164."

☐ My agent is: [name, telephone]. My directive is on file at: [ ].

Tool 13 — The authority card

Question Authority
Definitions; administrative simplification 42 U.S.C. § 1320d
Criminal penalties for wrongful disclosure 42 U.S.C. § 1320d-6
Security; business associates; breach framework 42 U.S.C. § 17931
Electronic access; out-of-pocket restriction 42 U.S.C. § 17935
Enforcement and general provisions 45 CFR Part 160
⭐ Privacy, security, breach notification 45 CFR Part 164
⭐ Substance use disorder records 42 CFR Part 2
Long-term care resident rights 42 CFR Part 483
Emergency screening and stabilization 42 U.S.C. § 1395dd
Provider participation conditions 42 U.S.C. § 1395cc
Nondiscrimination in health programs 42 U.S.C. § 18116, 45 CFR Part 92
Disability access; auxiliary aids 29 U.S.C. § 794, 42 U.S.C. § 12182
Federal agency records 5 U.S.C. § 552a, 5 U.S.C. § 552
Research consent and oversight 45 CFR Part 46, 21 CFR Part 50
Refusal of treatment; advance directives Cruzan
Psychotherapist-patient privilege Jaffee v. Redmond
Medical testing for law enforcement Ferguson v. City of Charleston
Health data in government databases Whalen v. Roe
Assistance in dying; federal-state authority Glucksberg, Vacco v. Quill, Gonzales v. Oregon

Tool 14 — The four-step month

☐ Week 1 — Send Tool 1 to your primary care provider and every specialist seen more than twice. ☐ Weeks 2–3 — Read the record with Tool 3. Rank errors by consequence. ☐ Week 4 — Send Tool 4 for the most consequential error. Execute Tool 11. ☐ Ongoing — Request the record again every two to three years, and after any hospitalization, provider change, or breach notice.

⭐ That is the whole practice. It costs almost nothing, and it is the difference between a record that describes you and one that merely happened to you.

Related Documents

Articles

Guides

Checklists

Toolkits