How to manage patient records requests and reduce delay

A patient records request arrives the way a supply order does. It comes in by fax, portal message, or across the front desk, and joins a queue behind every task with a patient sitting in a room. Two federal rules attach the moment it arrives, each on a different clock, and neither is enforced by the practice management system.

The result is a workflow most independent practices cannot describe in numbers. Not the median turnaround. Not the oldest open request. Not who owns the queue. That gap used to be an administrative annoyance. It is now a scored operational exposure.

Two rules, two clocks

The first is the HIPAA right of access under title 45 of the Code of Federal Regulations, section 164.524. A practice must act within 30 days, with one 30-day extension if it tells the patient in writing why and when. Thirty days is a ceiling, not a service target, and the Office for Civil Rights (OCR) has enforced it that way since its 2019 Right of Access Initiative. The settlements share a shape: one patient, one request, one complaint after weeks of silence.

The designated record set is broader than the chart most practices picture: It includes the billing and payment records used to make decisions about the patient, which often live in a different system than the clinical note. Fulfilling the clinical half on day 9 and never addressing the billing half does not complete the request, and the clock does not stop on partial delivery.

The second rule is the information blocking provision of the 21st Century Cures Act, and it sets no deadline at all. It asks whether the practice interfered with the access, exchange, or use of electronic health information without an applicable exception. A delay sitting comfortably inside the 30-day window can still be interference if the reason behind it is not an enumerated exception. The two rules are not tiered; they apply at the same time, to the same request, from the day it arrives.

The penalty is a payment adjustment

For an independent practice, an information blocking finding does not arrive as a fine. The Department of Health and Human Services (HHS) finalized the provider disincentives in June 2024. A Merit-based Incentive Payment System (MIPS)-eligible clinician found by the Office of Inspector General to have committed information blocking and referred to the Centers for Medicare & Medicaid Services (CMS) receives a zero in Promoting Interoperability. That category carries 25 percent of the MIPS final score, so a quarter of the composite disappears into a payment adjustment two years downstream. The million-dollar civil money penalty people cite reaches health IT developers and information networks, not practices. The practice’s exposure sits inside a program it already reports to, scored on a submission it already files.

Where the delay actually comes from

Turnaround failures cluster in four places, and copying the chart is none of them:

• Ownership: The request lands in a shared inbox or fax tray with no named owner and no timestamp, so the clock has run six days before anyone counts it as a request.
• Unnecessary routing: Routine requests get held for a provider review no rule requires, on a provider whose next administrative block is 11 days out. The review is a habit, not an obligation, and usually the largest contributor to the tail of the distribution.
• Format: A patient who asks for an electronic copy of records maintained electronically is entitled to that form when readily producible. Defaulting to paper turns a same-week task into a 2-week one and raises the interference question at once.
• Money: The fee for a patient’s own request must be reasonable and cost-based. A flat $6.50 remains available for electronic copies under the 2016 OCR fee guidance, and Ciox Health v. Azar narrowed how that rate applies when records go to a third party. Staff who price a patient request at the third-party rate stall a release over a bill the patient does not owe.

A workflow you can audit

Four measures, and a practice that cannot produce them does not know its own exposure:

• Intake: Every request gets a timestamp and a named owner the day it arrives, from every channel, including the fax line and voicemail. A request that is not logged is still aging.
• Distribution of days to fulfillment, not the average: An average of 9 days is compatible with 2 requests that sat 41 days, and those 2 generate the complaint. Track the maximum and the 30-day count alongside the median.
• A release log: What was withheld, and the exception or state-law basis cited. An undocumented partial release is the hardest position to defend months later against a patient who remembers the date exactly.
• The vendor line: Wherever release of information is outsourced. Contract for a turnaround shorter than the ceiling, and review the vendor fee schedule against the patient rate, because the practice remains the covered entity regardless of who prints the pages.

One question makes the framework testable: Ask the electronic health record (EHR) vendor whether the system can report request-to-release intervals at all. Many cannot, which is the practical reason so few practices know their own number.

What this comes down to

The records request is not a courtesy extended when the schedule allows. It is a regulated workflow with two concurrent clocks, a defined fee structure, and a penalty that lands on a Medicare payment adjustment rather than in a courtroom. A practice that can state its median turnaround, its oldest open request, and the named owner of the queue is defensible whichever rule the question comes from. A practice that treats the request as an errand will learn its turnaround number from a complaint, in a format written by someone else.

The difference is not diligence. It is whether anyone ever measured the workflow.

GetPracticeHelp is an independent vendor evaluation and decision support resource for independent practice owners. The platform helps practice operators make informed operational decisions across EHR selection, revenue cycle and billing services, credentialing, compliance, vendor evaluation, and operational benchmarks for primary care, specialty medicine, dental, behavioral health, physical therapy, and chiropractic practices.

GetPracticeHelp publishes independently tested buyer’s guides, a comparison directory of verified service providers, and decision support tools that help practice owners evaluate build versus buy tradeoffs without vendor sales pressure. The platform does not accept paid placement. Affiliate revenue follows the ranking, not the other way around, and its methodology is fully disclosed.

Its writing covers vendor evaluation methodology, payer dynamics, regulatory and compliance shifts, AI-assisted operations for clinical workflows, and the structural challenges that limit how independent practices grow. Resources are available at GetPracticeHelp, with updates on LinkedIn.