A medical records request is the process of requesting access to a client’s protected health information (PHI) or medical records. This requires a Release of Information (ROI).
An ROI is a document that allows a patient to authorize what information is released from their medical record, who receives the information, how long it can be released, and under what guidelines.
This article covers:
Requesting medical records
Rula is the custodian of patient records, and providers are prohibited from releasing medical records to patients. Patients can request a copy of their records directly from Rula, and have their request fulfilled by our partner, Datavant.
- For client-initiated requests, provider authorization is required—learn how to review client medical records requests below.
If you need to request patient records, the first step is to request an ROI, which will begin the process to access records. Rula’s internal team fulfills provider-initiated requests.
Requesting an ROI for your clients
Follow the steps below to complete an ROI request form. From there, our Records team will assist by sending your patient an email to obtain their electronic signature on a release form that authorizes their provider to release patient-specific information to others.
- From the provider portal, click the Resources tab.
- Under Documents and forms, find the release of information request form.
- Note: You can also find this form on our medical records request page, by clicking Get started and selecting Rula Provider.
- To initiate the request, complete all required fields—this will ensure your request can be processed more efficiently.
- It’s recommended to complete this form during a session with the patient when possible.
- Our Records team will email the client to sign a release form electronically. Once completed, we’ll upload the signed ROI and inform you once the process is complete.
- You can find the signed form in the provider portal by opening the client’s chart and clicking the Notes & Documents tab—it will be listed under “Documents” on the right.
- Keep in mind that ROIs can take 14 – 30 days to process, but most are processed sooner.
When an ROI is needed
Generally speaking, you'll need a signed ROI from the client to correspond with an external party that is not a covered entity (e.g. a school, case worker, probation officer, attorney, etc.).
- Authorization to Release Patient Information Policy: Learn more about the process for the use and disclosure of protected health information (PHI) pursuant to written authorization.
You don’t need an ROI to:
- Communicate with another healthcare provider—a physician, another therapist or psychiatrist, hospital staff, etc.—to coordinate care for a shared patient, both within Rula and externally.
- More on this: The HIPAA Privacy Rule allows healthcare providers to coordinate care without a client's authorization when connecting with another healthcare provider. These communications are covered under Treatment, Payment, and Operations (TPO). TPO also allows healthcare providers to make a referral to connect the client with services or resources or communicate with an insurance company without an ROI.
- Release information to the client for things like letters or paperwork (e.g. disability letters) you've completed at the client's request.
- Speak with a parent/guardian of a client for anyone who is aged 17 and younger.
- More on this: Unless a biological parent’s rights have been terminated or there is information in the minor client’s record that could reasonably be harmful to the minor child if the information was released, both biological parents will have the right to access the minor client’s medical records regardless of who signed consent for the minor. Please review the Medical Records section of Rula's Clinical Quality Practice Guidelines for Minors for more information.
- To meet a client’s request to talk with a partner, relative, or friend. In these situations, document the request in your note and confirm you obtained verbal consent from the client.
- To have someone else join a session at the client's request. Document the circumstance in your note to specify the client AND guest provided verbal agreement.
- More on this: Please review the Rula Agreement for Guest Participation for more information.
Reviewing client medical record requests
We partner with Datavant, a leading vendor in the healthcare industry, to securely process and fulfill medical record requests from patients.
For patient-initiated requests, HIPAA requires that we confirm with you, as the provider, that releasing the records would not pose a risk to the patients or others. This verification step is now managed by Datavant.
Provider verification for client requests for records
- You may receive outreach directly from a Datavant team member, which will come from the rula@datavant.com inbox.
- Please respond to them within three business days whenever possible to ensure timely fulfillment.
Updated