Records Request FAQ

Explanation of HIPAA

Q: Where do I find how long a facility has to keep records by state?

You may visit this site to find out how long a facility must keep records. Typically, it is 7 years. However, it is not uncommon for facilities to keep them much longer. If the facility has not destroyed your records, they are still legally required to provide them at your request.

Q: How do I know if I have gotten my full records?

Check with other survivors of your facility and inquire if they have received similar documents. The amount of time you were there should correspond with how many documents you receive. Historically, we have observed survivors receiving thoughts of pages of records from more intensive residential treatment centers. However, if you were in a facility for a year and you only received basic intake, discharge, and school transcripts, you may not have received your full record. If you suspect you have not received your complete records, you may file a HIPAA complaint.

Q: Can a facility refuse to provide records in an electronic format?

Most of these programs arguably have the resources to store records in an electronic format. It is typically a lower cost for them to maintain electronic medical records than paper records. Where an individual requests an electronic copy of records from a covered entity that maintains only on paper records, the covered entity is required to provide the individual with an electronic copy if it is readily “producible electronically” – meaning the covered entity can readily scan the paper record into an electronic format.  If a program refuses to provide you with electronic documents, you may need to inform them of this to pressure them adhere to their legal obligation. If they refuse, you may file a HIPAA complaint.

Q: Can a facility ask for a copy of my driver’s license or other measures in order to verify my identity?

Yes, HIPAA allows for facilities to verify an identity through a variety of ways, with a driver’s license being one of them. After all, you don’t want your records to be provided to just anyone that requests them. They may also request that you verify your identity orally, through writing, or by filling out a form that they provide.

Q: How much can they charge?

A program can only charge “reasonable, cost-based fees.”  For a better understanding of what that could look like, please check out this website. Please keep in mind it may be slightly out of date. If they are charging an extreme amount, you should try to first negotiate a more reasonable amount (including by informing them that you already paid thousands of dollars in tuition), and if unsuccessful, you can file a HIPAA complaint.

Q: How should I pay?

Most facilities have a way to pay by credit card or check. However, you should never send a photo of a credit card through email to the facility. If you would like to pay by phone and do not want the facility to have your credit card number, you may also use a prepaid credit card to prevent the facility from having your financial data.

Q: How long do they have to do it?

Programs have 30 days from the receipt of your request to send your records. They may request one extension which is allowed in some states but they must first make you aware of the extension. Typically, this extension only extends the deadline to 60 days from the date of the request. If they have not shipped/sent your records within 30 days and have not notified you of an extension or have denied/ignored your request, you may file a HIPAA complaint.

Q: Am I able to get access to therapy notes?

It is typical that a program may only retain therapy progress notes which you do have a right to. If a therapist jotted down private notes that were kept separate from your records, you may not be able to request them. However, in our experience, separate notes may not exist.

Q: What do I do if the facility tries to deny access to my records/progress notes by stating that they believe me seeing my records will cause emotional harm?

Some facilities have requested survivors to first request a note from their therapist or waive the facility of liability in return for releasing therapy progress notes. This is a HIPAA violation. Facilities can only deny access to records if they believe that the information would be reasonably likely to endanger the life or physical safety of someone. A survivor being upset from seeing their records does not qualify for this. You may file a HIPAA complaint to request a review of the denial.

Q: What do I do if the facility denies access to my records/progress notes by stating that they believe that releasing the records will physically endanger someone?

Facilities are only allowed to use this stipulation when they truly believe someone will be physically injured or die as a result of the records being released. You may file a HIPAA complaint to request a review of their denial.

Q: What does a normal HIPAA release look like?

A program will not typically require you to sign a HIPAA release form to get access to your own records. If they do, read the document thoroughly to ensure that the release only pertains to the disclosure of records and nothing else. This is an example of what a HIPAA release form may include.

Q: Can I still get my records if I have been gone longer than they were required to keep them?

If a program still physically has the records, they are required to give them to you. If they destroyed them, you may ask for a record of destruction which should specify when and how your records were destroyed.

Q: Can I still get my records if the facility has closed?

It is possible. It is even more likely if you were at the program within the last seven years as the records should not have been destroyed during that timeline. If the facility has a parent company, you may contact them to ask about records requests. If the facility was shut down by law enforcement, contact the law enforcement agency that shut them down to ask if your records were seized. If the facility has rebranded and is under a different name, contact the currently open facility to ask if they have them.

Q: What do I do if the facility says they have lost the records, destroyed them, or will not release them even though I am within the time limit for records retention?

This may be a violation of the law and you may file a HIPAA complaint.

Records are an incredibly important piece of evidence. They can provide evidence of poor quality of care such as a lack of licensed therapists, over medication, excessive use of isolation, improper use of restraint, neglect, harassment, or discrimination. If you see anything questionable in your records that may be evidence of neglect or abuse, you may contact an advocacy organization for support and/or contact an attorney.

Records are an incredibly important piece of evidence. They can provide evidence of poor quality of care such as a lack of licensed therapists, over medication, excessive use of isolation, improper use of restraint, neglect, harassment, or discrimination. If you see anything questionable in your records that may be evidence of neglect or abuse, you may contact an advocacy organization for support and/or contact an attorney.