If you’ve never had to fulfill a patient request for a copy of their medical records, chances are you may not know much about the process. In theory, it’s meant to be relatively straightforward. HIPAA entitles all patients to a copy of their records, and the format for obtaining this information is standardized across all states. Patients simply contact your facility, show you a valid government-issued ID, fill out your version of the record request form, specify exactly which information they need (if necessary), and wait. Yes, they’ll have to fill out a bit of paperwork (particularly if they’re requesting especially sensitive information such as psychiatric or STD records), and yes, they’ll have to wait however long your hospital or clinic deems necessary to prepare their info, but it should still be easy, right?

Unfortunately, these things are rarely as simple as they appear. Many individual practices have specific rules that only apply to them, such a refusing to send records electronically (even if the patient has authorized electronic transfer) and only being open during standard 9-5 business hours, making it difficult for people to find time to collect their information in person. According to AHIMA, those who are experts in HIPAA rules and regulations are not immune to getting blindsided by unexpected difficulties. Even Adam Greene, a lawyer who helped write the original HIPAA legislation back in 1996, reported that he was perplexed when a practice refused to release his records through any medium other than their patient portal. In his own words, “Now, that’s wrong.”

So, what can clinical staff do to ensure that this process works as fluidly as possible? The biggest fix would be to make sure they know and understand the official patient rights as outlined by HIPAA. While individual facilities may have additional rules, they cannot contradict anything in the national legislation. In Greene’s case, the hospital incorrectly told him that HIPAA forbid them from releasing the information in any other format, a mistake that could have been easily fixed with better training over patient requests. From there, practices should make an effort to allow patients to request records it multiple ways. Because not everyone is able to collect physical records in person, practices should make records available via secure email or websites, provided the patient signs off on this format.