The Lawyer’s Guide to Medical Records

Medical records exchange can be a complicated, burdensome process, even for healthcare professionals. This goes doubly so for people who are not used to how the healthcare system works. Legal professionals seeking to retrieve medical records for a case must adhere to HIPAA regulations just like healthcare providers. But where do you start?

What are electronic health records?

Electronic health records (EHR) are digital versions of medical records designed for easy exchange between healthcare facilities. These differ from electronic medical records (EMR) in that EMRs are designed for use specifically within the healthcare facility that created them. 

Unfortunately, electronic health records are usually incompatible with other systems. Patient information gets caught in large data silos that require alternative avenues of release to most requestors. Very few people are authorized to access EHR databases, so requesting medical records via patient authorization is the easiest way to retrieve important documents for law firms. 

The Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act outline the regulations covered entities and business associates must follow when handling medical records. HHS holds lawyers and doctors to the same standards regarding protected health information.

As business associates, law firm professionals requesting and handling medical records must take the time to study HIPAA rules. The penalties for failing to adhere to these regulations are steep and based on a tiered structure. Fines and other penalties following a breach are significantly higher based on their culpability. 

Click here for more information about electronic health records.

Back to the Table of Contents.

How are medical records used in court?

When the only way to access important evidence for a legal case is by reviewing a patient’s medical records, they will hopefully provide a signed authorization for the release of information. If the patient objects to the release of their medical records for whatever reason, you’ll need to submit a subpoena. If the patient or healthcare provider objects to the subpoena, a court order is a final option. 

“Minimum Necessary Standard” outlined in HIPAA limits what healthcare providers can include when assembling the records to fulfill a request. To remain compliant, healthcare providers will only release the records directly requested. This standard holds true in court, wherein only the minimum necessary information to extract the evidence can be used. 

From sending out a release of information request to using the records in court, patient privacy must be prioritized by all HIPAA-covered entities and business associates. The patient also retains the power to influence the final decision, and a strong reason for not releasing the medical records may dissuade a judge from pursuing a court order in the case of a failed subpoena. 

Surprises are unwelcome in court, so the big television moments where somebody bursts into the room with case-breaking evidence are not realistic. During the process of discovery, the legal representatives on both sides must share the evidence they’ll be using during the case. Additionally, healthcare facilities require proof of patient notification before fulfilling subpoenas. This provides ample time for the patient or healthcare provider to submit an objection. 

Back to the Table of Contents.

Medical records subpoenas

If a patient does not wish to authorize the release of information, legal professionals can try submitting a subpoena. To create a subpoena for medical records, you must express why you believe that the information within those records holds significant evidence that cannot be obtained in other ways. 

To create a subpoena for medical records, you must fill out the subpoena form. Include a declaration explaining why the records are integral to the case and whether you need the person receiving the subpoena to testify. After you submit your subpoena to the court clerk, you can deliver it to the healthcare provider. 

Use a “records only” type of subpoena if you only need medical records, or an ”appearance and records” type if you need the healthcare professional to testify in court as well. While the healthcare provider or patient can object to subpoena requests, they must have a valid reason for the records to not be released.

In the case that a patient and/or healthcare professional successfully object to a subpoena, you can appeal to the judge for a court order. In this context, a court order is basically a subpoena with additional authority because it includes a signature from a judge, administrative tribunal, or magistrate. 

Healthcare providers can object to court orders, but these objections are significantly less likely to succeed. Before submitting a court order, the judge will have reviewed the provider’s reasons for objecting. Unless they have further reasons to object, healthcare providers will be forced to release the records. 

Click here for more information on medical record subpoenas.

Back to the Table of Contents.

If you need medical records for court, ask if the patient is willing to sign a HIPAA-compliant authorization form. Whether you submit your request through ChartRequest or alternative methods, this form is necessary for healthcare providers to be legally protected when releasing records. 

With ChartRequest, you can send clients digital authorization forms to electronically sign via text or email. (Since the E-Sign Act was made law in 2000, electronic signatures legally fulfill physical signature requirements when requesting medical records). Then, our streamlined workflow guides you through the request process from start to finish. This allows you to complete a request in just minutes. 

Without ChartRequest, you need to acquire the signed authorization form as early as possible in the process. This form must inform the patient of their rights and contain the correct fields for them to provide the required information.

Next, reach out to the healthcare provider to determine their preferred method of receiving the incoming release of information requests. Verify the fax number or email address to be certain that the request is not sent to the wrong person.

Double-check the release form, then, check again. Once the release is complete, send it to the healthcare provider. If fax is their preferred method of receiving incoming requests, there are many alternatives to traditional fax machines to send the request. Once verified, submit the request and call to verify that it has been received. Then, call regularly to check for status updates until it has been received.

Click here for our comprehensive guide to requesting medical records.

Back to the Table of Contents.

Making your request go smoothly


When submitting a release of information request, it’s important to remember that there’s another person on the other end working hard to get medical records for you. Some tips to help make the process run more smoothly for all involved parties include:

  • Be as concise as possible without sacrificing important details or questions. Whether you’re communicating with a healthcare provider or a client, you should avoid keeping them on the line longer than necessary. 
  • Do not lose your temper. No matter the situation, yelling at the people designated to retrieve your medical records will do more harm than good. There’s a chance you’ll be working with them again, make sure they look forward to it.
  • Only submit valid requests. Healthcare providers will reject release of information forms and subpoenas if you do not meet all the requirements. Errors in these forms waste both your time and theirs. Also, the delays could interfere with your plan to submit the records for evidence. 

Knowing what you should expect within each stage of the medical records request process will help you keep each communication brief and friendly. If you appear confident and experienced, healthcare providers will look forward to hearing from you. 

Click here for tips to help ensure a positive experience throughout each stage.

Back to the Table of Contents.

How long are medical records kept?

Healthcare providers must keep medical records on file as long as state and federal regulations dictate. Additionally, this number varies based on the type of medical records and whether the patient is alive or not. 

In addition to these legal regulations, some healthcare providers have their own guidelines that extend medical record retention beyond the required timeframe. The base federal requirement for the retention of most medical records is six years. However, it’s not uncommon for healthcare providers to keep medical records at a minimum of 10 years.

To see if old medical records still exist, reach out to the healthcare facility that created them. In addition to explaining their retention policy, they can verify whether the records are on file or have been archived or destroyed. Healthcare providers can retrieve archived records, but it usually takes longer.

If you wish to find out your chances of retrieving your records before you reach out, check out your state’s medical records retention regulations and compare them to the HIPAA retention regulations. If your records are older than the highest number of years between the two guidelines, they may have been destroyed.

Click here to learn more about medical record retention and destruction.

Back to the Table of Contents.

How to correct medical records

Medical error is at best an inconvenience and at worst a severe danger for patients. If your client points out an error in their medical records before a court deadline, you can help them fix it. First, notify the court of the issue and request an extension if it seems unlikely to be resolved in time. 

Then, whoever submitted the request should submit a medical records correction request containing:

  • Patient’s full name, contact information, and address
  • Location of the error in the medical records
  • Exact wording of the error
  • Wording of suggested correction

With ChartRequest, you can use the provider chat function to submit your correction request. If not, create a document with the aforementioned information on your letterhead to ensure it is processed promptly. 

If your request is urgent, it’s important that you make sure it‘s a high priority for the healthcare provider as well. Don’t hesitate to reach out for status updates if they do not get back to you promptly.

Click here for more information about correcting medical records.

Back to the Table of Contents.