AI for Medical Records Requests in a Small Practice

Monday morning, the records inbox holds eleven requests. A patient wants her full chart sent to a new specialist. A law firm has faxed an authorization for a car-accident client. A life insurer wants two years of visit notes. A subpoena arrived by certified mail. Someone also asked for "all my x-rays, on a disc."

Each one follows different rules, has a different deadline, and carries a different fee. In a small practice, one person usually sorts all of it between phone calls. This guide covers how medical records request processing works from the receiving side, where errors happen, and which parts AI can safely take over.

Why records requests are harder than they look

A records request is not one task. It is a chain: receive the request, work out who is asking, check the paperwork, find the right records, remove what must not go, send it securely, and log the disclosure.

Larger health systems run this through a health information management (HIM) department. In a small practice, the same work falls to the front desk or an office manager. Each link has its own HIPAA rule. Mistakes go both ways. Releasing too much is a privacy breach. Releasing too slowly, or overcharging a patient, is a Right of Access violation, which the Office for Civil Rights (OCR) has enforced in dozens of cases.

Five kinds of requests, five sets of rules

1. The patient asking for their own records

This is the HIPAA Right of Access. You have 30 calendar days to act, with one 30-day extension if you tell the patient in writing within the first window. Some state laws set shorter deadlines, and the shorter one wins.

Fees are limited to a reasonable, cost-based amount. For electronic copies you may charge a flat $6.50 instead of calculating costs. Our Right of Access guide covers the clock, the fees and what you may withhold.

2. The patient directing records to someone else

A patient can direct you to send an electronic copy of their EHR records to a third party, such as a new provider or an app. The patient's signed, written request is enough. You do not need a full HIPAA authorization.

Since the 2020 court decision in Ciox Health v. Azar, the patient-rate fee limits no longer apply to these third-party directives. The obligation to send the electronic EHR copy remains.

3. Law firms and insurers with an authorization

Many law firms outsource medical record retrieval to retrieval services that request records on their behalf. The rules do not change: the request still needs a valid authorization or legal process.

Requests from law firms, life insurers and employers need a valid HIPAA authorization signed by the patient. Under 45 CFR 164.508, a valid authorization includes these core elements:

• A specific description of the information to be disclosed
• Who may disclose it, and who will receive it
• The purpose, or "at the request of the individual"
• An expiration date or event
• The patient's signature and the date
• Statements about the right to revoke and the risk of redisclosure

An authorization missing any of these is invalid, so do not release health information on it. That is the single most common reason a request should be sent back rather than filled. These disclosures follow state law on fees, not the Right of Access fee limits.

4. Subpoenas and court orders

A court order signed by a judge can be followed as written. A subpoena from an attorney alone is different. Under 45 CFR 164.512(e), you need written assurance that the patient was notified or that a qualified protective order is in place.

Subpoenas in litigation often come with short deadlines. Disclosures made this way also go into the accounting of disclosures, which patients can request. Releases made under a patient's own authorization do not.

5. Records with extra protection

Psychotherapy notes are excluded from the Right of Access and need their own specific authorization. Substance use disorder records covered by 42 CFR Part 2 need Part 2 consent. Our Part 2 guide explains how those rules differ from HIPAA.

Several states add protections for HIV status, genetic tests, mental health and reproductive health records. Your release workflow needs to flag these before anything leaves the building.

Where the errors happen

Most records request mistakes fall into a short list:

• Missed deadlines. The request sat in a fax tray, and the 30-day clock started on the day it arrived, not the day someone opened it.
• Invalid authorizations accepted. No expiration date, no signature date, or a recipient that does not match who is asking.
• Wrong patient. Two patients with the same name, and the records went to the wrong attorney.
• Too much released. The full chart went out when the authorization covered one date range.
• Protected records released. Psychotherapy or Part 2 records included without the right consent.
• Wrong fee. A per-page rate charged to a patient for an electronic copy.

Almost every item on that list is a sorting, checking or tracking failure. That is the kind of work AI handles well, as long as a person makes the final release decision.

What AI can do in the records workflow

The pattern is the same one we describe in our AI image and document processing guide: AI reads and sorts, people decide. Applied to records requests, it looks like this.

Intake and classification

Requests arrive by fax, mail, email and the patient portal. AI can read each one and classify it: patient request, patient-directed transfer, authorization-based request, subpoena or court order. It records the date received and starts the right deadline clock.

If most of your requests arrive by fax, the same intake step from our fax referral processing guide can feed this queue.

Authorization checks

AI can check an authorization against the required elements and flag what is missing. Expired, unsigned or undated forms go to a "send back" queue with a draft letter explaining what is needed.

It can also compare the date range and record types requested against what the authorization actually allows. That catches the "full chart" mistake before it happens.

Patient matching

AI can extract the name, date of birth and other identifiers, then suggest a match in your EHR. It should flag weak matches for a person to confirm, never pick one on its own.

Assembling the record set

Once a request is approved, software can pull the matching documents for the date range, including imaging reports and x-ray files where requested. It can flag documents marked as psychotherapy notes, Part 2 records or state-protected categories for review.

Tracking and logging

A dashboard showing every open request and its due date ends the "lost in the fax tray" problem. The system can log each disclosure automatically, which makes the accounting of disclosures a report instead of a research project.

What should stay with a person

• The final decision to release anything
• Any request involving psychotherapy notes, Part 2 records or state-protected information
• Subpoena responses, and anything a lawyer should look at
• Patient matches the system scored as uncertain
• Decisions to deny or delay a patient's access request

That split keeps the time savings while leaving accountability where HIPAA puts it, with your practice. Writing it down in an AI policy makes it stick when staff change.

Keeping the AI side HIPAA-compliant

Records requests are full of PHI, so the tooling has to meet the same standard as your EHR. Use only services covered by a Business Associate Agreement. Amazon Textract, for example, has been HIPAA eligible since October 2019 when used under an AWS BAA.

Keep processing inside your own cloud account where you can, log every access, and set retention rules for the request files themselves. Our guide on whether AI is HIPAA compliant covers the vendor questions to ask.

Release-of-information vendor or in-house tool?

Larger health systems often outsource records requests to release-of-information (ROI) vendors. For a small practice, the volume rarely justifies that, and the vendor still needs your staff to answer questions.

A lightweight in-house tool that classifies, checks and tracks requests can be enough. It sits beside your EHR and fax line, and your staff stay in control of every release.

Start with the tracker

If you change one thing, make it the log. Record every request on the day it arrives, with its type and due date. That alone closes the most common gap OCR finds.

Then add classification and authorization checks, which is where AI saves the most time. If you want help scoping a records tool around your EHR, our custom healthcare software practice builds this kind of workflow for small practices.