Practice of Medicine


Accessing and Amending Medical Records

Case Study #1

During an exam, Mr. Smith admits to his doctor that he used alcohol heavily in the past. The doctor notes this in the patient’s progress note. Subsequently, Mr. Smith applies for life insurance and learns that he is denied on the basis of the doctor’s note. Mr. Smith is upset and contacts his doctor to request an amendment of his medical record.

Case Study #2

Divorced parents are fighting over the custody of their two-year-old son. The mom calls the child’s provider and asks that information be added to her son’s medical record regarding a recent injury. She suggests that the injury could be the result of the father’s neglect.

Requests for Medical Records

MagMutual receives frequent calls about patients requesting redaction or amendment of their medical records. In the era of open access, patients now have the ability to request documentation of their visits with medical providers. Workers’ compensation, divorce and custody controversies, life or disability insurance application reviews, and ongoing legal proceedings all periodically lead to these types of requests. In each situation, sensitive information and potentially adverse comments in the record may result in unfavorable consequences for the patient.

Under HIPAA, patients have the right to review, (free of charge), and receive a copy, (for a fee), of their medical and billing records and any other records that are used to make decisions about a patient. Failure to comply with HIPAA’s access requirements is one of the top five most common violations of HIPAA.

A partial list of the most common records that a provider is not required to produce, (i.e. patients do not have a right of access), includes:

  • Quality assurance or professional review materials
  • Psychotherapy notes (personal notes of the therapist pertaining to counseling sessions; medications, dates of visits, billing information and other parts of the records are still subject to the right of access)
  • Information compiled in anticipation of a civil, administrative, or criminal action
  • A medical record which, if released, would likely cause harm to the patient or another person (in the professional judgment of the provider)

Research study records, but only if the patient agreed during the consent process and only while the clinical trial is in progress (patients must be informed that their right to access will be reinstated following the conclusion of the clinical trial)

  • Information obtained from someone other than a healthcare provider, such as a family member or close friend, under a promise of confidentiality

A common myth is that you cannot provide copies of another provider’s records that are contained in your records. This is not true. HIPAA FAQ’s for Professionals specifically states that a provider can produce such records and, in fact, it may be a violation of the right of access if you do not do so when requested by the patient.

A provider may require a patient to submit any request for access to records in writing, but only if the patient has been informed of this requirement, usually in the Notice of Privacy Practices. We recommend that providers have a requirement for a written request for access and that the request is signed and dated by the patient.

Guidelines for Providing Records to Patients

In general, physicians are required to provide the records in a “timely” manner (as soon as reasonably possible, but no later than 30 days after the request). In unusual situations beyond the control of the physician, an additional 30-day extension may be obtained if the patient is notified before the expiration of 30 days. These unusual circumstances may exist, for example, if the records are offsite and cannot be retrieved within the 30-day time frame. Being too busy, short-staffed, or similar reasons will not suffice. It is important to note that some states have laws that require records to be produced in a shorter time frame. Be sure to know and comply with the laws and regulations applicable your state.   

The Privacy Rule requires physicians to produce the records in the form and format requested by the patient, if readily producible in that form and format, or if not, in a readable hard copy form. For example, if a patient requests an electronic copy of a paper record, the physician is required to scan the paper information into an electronic format if the office has scanning capabilities.

The physician can charge a reasonable, cost-based fee for providing a copy, but can only charge for the following:

  • The cost of labor for actual copying time. Time spent reviewing the request, retrieving the records, etc. cannot be charged
  • The cost of supplies (e.g. paper and toner, or USB drive or DVD, if electronic); and
  • Postage if the patient requests the records be mailed

If the patient requests a summary or explanation of the records, labor for creating the summary may be charged if the patient agrees in advance to the proposed fee.

Requests to Amend Records

After accessing or obtaining a copy of their medical records, patients may also invoke another related right under HIPAA: the right to request an amendment or correction of their medical records. Providers must have a procedure in place to address this type of request. The request to amend must generally be approved or denied within 60 days, absent unusual circumstances.

Providers should be careful about any complaint from a patient about the accuracy of the records and should treat the complaint as a request to amend the medical record or should at least ask the patient if they are requesting an amendment and then proceed accordingly. The federal agencies charged with enforcing HIPAA consider emails, letters, and telephone calls complaining that the records are not correct as a “request to amend” and can sanction your practice if you do not follow the proper procedures.

If the request to amend is approved, the patient must be advised, and the amendment should be changed in the appropriate record. It should be clearly marked as an amendment and dated. Transparency is key to avoiding a later claim of alteration. Reasonable steps must be taken to get the amended information to individuals that the patients wants notified and to anyone to whom the provider previously sent the unedited record.

If the request is denied, the patient must be advised, in writing and in plain language, of the reason for denial. A request to amend may only be denied for one of the four following reasons, which must be stated in the denial letter:

  • The requested health information was not created by the physician’s office (a copy of another provider’s records). However, if the patient provides a reasonable basis to believe that the originator of the record is no longer available to act on the request, the amendment may be made
  • The patient does not have a right to access the records, and therefore does not have the right to amend them. Examples of this include psychotherapy notes, ongoing research, or confidential information obtained from a family member (see previous list)
  • The request does not pertain to the patient’s medical and financial records
  • The health information is accurate and correct (the most common reason for denial)

If the request is denied, the patient has the right to submit a statement of disagreement to the medical practice or facility. This statement must be included in the medical record and provided with any later request for those specific records. The right to file a statement of disagreement and the process for doing so must also be clearly stated in the denial letter.

Alternatively, the patient may elect, in lieu of filing a statement of disagreement, to use the letter requesting amendment. If requested, the provider must comply, and the letter requesting amendment must be included in the medical record and provided in any later disclosure of that record. 

The patient’s request to amend, the physician’s response, and all correspondence of these requests should be retained by the provider and included in the medical record. In the case studies at the beginning of this article, the requests for amendment were denied. Case study #1 was a situation where the record was accurate and correct; case study #2 represents a request that did not pertain to the patient’s medical record. 

Amendments by the Provider

Case Study #3

An ER physician evaluates a man with a respiratory illness and diagnoses influenza. The physician then sends the patient home. When the physician returns for his next shift, he learns the patient returned to the ER and is now in the ICU with sepsis. He reads his original note and feels it is inadequate and wants to add information that he didn’t include during the patient’s initial visit. He calls the MagMutual risk management hotline for advice.

  • After an adverse outcome, a physician may wish that a note in the medical record was more complete. Perhaps the ER physician should have written more in the physical examination, discussed more in the differential, or given better discharge instructions. After-the-fact notes, especially in the setting of an adverse outcome, are tricky. It is virtually impossible to make these not appear defensive or a tacit admission of wrongdoing. These additions will not help your case and our advice in this situation is generally to not add a note.
  • If the record is incorrect then it is reasonable to make a clear change of the record after the fact. This should be clearly marked as an addition or correction and noted as being added after the event. Never try to make it look like an added note is really part of the original. Besides appearing deceptive, the audit trail of the EHR will document when each entry is made.
  • Lost notes occur in the written and digital world. Be clear that this is being written after-the-fact. If it’s a few days later, summarize the care provided since you may not be able to recall all the specific details.
  • Some providers may add “Dictated but not read” or other disclaimers about voice recognition software following a dictated note. There is no advantage to this addendum. In fact, it is more often a disadvantage. In essence, it is saying you didn’t care enough to take the time to read your own note to see if it was correct. More practically, the comment will not qualify as the required certification of your records for Medicare and your bills may be denied if this statement is in your notes.

Please note: When an incident is reported, MagMutual will mail written confirmation of receipt to the insured. This confirmation should be kept separate from the medical record, as should all communications with MagMutual.

If you are not sure how to respond to a request or have questions about amending a record, please call your MagMutual Risk and Patient Safety Consultant or MagMutual’s Risk Management hotline at (800) 282-4882.

Created by MagMutual from materials provided by COPIC as part of MagMutual and COPIC’s alliance to improve patient safety and quality of care for all of our PolicyOwners. 


Want to learn more?

Interested in how MagMutual can help?

View our products


The information provided in this resource does not constitute legal, medical or any other professional advice, nor does it establish a standard of care. This resource has been created as an aid to you in your practice. The ultimate decision on how to use the information provided rests solely with you, the PolicyOwner.