Records Request Letter

Records Request Letter

LEGAL CONTEXT: Records requests in litigation require careful attention to HIPAA and state privacy law requirements. Under HIPAA (45 C.F.R. § 164.508), a valid authorization for disclosure of protected health information must meet specific regulatory requirements, including: a description of the information to be disclosed, identification of the person(s) authorized to make the disclosure, identification of the person(s) to whom disclosure may be made, an expiration date or event, a statement of the right to revoke, and a signature. State laws often provide additional protections. Authentication of records through FRE 902(11) certification from a business records custodian avoids the need for live testimony at trial. This template includes separate authorization forms for medical, employment, and financial records.

RECORDS REQUEST INFORMATION

SENT VIA:
☐ Certified Mail, Return Receipt Requested (Cert. No.: [________________________________])
☐ Process Server
☐ Secure Electronic Portal: [________________________________]
☐ Email with Delivery Confirmation: [________________________________]
☐ Fax with Confirmation

Date: [__/__/____]

To:

Custodian of Records / HIPAA Privacy Officer
[________________________________] (Institution / Provider / Employer / Bank)
[Address]
[City, State, ZIP]
Fax: [________________________________]
HIPAA Officer Email: [________________________________]

Re: RECORDS REQUEST — [________________________________]
Patient/Client/Employee: [________________________________]
Date of Birth: [__/__/____]
Social Security No. (last four digits only): XXX-XX-[____]
Account/Patient/Employee ID (if known): [________________________________]
Our File No.: [________________________________]

Dear Custodian of Records / Privacy Officer:

This office represents [________________________________] ("Client") in the above-referenced matter. Pursuant to the authorization signed by Client (enclosed) and the applicable state and federal law identified below, we request the records described in this letter. Enclosed with this request is a signed authorization that complies with HIPAA (45 C.F.R. § 164.508) and applicable state law.

SECTION 1: PART A — MEDICAL AND HEALTH RECORDS REQUEST

(Complete this Section only if requesting medical/health records.)

1.1 Description of Records Requested

Please provide true, complete, and legible copies of ALL health information in your possession relating to [________________________________] ("Patient"), including without limitation:

☐ Complete medical chart, including all physician notes (attending, specialist, resident, and consulting)
☐ Nursing notes, nursing assessments, and care plans
☐ Emergency department records and triage documentation
☐ Operative reports, anesthesia records, and surgical logs
☐ Pathology and laboratory reports (blood work, urinalysis, cultures, biopsies, genetic testing)
☐ Radiology and imaging reports AND images (X-ray, MRI, CT scan, PET scan, ultrasound) — films/images must be provided on CD/DVD or digital format
☐ Pharmacy and medication administration records
☐ Physical therapy, occupational therapy, and rehabilitation records
☐ Mental health and behavioral health records (requires separate psychotherapy notes authorization — see Section 1.4)
☐ Social work and case management records
☐ Discharge summaries and transfer records
☐ Consent forms and informed consent documentation
☐ Incident reports (note: in some states these may be protected — produce with privilege log if withheld)
☐ Billing records and insurance correspondence (itemized bill, UB-04, HCFA 1500)
☐ Prior authorizations from insurers
☐ Correspondence with other providers or specialists regarding Patient
☐ Any other records relating to Patient's treatment, diagnosis, or condition

Requested Date Range: From [__/__/____] through [__/__/____] (or ALL DATES if specified: ☐ All dates)

Specific Condition, Injury, or Visit (if limiting request):
[________________________________]

1.2 HIPAA Compliance Note

This request is accompanied by a HIPAA-compliant authorization signed by the Patient (Exhibit A). The authorization includes all elements required by 45 C.F.R. § 164.508(c):

☐ Description of information to be used or disclosed
☐ Name of authorized disclosing party (this institution)
☐ Name of authorized recipient (this law firm)
☐ Purpose of the disclosure (litigation)
☐ Expiration date: [__/__/____]
☐ Right to revoke statement
☐ Signature of Patient: ________________ Date: [__/__/____]

1.3 Response Time Requirements

We request production by [__/__/____]. If additional time is needed, please contact this office immediately.

1.4 Psychotherapy Notes — Separate Authorization Required

☐ Psychotherapy notes are NOT included in this request (standard mental health records are included).
☐ Psychotherapy notes ARE requested. A separate authorization specifically referencing "psychotherapy notes" is enclosed as Exhibit A-2, as required by 45 C.F.R. § 164.508(a)(2).

Note: Psychotherapy notes (as defined by 45 C.F.R. § 164.501 — notes recorded in any medium by a mental health professional documenting or analyzing conversation during counseling sessions) require separate authorization and cannot be included in a general medical records authorization.

1.5 Medical Records Fee Schedule

We agree to pay reasonable fees permitted by applicable law. The following fee limits apply:

Please provide an itemized invoice before fulfillment if charges are expected to exceed $[________________________________]. We will issue payment within [____] days of invoice.

SECTION 2: PART B — EMPLOYMENT RECORDS REQUEST

(Complete this Section only if requesting employment records.)

2.1 Description of Employment Records Requested

Please provide copies of all employment records maintained for [________________________________] ("Employee"), including:

☐ Complete personnel file
☐ Employment application, resume, and hiring documentation
☐ Offer letter and employment agreement
☐ Performance evaluations and reviews for all periods employed
☐ Disciplinary actions, warnings, and corrective action plans
☐ Attendance records and time sheets for [__/__/____] through [__/__/____]
☐ Payroll records, including wages, salaries, overtime, bonuses, and deductions
☐ W-2 forms for tax years [____] through [____]
☐ Benefits enrollment and usage records
☐ Training and certification records
☐ Workers' compensation claim records
☐ Workplace accommodation or disability records
☐ Termination documentation and separation agreement
☐ COBRA and benefits continuation records
☐ Internal investigation files relating to [________________________________] (produce with privilege log if withheld)
☐ All correspondence relating to Employee's employment, separation, or claims
☐ Other: [________________________________]

2.2 Authorization for Employment Records

Enclosed is an authorization signed by Employee permitting release of the above records. The authorization complies with applicable state law. (See Exhibit B.)

SECTION 3: PART C — FINANCIAL AND BANK RECORDS REQUEST

(Complete this Section only if requesting financial records.)

3.1 Description of Financial Records Requested

Please provide copies of the following financial records relating to [________________________________] (Account Holder / Entity) for the period [__/__/____] through [__/__/____]:

☐ Bank account statements (checking, savings, money market) — Account No(s).: [________________________________]
☐ Cancelled checks and deposit slips
☐ Wire transfer and ACH records
☐ Loan and credit account records
☐ Investment and brokerage account statements
☐ Credit card statements
☐ Safe deposit box records
☐ Cashier's checks, certified checks, and money orders
☐ Signature cards and account opening documents
☐ Correspondence relating to account holder
☐ Other: [________________________________]

3.2 Right to Financial Privacy Act Notice

Federal law (Right to Financial Privacy Act, 12 U.S.C. § 3401 et seq.) may require customer notice before financial institution records are released. State-specific notice requirements may also apply. This request is accompanied by:

☐ Customer authorization signed by account holder (Exhibit C)
☐ Administrative subpoena or court order (if applicable)
☐ Grand jury subpoena (if applicable)

SECTION 4: PART D — GENERAL BUSINESS RECORDS REQUEST

(Complete this Section only if requesting general business records.)

4.1 Description of Business Records Requested

Please provide copies of all records relating to [________________________________], including:

☐ Contracts and agreements between [________________________________] and [________________________________]
☐ Invoices, purchase orders, and billing records
☐ Shipping, delivery, and logistics records
☐ Correspondence (letters, emails, faxes) relating to [________________________________]
☐ Product specifications, design documents, and technical manuals
☐ Safety data sheets, testing records, and inspection reports
☐ Regulatory compliance records and governmental filings
☐ Insurance policies and claims records
☐ Other: [________________________________]

Relevant Time Period: From [__/__/____] through [__/__/____]

SECTION 5: FORMAT AND DELIVERY INSTRUCTIONS

5.1 Preferred Production Format

We request that records be produced in the following format:

☐ Electronic (Preferred): PDF or native format, produced via:

• Secure electronic portal: [________________________________]
• Encrypted email: [________________________________]
• USB drive mailed to this office
• CD/DVD (for imaging)

☐ Paper copies (if electronic production is not available): Please contact this office before fulfilling to confirm copying charges.

5.2 Electronic Production Specifications

For electronic records:

• Please preserve original file format and metadata where possible
• Label files clearly by date and document type
• Provide an index or table of contents for large productions
• Imaging records (X-rays, MRIs) should be produced in DICOM format or on CD/DVD with viewer software

5.3 Completeness

Please confirm in writing if any categories of records requested are: (a) not in your possession; (b) subject to privilege (provide a privilege log); or (c) no longer available (describe circumstances of destruction).

SECTION 6: AUTHENTICATION FOR COURT USE (FRE 902(11))

6.1 Business Records Certification

To the extent practicable and not burdensome, we request that the Custodian of Records provide a Certificate of Business Records Authenticity consistent with Federal Rule of Evidence 902(11) and applicable state equivalents, in the form of Exhibit D attached hereto.

FRE 902(11) provides that a certified copy of domestic records of a regularly conducted activity — accompanied by a written certification by the custodian — is self-authenticating and admissible without requiring the custodian's live testimony, provided the proponent has given opposing parties reasonable opportunity to challenge the authenticity.

If a certification is not possible, please advise so that we may subpoena the Custodian of Records if live authentication testimony is required at trial.

6.2 HIPAA Certification

For HIPAA-covered records, please note that a provider may certify that records are true and correct copies of the records maintained in the ordinary course of business without separately disclosing information about any patient not identified in the authorization.

SECTION 7: DEADLINE AND CONTACT INFORMATION

7.1 Response Deadline

Please respond and produce the requested records no later than [__/__/____] (the "Response Deadline"). This deadline reflects the applicable statutory response period for [jurisdiction]. If you are unable to fulfill this request by the deadline, contact this office immediately with an estimated completion date.

7.2 Contact Information

Please direct all inquiries, correspondence, and records to:

[________________________________]
[Attorney Name / Records Specialist]
[Law Firm / Organization]
[Street Address]
[City, State, ZIP]
Direct Phone: [________________________________]
Fax: [________________________________]
Email: [________________________________]
Secure Portal: [________________________________]

SECTION 8: FOLLOW-UP DEMAND

If we have not received the requested records or a written response by the Response Deadline, we reserve the right to proceed with formal legal process, including service of a subpoena duces tecum, to compel production. We may also seek recovery of all fees and costs incurred in compelling compliance.

Thank you for your prompt attention to this matter. We look forward to your cooperation.

Sincerely,

[________________________________]
[Attorney Name]
[Bar Number]
[Law Firm]

Enclosures:

• Exhibit A: HIPAA-Compliant Authorization for Release of Medical Records
• Exhibit A-2: Psychotherapy Notes Authorization (if applicable)
• Exhibit B: Employment Records Authorization
• Exhibit C: Financial Records Authorization
• Exhibit D: Proposed Certificate of Business Records Authenticity (FRE 902(11) form)
• Copy of identifying document (if required by applicable law)

EXHIBIT A — HIPAA-COMPLIANT AUTHORIZATION FOR RELEASE OF MEDICAL RECORDS

(45 C.F.R. § 164.508 compliant)

AUTHORIZATION FOR RELEASE OF PROTECTED HEALTH INFORMATION

Patient Name: [________________________________]
Date of Birth: [__/__/____]
Social Security No. (last four digits): XXX-XX-[____]
Address: [________________________________]

1. I authorize the following person(s)/entity to release my health information:

Name/Entity: [________________________________]
Address: [________________________________]

2. I authorize release to the following person(s)/entity:

Name/Entity: [________________________________] (Law Firm)
Address: [________________________________]
Phone: [________________________________]

3. Description of health information authorized for release:

☐ All records from [__/__/____] to [__/__/____]
☐ Records relating to: [________________________________]
☐ All records (all dates)

Specific conditions or diagnoses (if applicable): [________________________________]

4. Purpose of this authorization: Litigation / Legal proceedings

5. This authorization expires: ☐ On [__/__/____] ☐ Upon conclusion of litigation ☐ One (1) year from date of signature

6. I understand that:

• I may revoke this authorization in writing at any time, except to the extent that action has been taken in reliance on it.
• My treatment, payment, enrollment, or eligibility for benefits may NOT be conditioned on signing this authorization (unless the purpose is for research or certain other specified purposes).
• Information disclosed pursuant to this authorization may be re-disclosed by the recipient and may no longer be protected by HIPAA.

Patient/Authorized Representative Signature: [________________________________]

Printed Name: [________________________________]

Relationship to Patient (if not patient): [________________________________]

Date: [__/__/____]

(If signed by personal representative, provide documentation of authority on reverse.)

EXHIBIT D — CERTIFICATE OF BUSINESS RECORDS AUTHENTICITY (FRE 902(11))

CERTIFICATE OF AUTHENTICITY OF BUSINESS RECORDS

I, [________________________________], certify that:

1. I am the custodian of records, or a qualified person familiar with the record-keeping practices, of [________________________________] ("Entity").

2. The attached records (totaling [____] pages / [____] files) are true and correct copies of records maintained by the Entity in the ordinary course of its regularly conducted business activity.

3. These records were made at or near the time of the acts, events, conditions, opinions, or diagnoses reflected in the records, by or from information transmitted by a person with knowledge.

4. It was the regular practice of the Entity to make such records.

5. These records were produced in response to a records request from [________________________________] dated [__/__/____].

I declare under penalty of perjury under the laws of [________________________________] that the foregoing is true and correct.

Signature: [________________________________]

Printed Name: [________________________________]

Title: [________________________________]

Entity: [________________________________]

Date: [__/__/____]

SOURCES AND REFERENCES

• 45 C.F.R. § 164.508 (HIPAA authorization requirements)
• 45 C.F.R. § 164.524 (patient right of access — 30-day response)
• Cal. Health & Safety Code § 123110–123111
• Tex. Health & Safety Code § 241.153; Tex. Occ. Code § 159.006, 159.009
• Fla. Stat. § 456.057
• N.Y. Public Health Law § 17
• Fed. R. Evid. 803(6) (business records exception)
• Fed. R. Evid. 902(11) (self-authentication of business records)
• HHS.gov: "Individuals' Right under HIPAA to Access their Health Information 45 CFR § 164.524"