How Law Firms Request Medical Records, Bills, and Imaging

A medical-record request begins by identifying who is requesting the information and under what authority. The patient’s individual right of access under 45 C.F.R. § 164.524, a personal representative acting within verified authority, a patient direction to transmit information, a law-firm request supported by authorization, and compulsory process are not interchangeable routes.

HHS’s current notice about the Ciox court order limits the HIPAA third-party directive to a copy of electronic health-record PHI in electronic format and states that § 164.524(c)(4)’s fee limitation applies when the individual requests access to the individual’s own records, not when the individual asks for transmission to a third party. Do not label every signed form a HIPAA request or promise that one route’s timing and fee rules govern another. Staff may assemble and track the lawyer-approved path; the responsible lawyer decides legal authority, representation status, scope, privilege, compulsory process, and the treatment of specially protected information.

One episode of care can create records held by a hospital, physician group, laboratory, pharmacy, therapist, ambulance service, radiology group, imaging library, billing office, insurer, or outside release-of-information vendor. The treating name on a bill is not always the entity that owns or maintains every requested artifact.

Florida law also separates chapter 395 licensed facilities from practitioner records governed by section 456.057. Section 456.057 expressly excludes chapter 395 facilities from that section. Identify the actual holder and the law or procedure applicable to that holder rather than applying one Florida rule to every medical source.

A request for medical records may not produce every item the legal team expects. HHS explains that an individual’s designated record set can include medical, billing, payment, claims, insurance, laboratory, and diagnostic-image information, but the covered entity provides the requested existing information; it does not have to create a new analysis that does not exist.

Separate the clinical chart, laboratory and pathology material, pharmacy information, itemized bills, account ledgers or transaction histories, insurance records, written imaging reports, and actual diagnostic image files. A balance is not an itemized bill; a bill is not an account ledger; and an imaging report is not the image set. Use an exact approved start and end date and identify the facility or office locations in scope.

For a chapter 395 licensed facility, section 395.3025 addresses a written request after discharge by the patient, guardian, curator, personal representative, or a person designated in writing—or, in the absence of one of those persons, the next of kin of a decedent or the parent of a minor. It calls for a timely copy without delay for legal review and includes records in the facility’s possession, X-rays, and insurance information. The statute permits sales tax and actual postage, up to $1 per paper page, up to $2 for nonpaper records, and up to $1 for each requested year. A patient whose records are copied or searched for the purpose of continuing to receive medical care is not required to pay a copying or search charge. The section separately excludes specified mental-health and substance-use records from this general route.

For a practitioner or records owner covered by section 456.057—which expressly does not govern chapter 395 facilities—the patient or legal representative may request timely copies without delay for legal review of reports and records relating to examination or treatment, including X-rays and insurance information. Production may not be conditioned on an unpaid treatment fee. Copy charges may not exceed actual copying cost including reasonable staff time or the amount in the applicable board or department rule. For psychiatric, chapter 490 psychological, or chapter 491 psychotherapeutic records, the practitioner may provide a treatment report instead of copies; complete psychiatric records go directly to a subsequent treating psychiatrist on the patient’s written request.

For a licensed facility’s billing record, section 395.301 directs an itemized statement or bill to the patient, survivor, or legal guardian after discharge within seven days after discharge or request, whichever is later. It directs patient billing-verification records to be available within 10 business days at the facility and electronically through a HIPAA-compliant method, without a charge merely to make them available; copies may carry the section 395.3025 fee. It also calls for a response to patient billing questions within seven business days. These holder- and requester-specific rights do not automatically belong to a law firm requesting records on its own behalf.

When the approved route uses an authorization, compare it with 45 C.F.R. § 164.508 and the holder’s current instructions. The federal rule requires a specific and meaningful description of the information, identification of who may disclose and receive it, a purpose, an expiration date or event, signature and date, and representative authority when someone signs for the individual, together with required notice statements. A holder may use its own workflow, but a preferred form does not authorize staff to change scope or obtain a new signature without direction.

HIPAA psychotherapy notes are a defined category excluded from the ordinary § 164.524 access right and generally require the separate authorization treatment in § 164.508. Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative proceeding is also excluded from the ordinary access right. Broader psychiatric, chapter 490 psychological, and chapter 491 psychotherapeutic records have distinct Florida treatment under section 456.057. Substance-use disorder records require a separate analysis under 42 C.F.R. Part 2 and section 397.501; this guide does not state that route’s consent, notice, redisclosure, or legal-process requirements.

Place those categories, as well as HIV or genetic information, minor or deceased-patient records, incapacity, disputed representatives, and other specially protected material, in a lawyer-review lane. Florida sections 395.3025 and 456.057 contain holder-specific exclusions and special treatment; a routine release is not a universal key.

Reopen the holder’s official instructions on the submission date. Determine the correct requester-specific portal, form, mail address, fax, secure email, department, vendor, identity-verification step, accepted format, fee process, and contact channel. Provider procedures change, and clinical, billing, and imaging requests may travel through different offices.

Review the exact outgoing packet and destination before release. Transmit protected information only through the firm-approved secure method, then preserve the exact request, authorization or authority record, attachments, destination, timestamp, confirmation, transmission result, and initial tracker entry. A sent message without usable proof is not a completed submission record.

A request is not complete when it is sent. Assign an owner and track the submitted date, provider acknowledgment, stated response period, fees, questions, rejection reason, follow-up dates, delivery method, link expiration, partial productions, and unresolved items. Use the controlling source for the selected pathway instead of automatically applying the HIPAA individual-access deadline or fee limitation to an attorney request made on the law firm’s behalf.

Do not pay an unexpected fee, modify authority, narrow or broaden scope, sign for the client, or switch to subpoena or court-order process without approval. Ask the holder precise operational questions, preserve the answer, and send legal decisions or disputes to the responsible lawyer.

Record who sent the production, when it arrived, the delivery channel, link or media expiration, filename, stated contents, password or viewer instructions, and the person who accessed it. Preserve the original archive, folder structure, filenames, cover correspondence, manifest, and delivery proof before creating any approved working copy.

Use only the firm’s approved systems for protected and confidential information. Rule 4-1.6 requires lawyers to safeguard information relating to representation, and Florida Bar Ethics Opinion 12-3 permits cloud computing only with reasonable confidentiality, security, service-provider, and access precautions. Do not upload a production or diagnostic images to an unapproved public converter, viewer, AI tool, or personal account.

Florida section 395.3025 limits a recipient other than the patient or patient representative to using treatment-record information for the stated purpose and bars further disclosure without express written consent; a general medical release is not enough for that further use or disclosure. Section 456.057 also restricts a third party from redisclosing records without express written consent. Treat authorized receipt, internal access, use, and later disclosure as separate controls.

Compare each received component with the request manifest holder by holder and artifact by artifact. Check patient, provider, location, date range, encounters, accounts, report and image pairs, page ranges, duplicate sets, stated through-dates, and missing or unreadable material. Corroborating bills, explanations of benefits, referrals, and later records can identify a possible gap but do not prove what a holder maintains.

Describe deficiencies neutrally and follow up on the exact missing holder, category, date range, encounter, account, study, file, or transaction period. Staff does not diagnose, interpret medical findings, decide causation, assess reasonableness, determine lien validity, change a source record, or declare legal completeness.

Closure requires more than saving files. The matter should contain the approved request plan, authority record, exact submissions, tracker history, fees, preserved productions, working set, inventory, deficiency log, follow-up proof, and the responsible lawyer’s acceptance of any named exception.

If authorization does not produce the required records, the responsible lawyer decides whether a subpoena, court order, motion, protective process, or another legal route is appropriate. Staff should not convert a stalled request into compulsory process or calculate notice and objection periods independently. Reopen the tracker when later treatment, billing activity, a new provider, or a corrected production changes the approved scope.