Records requests from attorneys and retrieval companies: HIPAA rules

A practice releases records to an attorney, record retrieval company or life or disability insurer on the patient's valid HIPAA authorization, the patient's signed direction to send an electronic copy, a court order or a subpoena that meets 45 CFR 164.512(e). A requester's letter is not enough, and HIPAA sets no deadline or fee cap for authorization releases.

A patient's own request for a copy runs on different timing and fee rules, laid out in how to respond to a patient's medical records request by fax.

Can a practice fax medical records to an attorney or a record retrieval company?

A practice can fax medical records to an attorney or a record retrieval company once the patient's valid HIPAA authorization, the patient's signed direction to send an electronic copy, a court order or a subpoena that meets 45 CFR 164.512(e) authorizes the release. The requester's own letter does not take the place of any of the four. An authorization releases only the information it describes, to the people it names, until the expiration date or event it states.

Who asks for records, and on what authority?

An attorney, a record retrieval company, a court, a workers' compensation carrier, Social Security and a life or disability insurer each ask a practice for records on a different authority, which the table lists by requester.

Subpoenas and court orders carry conditions of their own, laid out in whether you can fax medical records on a subpoena. Requests from a patient's own health plan are a separate case, covered in whether you need patient consent to fax medical records.

What makes a HIPAA authorization valid, and what voids it?

A HIPAA authorization needs the core elements of 45 CFR 164.508(c)(1) and fails on any of the five defects in 164.508(b)(2). The core elements are:

• The information. A description that identifies the information to be disclosed in a specific and meaningful fashion.
• Who discloses. The name or other specific identification of the person or class of persons authorized to make the disclosure.
• Who receives. The name or other specific identification of the person or class of persons to whom the practice may make the disclosure.
• The purpose. A description of each purpose; "at the request of the individual" is enough when the patient starts the authorization and gives none.
• The expiration. An expiration date or an expiration event that relates to the patient or the purpose.
• The signature. The patient's signature and date, plus a description of the representative's authority when a personal representative signs.

Paragraph (c) also lists required statements, and what a HIPAA authorization must include sets them out. Any of these five defects voids an authorization:

• Expired. The expiration date has passed, or the practice knows the expiration event has occurred.
• Incomplete. A required element in paragraph (c) was not filled out completely.
• Revoked. The practice knows the patient revoked it.
• Improperly combined or conditioned. It violates the compound-authorization or conditioning rules in 164.508(b)(3) or (4).
• False. The practice knows material information in it is false.

The practice must document and retain every signed authorization as 45 CFR 164.530(j) requires, which means six years from the date of its creation or the date it last was in effect, whichever is later. A release made under an authorization is excepted from the patient's right to an accounting of disclosures (45 CFR 164.528(a)(1)(iv)).

How do you verify who is asking?

A practice verifies the identity of a person who requests protected health information, and that person's authority to have it, whenever the practice does not already know them (45 CFR 164.514(h)(1)(i)). The authorization does most of the work: the recipient it names must match the attorney or company asking, the patient's signature and date must be present, and a personal representative's signature needs a description of that representative's authority.

A record retrieval company acts for a law firm or an insurer, so the authorization has to name the company as a recipient or name a class of persons that includes it. The Privacy Rule does not require the original form: SSA's HIPAA fact sheet says providers may accept a photocopy, scan or fax of a signed authorization.

What do you send, and what stays out?

A practice sends the information the authorization describes, and psychotherapy notes stay out unless the patient signed an authorization written for them. Under 45 CFR 164.508(a)(2) a practice must obtain an authorization for any use or disclosure of psychotherapy notes, with the exceptions that paragraph lists, and under 164.508(b)(3)(ii) that authorization may be combined only with another authorization for psychotherapy notes.

Minimum necessary does not limit a release made under an authorization (45 CFR 164.502(b)(2)(iii)), so the authorization's own description of the information sets the scope. A court order sets its own limit: the practice discloses only the information the order expressly authorizes (164.512(e)(1)(i)).

What can you charge, and how fast must you answer?

HIPAA sets no deadline and no fee cap for a records release that runs on a patient's authorization, so a deadline or fee limit, where one applies, comes from state law. The Texas Medical Board shows what a state rule looks like: physicians must respond within 15 business days of receiving a written request, including a request to send records to a third party with proper written authorization.

The Texas Medical Board's rules define a reasonable fee for paper copies as no more than $25 for the first twenty pages and $.50 per page for every copy thereafter. The Board's limit for electronic copies is $25 for 500 pages or less and $50 for more than 500 pages. A Texas physician may not charge a fee for a medical or mental health record when the request relates to a benefits or assistance claim based on the patient's disability. Other states set their own rules.

The cost-based fee in 45 CFR 164.524(c)(4) is the patient's own rate: it covers only labor for copying, supplies, postage and an agreed summary or explanation, and it applies when the individual requests the copy. HHS says in its 2021 proposed rule that the Ciox v. Azar court found the Department had improperly imposed those limits on the right to direct a copy to a third party without notice and comment rulemaking.

How do workers' compensation, Social Security and insurance requests differ?

Workers' compensation, Social Security and life or disability insurance requests differ in what lets the practice send: workers' compensation law, the patient's signed Form SSA-827, or the patient's valid HIPAA authorization.

For workers' compensation, 45 CFR 164.512(l) permits a practice to disclose protected health information as authorized by and to the extent necessary to comply with laws relating to workers' compensation and similar programs that pay benefits for work-related injury or illness without regard to fault. The workers' compensation law that applies sets how much the carrier may request.

For Social Security, Form SSA-827, Authorization to Disclose Information to the Social Security Administration, is good for 12 months from the date signed, so the practice checks the date signed before it sends. A life or disability insurer gets records on the patient's valid HIPAA authorization, with the same core elements and defects as any other, and the permission ends on the authorization's expiration date or event.

How do you send records for third-party requests from a HIPAA fax account?

A practice answers a third-party records request from a HIPAA fax account by sending the records to the recipient the authorization names, then filing the delivery proof beside the signed authorization. On a paid Fax Pigeon plan, requests and authorizations arrive at the practice's own number, and each one can be assigned from the shared inbox to the person who handles records. Every delivered fax gets delivery proof, a cover sheet is optional, and adding people costs nothing. Basic covers 200 pages a month, sent plus received, for $4.99 a month billed annually, with a BAA signed at signup.

* Official sources (Cornell Legal Information Institute (45 CFR Part 164), Federal Register, Social Security Administration, Texas Medical Board) were read on October 23, 2026. Fax Pigeon prices and plan terms as of October 24, 2026.