When a medical practice closes and transfers records to a professional custodian, patients do not lose their right to access their health information. That right, guaranteed under HIPAA’s Privacy Rule, travels with the records. What changes is who fulfills it.
The medical records custodian assumes the release of information function for the practice’s patient population from the date of transfer through the end of the applicable retention period, which may be seven to ten years or more after the last patient visit. During that window, the custodian becomes the point of contact for every patient who needs their records, every attorney who serves a subpoena, every insurance company processing a claim, and every new provider who needs prior treatment history.
How that function is structured, who is authorized to make a request, how authorization is verified, and what the response process looks like are questions that practices and custodians should resolve explicitly before the transfer occurs.
What Release of Information Means in the Custodian Context
Release of information (ROI) is the formal process by which protected health information (PHI) is disclosed to an authorized party upon request. In an active medical practice, ROI is typically handled by a medical records department, a designated records coordinator, or in smaller practices, by office staff who manage record requests as they come in.
When a practice closes, the ROI function does not simply stop. It continues for as long as records are legally required to be retained. A custodian that accepts a practice’s records accepts the corresponding obligation to receive, verify, process, and fulfill authorized record requests throughout the retention period. This is the operational commitment that distinguishes a professional medical records custodian from a storage facility that merely holds boxes.
The legal foundation for the custodian’s ROI obligations is HIPAA’s Privacy Rule, specifically 45 CFR Section 164.524, which gives patients the right to access their protected health information in their designated record set, and 45 CFR Section 164.526, which addresses the right to request amendment of records. The Privacy Rule does not suspend when a practice closes. Records held by a custodian remain subject to the same access rights and privacy protections as records held by the original provider.
Who Has the Right to Request Records
Not every request for records is an authorized request. The custodian’s role includes verifying that each requester has the legal right to the specific records they are requesting. The categories of authorized requesters and the authorization standard that applies to each are distinct.
Patients themselves have the broadest and most unconditional access right. Under HIPAA, a patient has the right to access their own protected health information in their designated record set, which includes medical records and billing records used to make decisions about the patient. The custodian must fulfill a patient’s access request within 30 days of receiving it in writing, subject to the limited exceptions discussed below.
Personal representatives stand in the patient’s place for records access purposes. This category includes parents or legal guardians of minor patients, agents acting under a valid healthcare power of attorney, and the executor or administrator of a deceased patient’s estate. The custodian must verify the representative’s authority before releasing records, which typically requires documentation such as letters testamentary, a guardianship order, or a copy of the relevant power of attorney.
Treating healthcare providers may receive records for treatment purposes under HIPAA’s treatment exception, which allows disclosure without patient authorization when the disclosure is for the purpose of providing care. In practice, a new provider requesting a patient’s history from a closed practice custodian will typically provide a patient authorization, which is cleaner from a compliance standpoint, but the treatment exception exists as a legal basis.
Attorneys representing a patient may request records with a signed, HIPAA-compliant authorization from the patient. Attorneys pursuing a case against a patient or a former provider may obtain records through a subpoena, which is a legal process that triggers different procedural requirements and should be reviewed by legal counsel before the custodian responds.
Insurance companies and third-party payers may request records for payment or healthcare operations purposes, typically with patient authorization, as part of claims processing or coverage determinations.
Government agencies have specific authority to access records for public health reporting, law enforcement investigations, and regulatory oversight. Each type of government request has its own legal basis and procedural requirements. Requests from state health departments, law enforcement agencies, and regulatory bodies should be reviewed carefully to confirm they fall within HIPAA’s permitted disclosures before records are released without patient authorization.
Researchers may access records with appropriate institutional review board approval and either patient authorization or a documented waiver of authorization meeting HIPAA’s criteria. Research disclosures from a custodian archive are uncommon but do occur for retrospective studies involving historical patient populations.
How the Custodian Verifies Authorization
Releasing records to an unauthorized party is a HIPAA violation regardless of who made the request or how convincing it seemed. The custodian’s authorization verification process must be consistent and documented.
For patient-directed requests, the custodian requires a signed, written authorization that meets HIPAA’s requirements. A compliant authorization must identify the specific information to be disclosed, the purpose of the disclosure, the expiration date or event, the patient’s name and date of birth, the recipient of the records, and the patient’s signature and date. Pre-signed blank authorizations and authorizations that are missing required elements are not compliant and should not be accepted.
For personal representative requests, the custodian must verify that the representative’s authority is current and applies to the type of request being made. A power of attorney that expired, was revoked, or was limited to financial matters rather than healthcare decisions does not authorize access to medical records. Documentation should be reviewed for validity before records are released.
For attorney requests, the custodian should confirm that a signed patient authorization accompanies the request and that its terms cover the records being requested. For subpoenas, the custodian should verify that the subpoena was properly issued, consult the practice’s protocols or legal counsel if uncertain, and provide appropriate notice to the patient before responding if required by applicable law.
For government requests, the specific legal basis cited in the request determines how the custodian should respond. Requests that fall within HIPAA’s permitted disclosures can be fulfilled without patient authorization; requests that do not clearly fall within a permitted disclosure should be reviewed with legal counsel.
The ROI Process: What Happens After a Request Is Received
Once a request is received and verified, the custodian’s process for fulfilling it typically follows these steps:
- Log the request. Record the date received, the identity of the requester, the type of request, and the records being requested. This log is part of the disclosure accounting that HIPAA requires custodians to maintain.
- Verify authorization. Confirm that the authorization is present, complete, and valid before proceeding. If it is incomplete or missing, notify the requester of what additional information is needed and pause the fulfillment process.
- Locate the patient’s records. Search the archive using the patient’s identifying information: name, date of birth, medical record number if applicable, and the date range relevant to the request. For custodians managing both paper and electronic records, this search may need to cover multiple formats and physical locations.
- Identify the specific records requested. Determine whether the request is for all records, records from a specific date range, specific document types, or specific clinical events. Review the designation carefully before producing records, as releasing more than is authorized is a privacy violation just as releasing less than required is an access failure.
- Produce the requested records in the appropriate format. Records may be produced as paper copies, scanned PDF files, or electronic transmission depending on the custodian’s capabilities, the requester’s stated preference, and the format in which the records are held. HIPAA requires that the custodian provide records in the format requested by the patient when they are readily producible in that format.
- Apply any applicable fee. HIPAA allows covered entities to charge a reasonable, cost-based fee for producing records. This fee may cover the cost of copying or scanning, postage, and supplies, but cannot include profit. Many states further regulate the fees that can be charged for medical records access, and some limit fees to a flat per-page amount or a flat maximum.
- Release the records to the authorized recipient. Transmit the records securely, whether by mail, secure fax, secure portal, or encrypted email, depending on the custodian’s protocol and the sensitivity of the records.
- Document the disclosure. Record what was released, to whom, on what date, and the authorization basis. This documentation is required under HIPAA’s accounting of disclosures provisions.
HIPAA’s Right of Access and the 30-Day Requirement
HIPAA’s right of access gives patients the right to receive copies of their health information within 30 days of a written request. If the custodian cannot fulfill the request within 30 days, a single 30-day extension is available, but it requires written notification to the patient explaining the reason for the delay and the expected completion date.
A 30-day response window is manageable when records are well-organized and easily searchable. It becomes a real operational challenge when records are poorly indexed, when a patient’s history spans both paper and electronic formats that are not well-integrated, or when the request is unusually complex.
HIPAA also prohibits custodians from conditioning access to records on the payment of outstanding balances. A patient who owed money to the practice when it closed cannot be denied access to their records on that basis, though the custodian may still charge the applicable copying fee for the fulfillment of the request.
Limited exceptions to the right of access exist, including psychotherapy notes (specifically defined under HIPAA as separate from mental health treatment notes generally), records compiled in reasonable anticipation of litigation, and certain specialized categories of records. These exceptions are narrow and should not be invoked routinely. When a request is denied in whole or in part, the patient must be notified in writing with an explanation and information about how to file a complaint.
Fees, Formats, and Common Questions From Requesters
Requesters often ask similar questions when contacting a custodian for the first time. Several of the most common deserve specific attention in the custodian’s process.
“How long will this take?”
HIPAA requires a response within 30 days. Most well-organized custodians fulfill straightforward requests significantly faster. Setting clear expectations at the point of request avoids frustration and unnecessary follow-up calls.
“How much will this cost?”
The fee, if any, should be communicated upfront based on the applicable state law and the custodian’s fee schedule. Some custodians provide electronic records at no charge for direct patient access requests; others charge per page or per encounter. Requesters should be informed of the fee before they are required to pay it.
“Can you send these directly to my new doctor?”
Yes, with appropriate authorization. The patient’s authorization directing the custodian to transmit records to a named provider is the mechanism for provider-to-provider transfer from a custodian archive.
“I need these urgently. Can you expedite?”
Custodians may offer expedited service for genuine clinical urgency. The process and any additional fee for expedited service should be defined in the custodian’s procedures.
“The records seem incomplete. Where is the rest of my chart?”
A common and legitimate concern, particularly for patients whose records span both paper and electronic formats or whose charts were not completely transferred. The custodian should have a documented process for investigating completeness concerns and, where records are genuinely missing, explaining what is and is not available.
What Practices Should Establish Before Transferring Records
The practice’s obligations in the ROI process do not end when the boxes are transferred. Several decisions made before the transfer directly affect how effectively the custodian can handle patient requests afterward.
Before records are transferred, the practice should confirm with the custodian:
- The authorization form the custodian will require from requesters, ensuring it meets HIPAA standards and is appropriate for the practice’s patient population
- The fee schedule the custodian will apply, confirming it complies with applicable state law
- How the custodian will notify the practice or the physician’s estate if a request raises unusual legal or regulatory concerns, such as a government subpoena or a request for records of a particularly sensitive nature
- The custodian’s process for denied requests and how it will communicate denials to requesters
- What contact information will be provided to patients in the notification letter so they can reach the custodian directly
- Whether the custodian can handle requests in multiple languages if the practice served a population with significant non-English speakers
These decisions, made before transfer and documented in the custodian agreement, reduce the likelihood of confusion, delayed responses, or compliance gaps in the months and years after the practice closes.
Frequently Asked Questions
Who handles patient record requests after a medical practice closes?
The medical records custodian takes over the release of information function from the practice upon the transfer of records. Patients, their authorized representatives, treating providers, attorneys, and other authorized parties submit requests directly to the custodian, who verifies authorization, locates the records, and fulfills the request in accordance with HIPAA and any applicable state law. The custodian serves this function for the full retention period of the records, which may be many years after the practice’s closure.
How long does a custodian have to respond to a patient record request?
Under HIPAA’s right of access, the custodian must respond within 30 days of receiving a written request. A single 30-day extension is available if the custodian cannot complete the request within the initial period, but the patient must be notified in writing of the delay and the reason for it. Most straightforward requests can be fulfilled faster than 30 days when records are well-organized and indexed.
Can a custodian charge for fulfilling a patient record request?
Yes. HIPAA allows a reasonable, cost-based fee that may include the cost of copying or scanning, supplies, and postage but may not include profit. Many states further regulate what fees may be charged for medical records access, with some capping per-page rates or setting a maximum total fee. A custodian’s fee schedule should be established in compliance with applicable state law before the custodian begins receiving requests.
What authorization does a custodian require before releasing records?
For patient-directed requests, a signed, HIPAA-compliant authorization that includes the patient’s name and date of birth, the specific information to be released, the recipient, the purpose, an expiration date, and the patient’s signature. For personal representative requests, documentation of the representative’s authority such as letters testamentary, a guardianship order, or a power of attorney. For attorney requests, a signed patient authorization or a subpoena or court order. For government requests, the applicable legal authority cited in the request.
What happens if a patient’s records cannot be located?
The custodian should investigate whether the records were included in the transfer from the practice, whether the patient’s identifying information matches any records in the archive, and whether the records may exist in a different format than expected. If records genuinely cannot be located, the custodian must inform the patient of what was searched and what was not found. A complete and specific box inventory and patient index is the most effective preventive measure against this situation.
Can family members of a deceased patient request their records?
HIPAA protects the health information of deceased individuals for 50 years following their death. Access to a deceased patient’s records is authorized for the personal representative of the estate, which is typically the executor or administrator named in the will or appointed by a court. Next of kin do not have automatic access rights, though specific state laws may provide some additional guidance on family member access in the absence of a formal personal representative.
Emerald Document Imaging provides medical records custodian services including full release of information management for closing and transitioning practices on Long Island and throughout the New York metro area. Patients, attorneys, providers, and insurance companies can submit requests directly to us, and we handle authorization verification, records retrieval, and compliant fulfillment throughout the retention period.
Learn more about our Medical Records Custodian Services and contact us to discuss your practice’s transition.
