By Stodzy Team
Find the office that holds your records
Before you request treatment records, check whether the program handles copies itself or has an outside company do it. A HIPAA-covered provider can tell you, in its notice of privacy practices or another way, to send access requests straight to a business associate that processes them. HHS guidance on timely access says that when this happens, the 30-day clock starts on the date the business associate receives your request.
You can call the program’s main number and ask who processes patients’ requests for copies of their own records. Write down that person’s name, the office’s mailing address, and any fax number or email address it accepts for requests. Detox Local also has a Find a Detox Near Me directory for finding detox centers.
The HHS Your Medical Records page explains that, with few exceptions, the HIPAA Privacy Rule lets you inspect, review, and receive a copy of the medical and billing records held by health plans and health care providers covered by the rule. The access rights described on this page apply to those covered plans and providers. Ask the records office whether it processes requests under HIPAA. Under 45 CFR 164.524, a covered program must let you request access, and it can require requests in writing as long as it tells you about that requirement. To learn how to request medical records from a covered program, ask the office which form or submission method it accepts.
If the program is a Part 2 program
Part 2 is a separate federal rule for substance use disorder records. The HHS Part 2 overview says it applies to federally assisted programs that provide SUD diagnosis, treatment, or referral for treatment. For those programs, 42 CFR 2.23 says the rule doesn’t prohibit giving you access to your own records, including the chance to inspect and copy them. The program also doesn’t need your written consent under Part 2 to give you that access.
Section 2.23 is written as a permission. The 30-day timing on this page comes from HIPAA, so it applies where the program is a HIPAA-covered entity. Ask the records office which rules it’s applying to your request.
Questions to ask the records office
You might use some of these on your first call or in an email. Leave out the ones that don’t apply to you.
- Does the request have to be in writing? If so, do you have a form?
- How do you verify a patient’s identity before releasing copies? What proof of identity should I include with a mailed request?
- Does this office handle records for all the sites where I was treated, or does any location keep its own?
- Are my records kept electronically, and which formats can you produce?
- Is there a fee for a copy sent to me? How is it calculated? Can you put the estimate in writing before you begin?
- How will you let me know the date you’ve logged as receiving my request?
- If I haven’t heard anything, who should I follow up with?
Choose the records to request
In the request, list the program name, each site where you received care, and the dates you were at each one. If you stepped down from detox to another level of care at the same organization, list each level separately with its own dates. That way the office is less likely to miss one.
Then ask what record types the office keeps for you and name the ones you want. HIPAA’s right of access reaches information kept in a designated record set, for as long as it’s kept there. Depending on what the program kept, your list might include:
- medication prescription and monitoring records, such as what you were given during your stay and when
- lab and other clinical test results
- summaries of your diagnosis and treatment plan
- progress summaries, plus any counseling notes that are part of your medical record
- billing records, which HHS lists alongside medical records
The right of access under the regulation doesn’t extend to information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative proceeding. HHS also says you have no right to a provider’s psychotherapy notes. Under the Privacy Rule definition, those are a mental health professional’s notes documenting or analyzing the contents of a conversation during a private, group, joint, or family counseling session, kept separate from the rest of your medical record. According to the HHS FAQ on mental health information, the term doesn’t cover medication prescription and monitoring, session start and stop times, the types and frequency of treatment, or clinical test results. It also excludes summaries of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date, along with any information kept in your medical record. Under that definition, counseling notes kept in your medical record aren’t psychotherapy notes. Other exceptions can still apply.
Asking for a format, delivery method, and fee estimate
Tell the office how you want the copy and give your own mailing address or email for delivery. From a covered program, a copy of treatment records has to come in the form and format you ask for if it’s readily producible that way. If it isn’t, the office has to give you a readable paper copy or another format you both agree on. For records kept electronically, a request for an electronic copy has to be met in the electronic form and format you asked for if it’s readily producible. Otherwise, the office has to provide a readable electronic form and format that you and the office agree on (45 CFR 164.524).
Under the same regulation, the office may charge a reasonable, cost-based fee that includes only the cost of:
- labor for copying, on paper or electronically
- supplies for a paper copy, or portable media if you asked for your electronic copy on one
- postage, if you asked to have it mailed
- preparing a summary or explanation, if you agreed to one
A provider also can’t charge you for searching for or retrieving your records, according to HHS. Because the fee depends on those costs, ask for an estimate before the office starts copying. Record the estimate and the name of the staff member who gave it. The fee rules above are for copies you request for yourself.
How long the office has to act
When you request treatment records from a HIPAA-covered program, HHS says the program must act on your request no later than 30 calendar days after receiving it. Acting means providing the access or sending you a written denial. The office can take one extension of up to 30 more calendar days. But it has to give you a written statement within the first 30 days that explains the delay and gives the date it’ll finish.
HHS calls these outer limits and expects many offices to respond well before them. When you send your request, you can ask the office what completion date to expect. Any time the office spends negotiating the format with you comes out of the 30 days.
Keep a dated request log
The log can be on paper or in a notes app on your phone. The rows below are suggestions. Add or drop entries as your request requires.
| What to write down | Why it helps |
|---|---|
| The date you sent the request and how you sent it | The 30-day period runs from the date the office receives it |
| Who received it, and any confirmation number or receipt | Gives you a name and reference number if you need to follow up |
| The program, sites, dates, and record types in your request | Lets you check the records against your request |
| The format and delivery address you requested | Shows whether the copy came in the format you asked for |
| The fee estimate, who gave it, and the date | You can compare the final charge with the estimate |
| Any written extension notice, with the stated reasons and completion date | Keeps the new completion date on record |
| The date the records arrived and anything that was missing | Tells you what to raise if you follow up |
When the records arrive
Once the records arrive, check them against your log to see whether each site, date range, and record type you asked for is included. Call the records office about anything that’s missing. You can ask whether those records are still being processed, are kept at another location, or are being withheld. If the office denied any part of your request, it has to send a written denial, so ask for one if you haven’t received it.
If your request is denied in whole or in part
Read the letter for the reason it gives. Some denial grounds in 45 CFR 164.524 don’t come with a right to review. Among them are the psychotherapy-note and legal-proceeding exceptions described earlier. Another covers information obtained from someone other than a health care provider under a promise of confidentiality, when access would be reasonably likely to reveal who that source is. Other grounds can be reviewed. One is a licensed health care professional’s judgment that access is reasonably likely to endanger your life or physical safety, or someone else’s. For that kind of denial, you can have it reviewed by a licensed health care professional the program designates who didn’t take part in the original decision.
Where the letter describes review or complaint steps, you can follow those instructions. If any part of the letter is unclear, ask the records office to explain it.
More from Detox Local
The Detox Local Resources page is another place to start. If you’re also thinking about where to go next for care, see 6 Suggestions For Finding The Right Addiction Treatment.
Frequently asked questions
Can a program refuse to give me a copy because I still owe money?
Not under HIPAA, if the program is a covered provider. HHS states that a provider can’t deny you a copy of your records because you haven’t paid for the services you received. The provider may still charge the reasonable costs of copying and mailing the records.
Can I receive my records in parts if the request is taking longer?
You can ask for that. HHS encourages a covered entity that knows a request may take close to the outer time limits to provide the information in pieces as it becomes available, if you tell it you’d like to receive it that way.
Does the deadline change for old or archived records?
No. HHS guidance says the 30-day timeline and the single possible 30-day extension apply even when records are old, archived, or otherwise not readily accessible.
What if I think my records contain an error?
You can request a change, or amendment, to the record. According to HHS, the provider has to respond to your request, and it must amend inaccurate or incomplete information that it created. If it doesn’t agree to the change, you can submit a statement of disagreement, which the provider must add to your record.