Scope
List exact record types requested (e.g., encounter notes, billing records, EHR audit logs, consent forms) so custodians can target production and reduce over-disclosure risk.
A well-constructed request reduces production delays, supports legal and regulatory compliance, and creates an evidentiary record for disputes. Proper scope and authorization help limit disclosure of unnecessary PHI and demonstrate adherence to ESIGN/UETA and HIPAA expectations.
Typical requesters and responders vary across payer, provider, and legal teams depending on the audit purpose.
Proper role clarity speeds processing and reduces re-requests for missing or improperly authorized records.
List exact record types requested (e.g., encounter notes, billing records, EHR audit logs, consent forms) so custodians can target production and reduce over-disclosure risk.
Specify start and end dates using MM/DD/YYYY format; tie ranges to the claim or episode under review to avoid ambiguous production that delays compliance.
Identify the legal basis or authorization type (patient authorization, subpoena, payer audit clause) and include a copy or reference to the signed release when PHI is required.
Provide full legal name, organization, contact information, and role to enable validation and efficient follow-up with the records custodian.
State preferred secure transfer method (encrypted email, secure portal, SFTP, CD) and file formats (PDF, DOCX) to ensure interoperability and maintain chain of custody.
Reference HIPAA safeguards and any required BAA; include instructions for redaction or minimum necessary disclosures where appropriate.
| Field | Configuration |
|---|---|
| Authentication | SMS code or email link |
| Document Format | PDF/A preferred |
| Audit Trail | Enabled, downloadable log |
| Retention | Automatic 6-year retention |
Ensure the e-signature and file-transfer platform supports HIPAA safeguards, audit logging, and common integration points for EHR and document storage.
Usually 5–10 business days to confirm receipt
Commonly 10–30 business days depending on scope
Custodian should request extensions in writing
Expedited turnaround negotiated with custodian
Preserve records on issuance of request