There are times in dealing with a health insurer that you may need to get your medical records. Most often this is in conjunction with an appeal. The laws vary by state, but you do have the right to obtain your records and the state designates the allowable charge per page. Whether they are paper copies or electronic health records, doctors' notes, medical test results, lab reports and billing information will be supplied if requested properly. The federal law that addresses this is called HIPAA, the Health Information Portability Accountability Act. These rules mostly address privacy issues, but are so extensive that many healthcare providers are still confused about how HIPAA applies to them. This confusion sometimes makes it difficult to get the records, even when entitled to them. Here are the basics:
Who? You must be the patient, or the parent or guardian of the patient for whom you seek records. Caregivers may be able to access records if the patient has provided written permission to the provider. Providers are required to keep most adult medical records for six years or more, although this varies by the state where the records are stored. In most states, children's records must be kept for three to 10 years beyond age 18 or 21. If you seek older records, contact the provider to see if they are available.
Providers are required to share any notes or records they have created themselves, or any test results for which they have copies. They are also required to share any information provided to them about you by another doctor if that information was used for the diagnosis and/ortreatment being discussed with you.
What? Diagnostic lab test records for such tests as blood tests, CT scans, x-rays, mammograms or others, should be requested from the doctor who ordered them, or your primary care physician. In most states, the lab will not provide them to you directly. If you seek hospital records or records from any other medical facility, you'll want to request them directly from that facility.
A note about privacy: Many patients believe they or their designees are the only people who can obtain copies of their records. In fact, there are many others who can gain access to your medical records without your permission.
How? Most practices and facilities ask you to fill out a form to request your records. Call the provider's office and request a copy of the form. They should be able to deliver it to you by fax, e-mail, or postal mail, or you may pick it up from the doctor's office. If the doctor's office doesn't have a specific form, you may write a letter to make your request. Include this information:
your name, including your maiden name (if applicable)Social Security numberdate of birthaddress and phone numbere-mail addressrecord(s) being requesteddate(s) of service (months and years under the doctor's care)signaturedelivery option (pick up, fax, e-mail, etc.)
Simply drop off or mail the letter to the provider's office. Be aware that you may have to pay for the medical records copies you want.
When? Once you have made the request, you may have to wait for awhile before you get the records. State laws regulate how quickly those records must be supplied to a patient. In some states, you'll be given access to review them in the doctor's office immediately but may have to wait from 10 to 60 days to obtain your own copies. Other states require access within 30 days. Many others provide access to the medical records regulations of healthcare providers must adherent to timeframes in all 50 states. Those time frames may sometimes be extended if circumstances warrant.
Once you've obtained copies of your records, be sure to review them carefully. If you find errors, you'll want to correct them immediately to be sure they cannot affect any future diagnoses or treatment you may receive. There is a protocol and complaint system to follow if you are denied access or copies of your medical records.
Where? Simply making a phone call may not be enough. There are certain steps you may need to take, including letter-writing and signatures. Included in the protocol is payment for the records. You may be required to pay for your medical records before they are provided. The amount you can be charged will vary by state. If you can't afford them, each state also provides a procedure for reducing the cost.
Be sure you have made the request from a "covered entity." If you make your request from a non-covered entity then your request will not fall under HIPAA laws and requirements. Find one of the covered entities that has your records and make the request there.
Be sure you have waited the entire length of time the organization has, by law, to delay fulfilling your request. By federal law, the maximum amount of time they can delay is 60 days. Some states provide for less time than that. Check with your state's laws to learn what your wait time will have to be.
Be sure you have followed all these steps:
- Being sure you have a right to those records
- Following the right protocol to getting your medical records
- Double checking that you have made the request of a covered entity
- You have waited long enough...
Once you are sure you have them completed, if you are still being denied access to your health records, you can make a complaint to the US Department of Health and Human Services. Follow their complaint process against the covered entity that is denying you access. This complaint must be filed within 180 days of the denials. Also, the law prohibits retaliation on the part of the covered entity.
Why? Just because the law says you have a right to get copies of your medical records doesn't mean all covered entities are willing to supply them. Your doctor or your insurer may deny you access for reasons that make no sense to you, but for some reason are important to them. In most cases, it's illegal for them to deny you access, according to HIPAA laws.
However, you may be denied access to some records, usually related to mental health records. If a provider believes that letting you look at your medical records can endanger your physical health, your request may be refused. They cannot deny you access just because they think you will be upset, unless they believe that upset will lead to an attempt to physically harm yourself. If you are refused, the provider must make that clear, in writing.
But these medical records laws do have teeth. They were tested by Cignet Health, a Maryland health center, when it denied records to 41 patients in 2008 and 2009. In 2011, $4.3 million worth of fines were levied against Cignet for violating the law. That action came as a result of complaints made by patients through the complaint process described above.