River
Y CombinatorBacked by Y Combinator
Log InStart Free
FREE TEMPLATE

HIPAA Medical Records Request Template

Four documents and three sheets that route every request by legal basis, because the deadline, the fee cap and the logging duty come apart.

Edit with AIDownload (.docx + .csv)

Free download  ·  No account needed

What you get

Pack of 7 files: 4 documents, 3 spreadsheets

HIPAA Medical Records Request Template
  • Request ProcedureDocument
  • Fee Schedule NoteDocument
  • Authorization Verification ChecklistDocument
  • Request RegisterSpreadsheet
  • Response LetterDocument
  • Release LogSpreadsheet
  • Denial and Redaction LogSpreadsheet
RiverHIPAA Medical Records Request Template

Request Register, routing table

Four duties, and each one changes at a different row

Six months at a fictional practice, Bellhaven Family Medicine. 246 requests, one intake queue, one fee schedule, no log.

PathwayReqs30 daysFee capMin necLogged
Access, copy to the individual121YesYesNoNo
Access by directive, electronic copy19YesNoNoNo
Authorization77NoNoNoNo
Required by law8NoNoNoYes
Permitted without authorization21NoNoYesYes
Total246Five profiles, no two alike

136 of 246carried at least one obligation the single queue got wrong

19 on a 30-day clock nobody was counting. 88 invoiced with a retrieval line the cap does not permit. 29 accountable disclosures never logged. The queue was not broken. It had one column too few.

Remaining columns: Received, Capacity, Copy Goes To, Format, Attached, Act By, Extension Letter By, Deadline Source, Verified, Scope Set, Owner.

Every guide to the HIPAA medical records request process teaches the same two rules: act within 30 days, and cap the fee. Both are real. Both belong to one pathway out of five, and a records office runs one queue across all of them. Four separate obligations attach to a request, the legal basis it arrives under decides which apply, and no two pathways carry the same four. Read them down and they invert against how urgent each request feels.

The routine one a receptionist handles is on a hard clock with a fee capped to four permitted costs, and nothing about it ever needs logging. The subpoena that feels urgent has no HIPAA deadline and no HIPAA fee cap, is limited to the minimum necessary, and is the one that has to be written down for six years. One field decides all four, and almost nobody records it.

Bellhaven Family Medicine took 246 requests in six months through a single queue. Re-triaged by pathway, 19 were on a 30-day clock nobody was counting, 88 were invoiced with a retrieval line the cap does not permit, and 29 accountable disclosures were never logged at all. That is 136 of 246, 55 percent, carrying at least one obligation the queue got wrong. The queue was not broken. It had one column too few. Records arriving from elsewhere run the other direction, and an outside records chronology handles those.

Every document in the pack

The row where the clock and the cap come apart, the schedule lines that map to nothing, and the log that becomes the accounting without being rebuilt.

HIPAA Medical Records Request Template
RiverThe misfiled row

One row, four duties, one of them right

A request signed by the patient naming her attorney as the recipient. Filed as an authorization, because a third party's name was on it.

Received4 March 2026Signed byThe patient
Copy goes toHer attorneyFormatElectronic, from the electronic record
DutyWhat the queue hadWhat the pathway carries
Act within 30 daysNo clockAct by 3 April 2026
Written extensionNot consideredAvailable once, by 3 April
Fee capped to four costsCapped, discountedCap does not reach a directive
Minimum necessaryDoes not applyDoes not apply
In the accountingNot loggedCorrectly not logged

Sent 1 May 2026day 58, on a request that had 30

The clock and the cap are taught as one bundle called the access rules. On this row they come apart: the clock runs and the cap does not. The directive reaches an electronic copy of an electronic record in an electronic format, so a directive for paper is not on this row at all and runs as an authorization instead.

Two fields decide it, and most intake forms have neither: who receives the copy, and what format is being sent from where the content lives.

RiverFee Schedule Note

Fee Schedule Note

Every line maps to a permitted cost, or it comes off

The cap permits four costs and no others. A line that maps to none of them does not belong on an invoice for a copy going to the individual.

Schedule lineMaps toOn an access invoice
Per page, copyingLabor for copying, suppliesYes
Portable mediaSuppliesYes
Postage, actualPostage, where mailing was asked forYes
Summary at patient requestPreparing an agreed summaryYes, if agreed in advance
Record retrieval, flat $25NothingNo
Administrative processingNothingNo
Certification, unrequestedNothingNo

What the unmapped line was worth at Bellhaven

Access requests invoiced88 in six monthsRetrieval line$25 flat
Charged outside the cap$2,200Annualised$4,400

That is a refund exposure rather than revenue. And the same $25 line is lawful on the 19 directive rows, where the cap does not reach at all, which is exactly the row Bellhaven had been discounting. One misunderstanding, costing money in both directions at once.

Where state law caps lower than the four permitted costs allow, the lower one governs, and the invoice records which source it came from.

RiverRelease Log

Release Log

Logged in the shape of the artifact it has to become

An accounting has four required elements. The log carries all four on every row, so producing one is a filter rather than a reconstruction.

DateRecipient, address if knownWhat was disclosedPurposeAcct
10 MarState health department, Bureau of Communicable DiseaseThe fields the statute namesReporting required by lawYes
17 MarCircuit Court, Clerk of CourtThe admission the order namesResponse to a court orderYes
25 MarMeridian Health Plan, Special InvestigationsClaims period onlyHealth oversightYes
19 MarPatientFull designated record setAt the request of the individualNo
24 MarHalloway and Finch LLPRecords the form namesLitigation supportNo

The two greyed rows are excepted: a disclosure to the individual about themselves, and a disclosure made under an authorization. Between them they are 81 percent of Bellhaven's volume and none of it belongs in an accounting. What is left is the 12 percent nobody was recording.

What the accounting has to answer

LookbackSix yearsTime to produce60 days, one 30-day extension
Accountable, six months29Logged with all four elements0

At the same rate that is 348 disclosures across the lookback, and the first accounting in any 12-month period is free, so cost is not a filter on who asks.

Third column on the real sheet also carries the scope basis, so a court-order release records that it was cut back to what the order expressly authorized.

Edit with AI

What's in the pack

01

Request Register

One row per request carrying the pathway and all four consequences that fall out of it. Two date columns on every access row: the day action is due, and the last day a written extension can still go out.

02

Request Procedure

The written procedure, built around the routing table rather than around a workflow. It names the designated record sets and the office responsible, both of which the rule requires documented, and sits alongside the wider HIPAA policy set. What lands in that set starts at the front desk, and every unjustified field on the patient intake form is one more thing that has to be produced. Care plans are the part of the record with their own review and signature deadlines, tracked in the care plan documentation pack.

03

Fee Schedule Note

Your own schedule mapped line by line to labor for copying, supplies, postage or an agreed summary. The lines that map to nothing are the exposure, and the rows the cap never reached are the discount nobody had to give.

04

Authorization Verification Checklist

Worked element by element rather than signed off as a whole, because a form missing a required element is not an authorization. Includes the two routing traps that send a 30-day request into a queue with no clock.

05

Response Letter

Four letters, because a records office sends four kinds and three of them carry required content. The extension letter has its own deadline, inside the first 30 days, and a letter sent after that is a late notice.

06

Release Log

Written in the shape of an accounting: date, recipient with address if known, what was disclosed, and the purpose. The artifact a patient can demand becomes a filter over the log rather than a reconstruction from memory.

07

Denial and Redaction Log

The ground for each withholding, whether review rights attach, and where a judgement-based ground was used, the named licensed professional who made the determination. A reviewable denial without one is not a valid denial.

08

Records Request Deadline and Accounting Watch

A weekly pass that leads with the extension windows closing this week rather than the 30-day dates, then directives sitting in the wrong queue, unmapped fee lines, and accountable disclosures missing an element.

How to use it

  1. 1

    Open in River, or download it

    Open the pack in River and let the agent route your live queue, or download the blank Word and CSV files instantly and work through them yourself.

  2. 2

    Route before anything else

    Four fields decide the row: who asked in their own capacity, what was attached, who receives the copy, and what format is going from where the content lives.

  3. 3

    Set two dates on every access row

    The day action is due, and the last day an extension can go out. The second one is inside the first 30 days and it is the date worth watching.

  4. 4

    Log the release, not the request

    Four elements on every row as it goes out. That is what turns an accounting request from a week of archaeology into a filter over a sheet you already keep.

Frequently asked questions

Is this template free?

Yes. Download the whole pack as Word documents and CSV sheets with no credit card. "Edit with AI" is a separate, optional path for practices that want the agent to route their live queue and compute both dates on every row. Other packs are in the template library.

What format are the downloaded files?

Word documents (.docx) for the procedure, the fee note, the verification checklist and the letters, and CSV (.csv) for the three sheets, zipped into one file. They open natively in Word, Pages, Google Docs, Excel, Numbers and Sheets.

Why does the fee cap not apply to a third-party directive?

Because a court said so. In 2020 the fee limitation was held to apply only to an individual's request for their own records and not to a request to transmit records to a third party. The 30-day clock still runs, so the two rules come apart on that row.

How can a subpoena have no HIPAA deadline?

Because the Privacy Rule sets a deadline only on the access pathway. A subpoena's date comes from the court or the requester. What the rule does impose is a precondition: without a court order behind it, disclosure needs satisfactory assurance of notice or a protective order first.

Do we have to log every disclosure we make?

No, and that is the point. Treatment, payment and operations are out. Disclosures to the individual are out. Disclosures under an authorization are out. What is left is mostly the permitted-without-authorization pathway, which is also where minimum necessary applies and the whole chart usually goes anyway.

Does this pack decide whether a disclosure is permitted?

No. It routes, tracks, prices, scopes and logs. Whether a disclosure is permitted, whether a denial ground applies and how to read a subpoena are for your privacy officer and, where compulsion is involved, counsel. The security risk analysis those roles also own is a separate pack.

What if our state law is stricter?

Then it governs, on whichever of the four columns it reaches. Several states cap copying fees below the federal permitted costs or shorten the response window. The register records which source each date and cap came from, so a later reviewer can see the reasoning rather than infer it.

Sources

  1. eCFR45 CFR 164.524 — Access of individuals to protected health information (opens in a new tab)
  2. eCFR45 CFR 164.528 — Accounting of disclosures of protected health information (opens in a new tab)
  3. HHSImportant Notice Regarding Individuals’ Right of Access to Health (opens in a new tab)
  4. eCFR45 CFR 164.512 — Uses and disclosures for which an authorization or opportunity to agree or object is not required (opens in a new tab)
  5. eCFR45 CFR 164.502 — Uses and disclosures of protected health information: General rules (opens in a new tab)

Written by

Chandler Supple

Co-founder & CEO, River

Chandler has spent the last six years working in AI, building tools for millions of users and Fortune 100 companies. In 2025, he co-founded River to build a new kind of operating system for AI agents.

LinkedInGitHubX

Reviewed by

Brian Joseff, Co-founder, River

LinkedInX

Related workspaces

Outside records chronology and gap list

For the stack arriving from another provider, which runs the other direction.

Referral letter and consult note

For what goes back out to a clinician rather than to a requester.

HIPAA policies and procedures template

The wider policy set, training evidence and business associate register.

More free templates

Patient Education Handout Template

Free patient education pack: every handout carries a named clinician's approval and a review date derived from what it depends on, not a blanket annual policy.

Patient Intake Form Template

The intake template that gets shorter. Every field names the requirement that reads it, and a field that was right last year is measured as stale, not filled.

Telehealth Encounter Documentation Template

Audits telehealth encounters against five non-clinical elements, priced by element and by payer, because a signed consent isn't always enough.

Treatment Plan Documentation Template

Free care plan documentation pack: the review-due date is computed from the service line's own interval and anchor, with the authority stored on the row.

Route it first, and three of the four duties decide themselves

Download the blank pack as Word and CSV files, or open this exact pack in River and let the agent route your live queue and find the rows on a clock nobody was counting.

Edit with AI