Medical Records Request Letter From Attorney Template for the United States

When a legal case turns on medical evidence, you need a HIPAA records request letter that complies with both federal HIPAA rules and state medical records laws in the United States. This sample gives an attorney or law firm a formal way to request medical records from a hospital, clinic, doctor's office or other healthcare provider while protecting patient privacy and meeting authorization standards.

What does a HIPAA records request letter sample include?

A complete sample identifies the patient and the sender clearly, so the provider can act without follow-up. Most letters contain the following:

• The patient's full name, date of birth, and any prior names, so the provider can locate the correct file.
• The sending law firm or business name, along with a contact name, phone number and email address for the response.
• A description of the content requested, such as treatment notes, test results, diagnostic reports, imaging, discharge summaries and billing statements.
• Specific date ranges or departments, so the request is neither too broad nor too narrow.
• A signed HIPAA authorization from the client, or a reference to a subpoena or court order that supports the request.
• The delivery format requested, whether paper copies sent to a home or office address, a secure email, or an electronic health record export.

What does a sample HIPAA request look like?

Here's how a short opening might read in practice: "Please release the complete medical records for [Patient Name], date of birth [MM/DD/YYYY], for treatment dates January 2024 through December 2026. Enclosed is a signed HIPAA authorization consistent with your office's privacy policy. Kindly include a summary of care, test results, diagnostic codes and billing statements from the treating physician." Adjust the scope, date ranges and record types to fit your case. You can pair this with a signed next-of-kin affidavit for medical records when a family member is authorizing access on a patient's behalf.

When do you need this letter?

You'll need this letter whenever your legal work requires access to medical records for case preparation or evidence gathering. Personal injury attorneys use these requests to obtain treatment records, diagnostic reports and medical opinions that support damage claims. Workers' compensation matters need detailed documentation to establish work-related injuries and treatment histories. Disability benefit claims depend on comprehensive records to demonstrate qualifying conditions and functional limitations. Medical malpractice matters need extensive records to identify potential negligence or standard-of-care questions. Family law proceedings may need records to address custody considerations or support modification requests. In an emergency, a provider may release limited information under separate HIPAA rules, but a formal authorized request is still the route to a full file.

How do you write and send the request?

Address the letter to the provider's health information management or records department, since that is where release requests are processed, whether the provider is a hospital, a clinic or a single physician's office. State the client's full name, date of birth and identifying details near the top, then set out the specific content and date ranges you need. Attach the signed HIPAA authorization, and include a contact name, phone number, email and mailing address so the provider can reach your business with questions or to confirm any fee. A courteous "please respond within your standard timeframe" line and a self-contained letter reduce back-and-forth and speed the response.

How long does a provider have to respond?

Under HIPAA, a covered provider generally must act on a request for access within 30 days, with one 30-day extension allowed if the patient is notified. Many states set shorter response times for their own residents, and some cap the fees a provider can charge for copies. Building a realistic turnaround into your case timeline helps, since a large file or records held at an off-site storage center can take longer to retrieve than records in an active office.

What to do when the records arrive

Once you receive the file, confirm the provider sent the full scope you asked for, since partial releases are common when a request spans several departments or date ranges. Review the records against your request, check that treatment notes, test results, diagnostic reports and billing statements are all present, and flag any gaps for a follow-up letter. A short intake step like this lets your team catch missing pages early rather than during a deadline crunch, and keeps the service a client expects running on schedule.

Key legal considerations

Your request must include a valid HIPAA authorization signed by your client that specifically identifies the information being requested and the purpose for disclosure. The letter should state the legal basis for the request, whether through client authorization, subpoena, or court order. Include precise descriptions of the records needed, such as date ranges, types of treatment, test results, diagnostic codes, or particular departments. Certain mental health, substance abuse, and HIV-related records may require additional authorizations beyond standard HIPAA compliance. Healthcare providers can charge reasonable copying and administrative fees, but these must comply with state limitations on per-page costs. If the provider has no responsive records, an affidavit of no records can confirm that in writing for your file.

Legal requirements in the United States

Under federal HIPAA rules, specifically 45 CFR 164.508, your authorization must contain a description of the information to be disclosed, identification of authorized recipients, an expiration date, and the patient's signature. State laws often add mandatory response timeframes, typically ranging from 15 to 30 days depending on jurisdiction. Many states set record retention periods and cap copying fees at statutory maximums. Each provider also maintains its own notice of privacy practices under HIPAA, and your request should reference the terms and authorization form the provider accepts. Your letter must also comply with state bar association rules on client confidentiality and proper handling of protected health information. Some jurisdictions require special language for certain records or have unique provisions for electronic health record requests.