Patient Medical Record Access Guidance Issued by ONC

by | Jun 13, 2017

Patient medical record access guidance has been issued by the Department of Health and Human Services’ Office of the National Coordinator for Health Information Technology (ONC).

The HIPAA Privacy Rule permits patients to obtain copies of their health information from their providers. Patients have the option of receiving data in paper or electronic form. Electronic copies should be provided on a CD, copied to a pen drive, or emailed (at a patient’s request), although many healthcare organizations also provide access to medical records via their patient portals.

However, some healthcare providers are struggling to process the requests made by patients. Patients are also often confused by the request process and find it difficult to obtain copies of their PHI or access the information via patient portals. The process lacks transparency and data is not always provided in a readily usable form. When requests need to be made to multiple providers, obtaining a full set of health information can take months.

ONC was aware of the problems faced by patients and launched an investigation to determine what was happening and how the health information request process could be improved for both patients and providers.

ONC looked at the problems faced by both providers and patients and conducted interviews with patients to find out how they felt about the process and what could be improved. The results of the investigation have now been made available to healthcare providers.

The report – Improving the Health Records Request Process for Patients – details several steps that covered entities can take to streamline the processing medical record access requests and ensure patients are provided with their health data in a timely fashion.

The guidance includes several examples of the problems faced by patients using three fictional personas. The personas may be fictional, but they detail genuine examples of problems that were identified from 17 interviews with patients.

In addition to the interviews, ONC looked at the medical record release forms of 50 large healthcare systems across the United States, spoke with medical record fulfillment administrators and consulted partner stakeholders.

The interviews confirmed that while the Office for Civil Rights has previously issued guidance for patients and covered entities on medical record access, patients still do not have easy access to their health data. Patient portals have been implemented by many healthcare organizations and health data is accessible through those portals. However, in practice, health data is often incomplete or inaccurate. Many patients have found they are unable to access their PHI in electronic form, making the process of sharing their information with other providers a difficult process.

Many patients feel the medical record access requests go into a black box and do not understand what is going on. They do not receive notifications that the requests have been received, how long the process will take, or what is involved.

The findings of the ONC investigation and its recommendations for streamlining the process of providing access to medical records have been detailed in this report.

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.


Please enable JavaScript in your browser to complete this form.


    Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.

    Comprehensive HIPAA Training

    Used in 1000+ Healthcare Organizations and 100+ Universities

      Full Course - Immediate Access

      Privacy Policy