Call Today (919) 491-5643 or Email

The HITECH Act – a new tool for attorneys seeking medical records (updated 9/13/18).

//The HITECH Act – a new tool for attorneys seeking medical records (updated 9/13/18).

The HITECH Act – a new tool for attorneys seeking medical records (updated 9/13/18).

Disability attorneys, workers compensation attorneys and personal injury attorneys spend thousands of dollars each year obtaining the medical records of their clients. Historically, attorneys have used a HIPAA authorization to obtain these records.

HIPAA (the Health Insurance Portability and Accountability Act of 1996) has a Privacy Rule that gives individuals the legal right to obtain copies of their medical records. This Rule requires HIPAA covered entities to provide individuals, upon request, with access to the protected health information about them in one or more “designated record sets” maintained by or for the covered entity. A “designated records set” is defined at 45 C.F.R. 164.501 as a group of records maintained by or for a covered entity.

The Health Information Technology for Economic and Clinical Health Act, known as the “HITECH Act”, provides a new method to obtain medical records at substantial cost savings. Pursuant to 42 USC 17935 (e) (1), if a covered entity maintains electronic health records

“. . . the individual shall have a right to obtain from such covered entity a copy of such information in an electronic format and, if the individual chooses, to direct the covered entity to transmit such copy directly to an entity or person designated by the individual, provided that any such choice is clear, conspicuous, and specific, . . .”

Obtaining medical records via a HITECH request has three important advantages over using a HIPAA authorization.

1. Simplicity. The HITECH request must

(i)   be in writing;

(ii)  signed by the Client;

(iii) identify the attorney and where to send the records.

Click on HITECH Records Request to see a sample request. The necessary wording of a HITECH request is much simpler than the necessary wording of a HIPAA authorization.

2. Time Deadline. The covered entity must respond to a HITECH request within 30 days after the request is received. See 45 CFR 164.524 (b) (2) (i). The HIPAA authorization does not have a time deadline.

3. Fees. The fees a covered entity can charge to respond to a HITECH request are strictly limited by 45 C.F.R. §164.524 (c) (4). In most cases, the fee cannot exceed $6.50. See  HHS FAQ 45 CFR 164.524 at page 15. This fee limitation applies to any vendor hired by the covered entity to respond to the HITECH request. See  HHS FAQ 45 CFR 164.524 at page 13. Further, the HITECH Act is a federal law that supercedes all State laws pertaining to the cost of medical records.


A HITECH Records Request has two important limitations attorneys should be aware of. First, it ONLY applies to electronic records. If the health care provider only maintains paper records, the HITECH request does NOT apply. Second, psychotherapy notes are exempt from a HITECH Records Request. See 45 CFR 164.524 (a) (1) (i).


If the HITECH request is denied, I suggest you call the medical records supervisor. My experience has been a phone call is often necessary, and most of the time prompt compliance occurs.

If the call does not resolve the issue, I suggest you send a detailed letter with citations to the relevant authority, with attachments of the relevant authority, with a 10 day deadline for a response. Click on “Response to Denial of HITECH Request” for a sample letter.

If that letter does not work, I suggest you file a complaint with the Office of Civil Rights (OCR) in the US Dept of Health & Human Services. See .

Practice Tips.

1.  The individual, NOT the health care provider, gets to choose the method for obtaining medical records. See  45 CFR 164.524 (b) (1) and (c) (2).

2.  The attorney should NOT send a HIPAA authorization with the HITECH request. The HIPAA authorization might give the covered entity a basis to disregard the HITECH fee limitation.

3. Some vendors such as MRO argue that the fee limitation under the HITECH Act does not apply to requests made by third parties such as law firms. This argument is valid if the attorney requests medical records using a standard Release form.

However, the HITECH form I use is a request from the patient (not the attorney) to the covered entity. Further, 42 U.S.C. §17935 (e) (1) specifically allows the patient to direct the covered entity to transmit records to any person designated by the patient. In a few instances, it has been necessary to mail the HITECH request, with no other documents, to the covered entity in an envelope with the patient’s return address.

Authorities. The Federal legal authority for a HITECH Records Request can be read and downloaded by clicking on the documents below.

42 USC 17935.

45 CFR 164.524.

HHS FAQ 45 CFR 164.524.

Federal Register Vol. 78, No. 17, pgs. 5631 – 5637.

Sample Forms.  Sample forms can be read and downloaded by clicking on the documents below.

HITECH Records Request.

Attorney Letter.

Response to Denial of HITECH Request.

This Article was updated by David Paletta on September 13, 2018.

By |2018-09-13T19:51:40+00:00September 13th, 2018|Disability Law Blog|2 Comments


  1. Jarrett May 23, 2018 at 7:21 pm - Reply

    Very interesting article. Out of curiosity, how does Webb v. Smart Document Sols., LLC, 499 F.3d 1078, 1080 (9th Cir. 2007) interact with your method. Is it that your model includes the client making his own request, which is merely forwarded to the provider by the attorney’s office?

  2. Attorney Johns August 15, 2018 at 5:05 pm - Reply

    Thank you for sharing this information Attorney Paletta. I have run into my first roadblocks in utilizing a HITECH request for a client, and I expect your advice will help to ensure compliance. (Surprising that a nearly 10-year old federal law is still so difficult to enforce, no?)

    – Attorney Johns (Connecticut)

Leave A Comment