Need to Know
Review request guidelines, acceptable documents, turnaround times, privacy information, and common questions.
What governs a records request?
The documents and review steps depend on who is asking, the records involved, and the legal basis for disclosure. Use the checklist below for your request type.
Patient access
Under 45 CFR 164.524, individuals generally have a right to access information in their designated record set. A covered entity generally must act within 30 calendar days, with one permitted 30 day extension and written notice when needed.
HHS right of access guidanceAuthorization & representatives
Disclosures requiring an authorization must meet the elements in 45 CFR 164.508. A personal representative’s authority is verified under 45 CFR 164.514(h); their access depends on the scope of that authority and applicable law.
HHS personal representative guidanceSubpoenas & court orders
A court order and a subpoena without a court order follow different HIPAA conditions. For a subpoena without an order, satisfactory assurances of notice or a qualified protective order may be needed under 45 CFR 164.512(e).
HHS judicial proceedings guidanceSubstance use disorder records
Records covered by 42 CFR Part 2 have additional confidentiality rules. Whether they apply and what consent or other authority is needed must be reviewed for the specific records and request.
HHS Part 2 guidanceThese summaries explain federal rules and do not determine whether a particular request may be released. State law and the records’ circumstances can add requirements.
What we require before processing
These are NovaCore intake and verification steps. They are separate from the federal rules above. The exact supporting documents depend on the requester type and the records involved.
We collect the requester’s name and contact information. Patient, representative, and guardian requests currently include front and back ID upload for identity verification.
We review the signed authorization, representative authority, court order, subpoena materials, or other applicable basis. Upload the document you rely on; submitting a document does not itself authorize release.
We need the facility, facility state, patient name, and date of birth to locate and compare the correct record. Discrepancies may pause processing for clarification.
Choose the record types and a date of service range or preset. Bulk requests need a chart list with patient names and dates of birth for each row.
Choose a delivery method and provide its destination when applicable. We review recipient details before records are made available.