A paralegal opens the provider's response expecting a complete chart and finds three progress notes, a redacted invoice, and a message saying the request was “too broad.” The demand package is due soon, the adjuster is questioning treatment, and nobody can tell whether the missing imaging files were never created or weren't requested. That problem rarely starts with the records department. It starts with a medical record request letter that gives the custodian too much room to guess.
In personal injury practice, the letter is a case-management instrument, not clerical cover. It identifies the patient, defines the evidentiary scope, invokes a time-bound access process, and tells the provider exactly how the production should arrive. A precise request also helps the firm compare treatment chronology, causation evidence, billing, and damages without repeatedly reopening the same file.
Digital access hasn't made formal requests obsolete. In 2024, 77% of individuals were offered online access to medical records and 65% accessed them at least once during the prior year, with access having increased 50% from 2020, according to the National Center for Biotechnology Information's summary of patient portal access. Portals may provide quick access to selected information, but a litigation file still needs a deliberately scoped request for the records, formats, and custodians that matter.
Why a Perfect Medical Record Request Letter Matters
A personal injury firm can receive a file that is technically responsive yet useless for litigation. “Please send all medical records” may produce office notes while leaving out itemized billing, billing codes, radiology images, therapy flowsheets, provider messages, or records maintained by a separate release vendor. The team then sends a second request, waits again, and loses time reconstructing the treatment chronology.
A well-drafted letter functions as the first evidence map. It identifies the treatment window, distinguishes the complete designated record set from specific categories, names the intended recipient, and states the preferred delivery method. For a PI case, that means requesting the evidence needed to test causation and damages, including provider notes, imaging reports and files, procedure records, medication history, billing ledgers, codes, and payment information. Listing those categories also reduces the chance that a custodian treats “all records” as permission to select only routine notes.
The letter should anticipate predictable pushback. If the provider uses separate departments or vendors, direct the request to each relevant custodian or state that the provider should identify and forward records held elsewhere. Ask the custodian to confirm whether a requested category does not exist, is unavailable, or is being withheld, rather than omitting it without explanation. Specify whether electronic records should include native imaging files, metadata, and readable billing detail when those materials are needed for expert review.
Practical rule: Make the request broad enough to capture the injury story, but organized enough for a records specialist to process without asking what “all records” means.
A precise request also creates a useful paper trail. It shows what the firm sought, for which period, in which format, and to whom delivery was directed. That record helps counsel challenge an incomplete production and decide whether a follow-up should target missing evidence instead of repeating the entire request.
Portals serve a different purpose. They may show information available to the patient online, while a formal letter documents the categories and custodians the firm asked to produce. For personal injury litigation, both sources can matter, but the letter controls the scope of the production the case team must evaluate.
The Anatomy of a Compliant Request Letter
A reliable medical record request letter should be easy for a records specialist to validate at a glance. The request must identify the patient and describe the information clearly enough for the provider to locate it in the requested format when that format is readily producible. Holland & Hart's discussion of HIPAA releases and authorizations supports that operational standard.
Use this checklist before dispatch:
Patient identification. Include the patient's full legal name, date of birth, current address, former names if relevant, and any medical record number known to the firm. The purpose is matching, not decoration. Example: “Please identify the records for Jordan Lee, date of birth [MM/DD/YYYY], medical record number [number], residing at [address].”
Recipient details. Address the request to the correct facility, department, and custodian. A hospital's medical records department may differ from its imaging center or billing office. Example: “To the Health Information Management Department, [provider name and address].”
Specific records requested. List the categories and treatment dates instead of relying on a catch-all phrase. Example: “Please produce emergency department records, physician notes, nursing notes, diagnostic reports, imaging files, therapy records, discharge materials, and billing records for treatment from [start date] through [end date].”
Purpose and authority. State that the request is made under the patient's signed authorization for representation in a personal injury matter, without disclosing unnecessary litigation strategy. Attach the authorization and ensure it identifies the information, recipient, purpose, and signature.
Delivery format. Ask for an electronic copy where the records are maintained electronically and the requested format is readily producible. Example: “Please provide the records through your secure electronic delivery system in searchable PDF format, and provide native imaging files where available.”
Receipt and response details. Give the custodian a direct contact, request confirmation of receipt, and ask for the anticipated completion date. Example: “Please confirm receipt and advise whether any additional form, identity verification, or fee information is required.”
Use the attached authorization as a control document, not an afterthought. If the provider has a proprietary form, check whether it must accompany the firm's standard authorization. A letter can be perfectly drafted and still stall if the authorization is unsigned, incomplete, expired, or inconsistent with the requested scope.
The provider should also be able to distinguish treatment records from business-office records. If the case requires both, say so expressly. A request for “the chart” may not reliably capture itemized charges, claim forms, payment histories, or image files maintained in separate systems.
The following video can supplement staff training on request preparation and records workflows:
Authorization Types and Legal Grounds for Release
The efficient method depends on where the case stands and what authority the provider can recognize. A patient-signed authorization is usually the cleanest pre-litigation tool. A subpoena becomes more useful when voluntary production fails or a nonparty custodian must be compelled during litigation. A court order is more formal and may be necessary when relevance, privilege, consent, or sensitive information is disputed.
| Method | Primary Use Case | Key Requirement | Common Challenge |
|---|---|---|---|
| Patient-signed HIPAA authorization | Pre-litigation investigation and voluntary production | Valid authorization identifying the patient, information, recipient, purpose, and signature | Provider insists on its own form, requests clarification, or separates billing and imaging records |
| Subpoena duces tecum | Litigation discovery from a provider or other custodian | Proper procedural issuance, notice, defined scope, and compliance with applicable court rules | Patient or provider objects, moves to limit production, or challenges relevance and burden |
| Court order | Disputed, sensitive, or contested production | Judicial finding or directive authorizing the disclosure | The court may narrow the request, require protections, or review records before broader release |
The patient authorization works best when the client controls the information and the provider is willing to cooperate. It's faster to prepare than a subpoena and avoids unnecessary procedural conflict. Its weakness is practical rather than theoretical. A provider may reject an otherwise sufficient request because the signature, expiration language, recipient, or record description doesn't match its internal requirements.
A subpoena duces tecum is different. It compels production within the scope permitted by the court and applicable rules, but it also creates procedural obligations. The requesting firm must define relevant records, provide required notice, and allow objections. An overbroad subpoena can trigger a motion to quash or a protective-order request, turning a records task into a discovery dispute.
A court order is the strongest intervention when ordinary authorization or subpoena practice doesn't resolve the issue. It's appropriate when the parties disagree about sensitive records, when a provider refuses to release information despite proper process, or when the court needs to balance evidentiary value against privacy. It's rarely the first tool to use for a routine pre-suit chart request because the judicial process adds time and expense.
A signed release is a request for cooperation. A subpoena is a discovery mechanism. A court order is judicial direction. Treating them as interchangeable causes avoidable delay.
Firms should also separate the legal basis from the practical scope. A valid authorization doesn't justify requesting every record ever created if the claim concerns a defined injury. Conversely, a narrowly drafted request can omit records needed to test causation. The right question is not, “Can we obtain this?” It's, “What records are relevant, authorized, and necessary to prove or defend the claim?”
For a deeper review of authorization, subpoena, and privacy issues, see this guide to HIPAA medical records release laws.
Medical Record Request Letter Templates
Templates save time only when they preserve the decisions that matter. Each version below should be placed on firm letterhead, paired with the appropriate authorization, and edited for the provider's identity, record system, treatment dates, and delivery requirements.
General request for a complete treatment file
When to use this: Use this version when the firm needs the full treatment record from a primary hospital, physician, or facility and hasn't yet confirmed which departments maintain relevant materials.
[Date]
Health Information Management Department
[Provider or Facility Name]
[Address]
[City, State ZIP]
Re: Request for medical records for [Patient Full Name], date of birth [MM/DD/YYYY]
To the Records Custodian:
Our firm represents [Patient Full Name] in connection with a personal injury claim arising from [brief description of incident]. Enclosed is the patient's signed authorization permitting release of the requested protected health information to [law firm name] at the delivery address or secure email listed below.
Please produce the complete designated record set relating to the patient's care from [start date] through [end date], including, as applicable:
- Clinical documentation: Intake materials, histories, examinations, physician and provider notes, nursing notes, consultation notes, diagnoses, treatment plans, and discharge records.
- Testing and imaging: Laboratory results, diagnostic reports, radiology reports, and the underlying electronic imaging files where readily producible.
- Procedural materials: Operative reports, anesthesia records, surgical notes, procedure records, and related follow-up documentation.
- Rehabilitation records: Physical therapy, occupational therapy, chiropractic, speech therapy, and other rehabilitation notes, evaluations, attendance records, and progress logs.
- Medication information: Medication lists, prescriptions, administration records, and documented changes related to the requested treatment.
- Financial materials: Itemized statements, billing ledgers, claim forms, payment records, and diagnosis or procedure coding associated with the requested care.
Please provide the records in [requested format] through [secure delivery method]. If any requested category is maintained by a separate custodian, please identify that custodian and advise whether a separate request is required. Please confirm receipt and provide the anticipated completion date. If you believe additional information, identity verification, authorization, or fee arrangements are necessary, contact [name] at [phone] or [email].
Sincerely,
[Attorney or Authorized Representative]
[Law Firm]
[Address]
[Phone]
[Email]
Targeted billing and imaging request
When to use this: Send this version when the medical chart has arrived but the damages file still lacks the financial and technical evidence needed for valuation or expert review.
[Date]
To the Records Custodian at [Provider Name]:
Please supplement the production for [Patient Full Name], date of birth [MM/DD/YYYY], for services provided from [start date] through [end date]. The firm requests:
- Billing detail: Itemized statements, billing ledger, charge history, payment and adjustment entries, payer claims, diagnosis codes, procedure codes, and records identifying the provider responsible for each charge.
- Imaging detail: Radiology reports and the underlying image files for [body region or study], including the available electronic format.
- Clinical cross-reference: The office, emergency, procedural, and therapy notes corresponding to the listed services.
The enclosed authorization covers this request. Please confirm whether these materials are maintained by [provider name] or by a separate billing, imaging, or release-of-information custodian. Produce the materials through [secure channel] and direct questions to [contact information].
Sincerely,
[Signature and firm details]
Request to a third-party custodian
When to use this: Use this letter for a billing company, imaging center, records vendor, or other custodian that may hold records outside the treating provider's primary chart.
[Date]
To [Custodian Name]:
Our firm represents [Patient Full Name], date of birth [MM/DD/YYYY], regarding a personal injury claim. Enclosed are the patient's signed authorization and identifying information. Please produce all records in your custody relating to services provided by or billed on behalf of [provider or facility] from [start date] through [end date].
The request includes [identify exact materials], including itemized invoices, claims, coding detail, payment history, image files, or other electronically maintained records relevant to the identified care. Please state in writing if you don't maintain any requested category and identify the entity believed to maintain it.
Send the production to [secure destination]. Confirm receipt, identify any deficiency, and provide an anticipated completion date.
Sincerely,
[Signature and firm details]
Don't let a template replace a file-specific scope decision. The letter should reflect the injury theory, the providers involved, and the evidence needed for the next litigation event.
Strategic Drafting for Personal Injury Cases
A generic “send all records” request is often too blunt for PI litigation. It may produce a large PDF while missing the discrete evidence that explains when symptoms began, how treatment progressed, what services were billed, and whether the imaging supports the diagnosis. MyChartCount's guide to medical record request templates identifies this gap between generic forms and requests for specific evidence such as itemized claims or electronic files.
The request should follow the proof problem. Causation, damages, prior condition, and treatment necessity each point toward different records.
Build the injury chronology
Emergency intake forms and first examination notes may capture the patient's initial complaints, mechanism, functional limitations, and prior symptoms. Later provider notes can show whether those complaints persisted, changed, or resolved. Ask for intake questionnaires, triage notes, nursing observations, referral records, and provider-to-provider communications when those materials are maintained.
A surgical report answers what happened in the operating room. It may not answer what the patient reported before admission, what conservative care failed, or how function changed during rehabilitation. Request the surrounding records, including preoperative assessments, postoperative notes, therapy logs, and discharge instructions.
Request evidence in its usable form
An imaging report is not the same as the imaging study. If an expert needs to evaluate the film, request the underlying electronic image files, not only the radiologist's interpretation. State the preferred format and ask the provider to identify any separate imaging custodian.
Billing requires similar precision. Ask for itemized statements, claims, diagnosis codes, procedure codes, adjustments, and payment records when the file requires a damages review. Coding and ledger detail can help reconcile what the clinician documented with what the facility billed.
The record category should answer a litigation question. If the question is whether treatment was necessary, request the clinical rationale and the billing evidence, not merely the final invoice.
Address pre-existing conditions without overreaching
A targeted historical request can reveal baseline function and prior complaints relevant to the claimed injury. It can also prevent the defense from presenting an incomplete prior-history narrative. Limit the dates and categories to what the claim makes relevant, and coordinate the scope with the authorization and governing discovery rules.
The same principle applies to treatment gaps. Don't assume a gap means noncompliance or recovery. Request follow-up notes, referral records, scheduling materials when available, and later histories that may explain a change in provider or treatment plan.
A strong request therefore reads less like a form and more like an evidence plan. It gives the custodian clear categories while preserving enough context to capture chronology-defining materials.
Navigating HIPAA Timelines Fees and Compliance
The federal access timeline begins when the covered entity receives a valid request. Under the HIPAA Privacy Rule, the provider must act within 30 calendar days, and it may take one additional 30-day extension only if it gives the patient a written explanation for the delay and a new completion date within the initial response period, according to HHS's official access guidance.
That framework provides a well-drafted letter with a strong basis, but only if the firm can prove receipt and identify what the provider received. Save the letter, authorization, attachments, transmission confirmation, and any deficiency notice in the case file. The response clock is difficult to enforce if the firm can't establish the starting point.
Separate delay from deficiency
A provider's request for clarification may mean the submission wasn't validly processable. Missing identifiers, an inconsistent patient name, an absent signature, or an unclear recipient can cause the records department to pause rather than produce. Correct the deficiency promptly, but document whether the provider treated the submission as received or required a new request.
If the provider invokes an extension, look for both required elements: a written explanation and a new completion date. A vague statement that the records department is busy doesn't give the firm a useful production commitment. The letter should request written confirmation so the file reflects the provider's position.
Review fees instead of accepting them automatically
Providers may charge reasonable, cost-based fees for permitted access-related copying and delivery work. A firm should ask for an itemized invoice when charges are unclear, especially when the request includes multiple categories or separate custodians. Confirm whether the invoice covers paper copies, electronic production, certification, postage, or a service that the provider treats separately.
Pushback should be precise. Ask the vendor to identify the records produced, the fee basis, and any portion attributable to an optional service. Don't delay a needed production over a minor question, but don't let an unexplained invoice become the default case cost either. The practical distinctions are discussed in this guide to medical records fees.
Protect the information after receipt
HIPAA compliance doesn't end when the PDF arrives. Store records in the firm's approved secure system, restrict access by role, preserve the original production, and track supplemental records separately. If the provider sends an unsecured or misdirected production, notify the appropriate contact and follow the firm's incident protocol.
The operational goal is not merely to obtain records. It's to obtain the right records, within the applicable process, at a documented and defensible cost.
Best Practices for Request Tracking and Follow-Up
A request that isn't tracked becomes a silent case risk. Use a request log with fields for provider, custodian, patient identifiers, scope, authorization status, transmission method, receipt confirmation, response deadline, extension notice, invoice, production status, and missing categories.
Start with a pre-dispatch audit:
- Confirm the provider: Verify the current records department address, secure fax, portal, or vendor destination.
- Match the authorization: Ensure the patient name, recipient, scope, signature, and date align with the letter.
- Define the deliverable: Record whether the request seeks clinical notes, billing, imaging, therapy materials, or a complete file.
- Preserve proof: Save the outgoing package and evidence showing when the custodian received it.
Call the records department after dispatch to confirm that the request reached the correct queue. Ask for the custodian's name, the internal reference number, whether the authorization is acceptable, and whether another department holds billing or imaging materials. A short confirmation can prevent weeks of waiting at the wrong destination.
A follow-up email can stay firm without becoming argumentative:
Subject: Request confirmation and production status, [patient name], [provider]
We're following up on the medical records request received by your office on [date]. Please confirm whether the request and authorization are complete, identify any missing information, and provide the anticipated production date. If an extension is being used, please send the written explanation and new completion date.
If the response is incomplete, don't send a vague second request. Identify the missing categories in a short supplement: “The production includes office notes but does not include the itemized billing ledger, diagnostic image files, or physical therapy logs requested in the original letter.” Attach the original scope and ask the provider to confirm whether those materials are held elsewhere.
For firms handling a growing caseload, staffing and delegation matter as much as software. A documented process helps managers assess whether they need more retrieval capacity, and resources on mastering paralegal recruitment can help firms think through role design and hiring for operational support. The firm's system should make ownership visible, so every open request has a responsible person and a next action.
For practical retrieval workflow guidance, review getting medical records. The best tracker is the one staff update after every call, invoice, receipt, and supplemental production.
Frequently Asked Questions About Medical Record Requests
How should a firm request records for a minor?
Start by identifying the person legally authorized to act for the minor under applicable state law and provider policy. The authorization should identify the minor, the authorized representative, the provider, the requested information, the purpose, and the recipient. Include documentation the provider reasonably requires to verify representative authority, and ask in advance whether the facility uses a separate minor-release form.
Keep the scope tied to the injury claim. If the case involves prior treatment or a disputed condition, explain the relevant date range and record categories rather than requesting unrelated sensitive information.
What changes when the patient is deceased?
The firm should identify the personal representative, executor, administrator, or other legally recognized person with authority to access the decedent's records. Attach the documentation establishing that authority and confirm whether state law or the provider requires an estate-specific authorization.
A family relationship alone may not satisfy the custodian. The request should also explain the legal purpose, identify the claim or estate matter, and distinguish records needed for the injury investigation from unrelated medical history.
What should counsel do if the provider refuses?
Ask for the refusal in writing and require the provider to identify the specific deficiency or legal basis. Review the authorization, patient identifiers, scope, recipient, and delivery request before resubmitting. If the provider says another entity maintains the records, request the custodian's name and contact information.
If voluntary cooperation fails during litigation, counsel can evaluate subpoena practice, notice requirements, and protective measures. If the dispute concerns sensitive records or competing privacy interests, a court order may be appropriate. Don't respond to a refusal with a broader fishing expedition. Narrow the request to the evidence tied to the claim and preserve the correspondence.
How should mental health or substance-use records be handled?
Treat them as a separate sensitivity analysis, not as ordinary chart material. These records may carry additional federal or state protections, and a general authorization may not be enough for every category. Determine whether the information is relevant to causation, damages, or an asserted defense, then use the specific authorization, notice, subpoena, or court process required in the jurisdiction.
Where appropriate, request protective treatment, redaction, limited disclosure, or in-camera review. Counsel should avoid placing sensitive records into a broad production merely because the patient's medical history is generally relevant.
Can a patient request records through a portal instead?
Yes, portal access can be useful for quickly reviewing information the provider makes available online. It shouldn't replace a formal request when the case needs defined date ranges, billing materials, underlying imaging files, separate custodians, or a documented production scope. The letter gives the firm a precise record of what it requested and how the provider was asked to respond.
What if the records arrive incomplete?
Compare the production against the request line by line. Create a missing-records list organized by category, date range, and likely custodian. Send a targeted supplement, ask the provider to confirm whether the omitted records exist, and preserve the response.
A missing category can change the legal analysis. Absent billing detail may affect damages, while absent intake or imaging material may affect causation and chronology. Treat completeness review as part of retrieval, not as a task postponed until demand drafting.
Ares helps personal injury firms organize medical records by extracting treatment dates, diagnoses, providers, and symptom chronology, then supports medical overviews and demand letter drafts from the case materials. Visit Ares to see how your team can turn a documented retrieval process into case-ready medical analysis.
