Is Mailing Medical Records HIPAA Compliant? What Healthcare Providers Need to Know

Mailing medical records to a patient can be HIPAA compliant when the disclosure is permitted and the provider uses reasonable safeguards to protect protected health information (PHI) during handling and transit. HHS specifically recognizes mail as a way patients can receive copies of their PHI under the HIPAA right of access.

For release of information teams, the operational question is how to make sure the correct records reach the correct recipient without exposing PHI along the way.

What Safeguards Should Providers Use When Mailing Medical Records?

HIPAA does not prescribe one mailing procedure for every organization or request. Under 45 CFR § 164.530(c), covered entities must use appropriate administrative, technical, and physical safeguards to protect PHI.

A practical mailing workflow should cover six points:

1. Confirm the basis for the release. Make sure the organization has the appropriate request, direction, authorization, or other basis for disclosing the records.
2. Verify the recipient and address. Compare the destination with the request before the records leave the organization, especially when an address differs from information already on file.
3. Match the records to the request. Before sealing the package, confirm that the correct patient’s records match the scope of the request.
4. Protect PHI from external visibility. Keep diagnoses, treatment details, and other unnecessary PHI from appearing through an envelope window or on exterior labeling.
5. Use appropriate packaging. Choose packaging that reasonably protects the contents during normal handling and delivery.
6. Document the release. Follow the organization’s release documentation process so staff can identify what was sent, when, and where.

These controls should be built into the release process rather than depend on staff improvising each paper request.

Can an Envelope Expose PHI?

Yes. In a 2017 incident, HHS reported that Aetna mailed benefit notices in window envelopes that exposed PHI for 11,887 individuals. The mailing was one of three breaches later covered by Aetna’s $1 million OCR settlement and corrective action plan.

A mailing can reach the right address and still expose PHI before the recipient opens it.

Does HIPAA Require Certified or Tracked Mail?

No. HIPAA does not impose a blanket requirement to use Certified Mail, signature confirmation, or another specific postal product when mailing medical records. HIPAA’s safeguard rule requires appropriate safeguards rather than a specific mailing service.

For treatment disclosures, HHS gives the example of a physician mailing a patient’s medical record to a treating specialist. The provider must use reasonable safeguards when doing so.

An organization may still choose tracking or signature confirmation for certain releases. Internal policy, the circumstances of the request, contractual requirements, or other applicable law may affect that decision.

What If a Patient Requests Their Medical Records by Mail?

A patient exercising the HIPAA right of access generally may ask to receive copies of PHI by mail. HHS states that covered entities generally must provide copies by mail when the patient requests it and the PHI is readily producible that way.

A provider cannot require the patient to travel to the office to pick up the records simply because the organization prefers in-person delivery.

The provider must take reasonable steps to verify the identity of the person requesting access, but it has flexibility in how it does so. HHS right of access guidance makes clear that verification procedures should not create unreasonable barriers or delays.

Staff also should not treat a HIPAA authorization as a universal requirement. A patient exercising the HIPAA right of access under § 164.524 follows a different disclosure pathway from an authorization under § 164.508. HHS specifically distinguishes those two pathways.

Our HIPAA right of access violation examples show how access workflows can create compliance problems beyond the mailing step itself.

When a provider mails copies for a right of access request, 45 CFR § 164.524 permits postage to be included in the limited reasonable, cost-based fee when applicable.

What Happens If Medical Records Are Mailed to the Wrong Address?

A misdirected package containing PHI requires prompt attention. It can create an impermissible disclosure, but not every mailing error automatically becomes a reportable HIPAA breach.

Once the organization discovers the mistake:

1. Try to contain or recover the records when possible.
2. Determine what PHI the package contained.
3. Identify who received or may have accessed it.
4. Document the incident and determine how the organization will apply the Breach Notification Rule.
5. Make any notifications required based on that determination.

An impermissible disclosure is generally presumed to be a breach unless an exception applies. An organization can rebut that presumption through the four-factor HIPAA breach risk assessment described by HHS. This considers the PHI involved, the unauthorized recipient, whether someone actually acquired or viewed the information, and the extent of mitigation. An organization may instead treat the incident as a breach and proceed with notification without first completing that assessment.

How Can ChartRequest Reduce the Need for Mailing Medical Records?

Physical mail can be compliant and still create avoidable work.

A paper release may require printing, assembly, address verification, packaging, postage, physical handoff, and returned-mail handling. When electronic delivery is appropriate, staff can avoid much of that physical handling. Emailing medical records has its own HIPAA safeguards, but the workflow no longer depends on printing, packaging, postage, or returned mail.

A digital release of information workflow can also give staff a clearer record of request status and fulfillment activity without relying on a separate paper-mail process.

If a patient exercises the right of access and requests mail, the organization generally must accommodate that request when the records are readily producible that way.

HIPAA compliance answers whether an organization can use mail. Workflow design determines whether mail is necessary for that request.

In a 2018 JAMA Network Open study, 47 of the 71 hospitals that reported mean release times for paper medical records estimated 7 to 20 days. For records sent by eligible First-Class Mail, USPS currently estimates another 1 to 5 business days in transit. 

When providers outsource release of information fulfillment to ChartRequest, our experts can fulfill requests electronically with a 5-day average turnaround guarantee.

If your team still prints, packages, and mails records that could move through a digital release workflow, we can help take those manual steps out of the process. Schedule a ChartRequest workflow review.

Frequently Asked Questions