Health Care Records Requests Policy

Effective: 1/28/2026

To whom this policy applies

Anyone with access to health care records who would be responsible for handling requests for records at non-HIPAA covered entities.

Definitions

• Health care records: Reports, notes, orders, photographs, X-rays or other recorded data or information whether maintained in written, electronic or other form which is received or produced by a provider of health care, or any person employed by a provider of health care, and contains information relating to the medical history, examination, diagnosis or treatment of the patient.

Purpose/Background

The purpose of this policy is to establish a clear and compliant process for responding to health care records requests at the UNR Med. This ensures adherence to legal, ethical, and institutional requirements while protecting patient privacy and confidentiality.

Policy

1. Standard Operating Procedure
   1. Official Authorization Request Form
      1. All medical record requests must be submitted using the Authorization For Request of Medical Information Form.
      2. The form must be signed by the patient or a legally authorized representative (parenUguardian, power of attorney, executor). If signed on behalf of a patient, documented authority must be provided.
   2. Submission Process
      1. Requests for records must be submitted via email to: compliance@med.unr.edu
      2. After a request is received, the request and authorization forms must be submitted to UNR Med Office of General Counsel for review and confirmation that the authorization form is complete. After review and confirmation, the request shall be processed by the UNR Med Privacy Officer.
      3. Under no circumstance should medical students, residents, or physicians directly release or respond to health care records requests. Timely refer any such requests to compliance@med.unr.edu
   3. Identity Verification
      1. If a request is submitted via email, verify identity of requestor by comparing the completed written authorization form to patient record.
      2. Third-party requests require both a signed authorization form completed by the patient, and verification of the thirdparty requester's authority to receive the requested records.
   4. Response Time
      1. The standard response time for processing records requests is 10 business days from receipt of the completed authorization form.
   5. Fee Schedule
      1. Actual cost of postage if documents are mailed to requestor.
      2. $0.60 per page, pursuant to NRS 629.061.
      3. Electronic records: $5.00 flat fee pursuant to NRS 629.062.
      4. Waivers: Fees may be waived for individuals unable to pay, based on financial need.
   6. Responsibility
      1. Response will be provided by UNR Med Privacy Officer only.
      2. All actions will be documented for compliance and audit purposes.
   7. Documentation & Recordkeeping
      1. All requests will be logged in the Medical Records Request Log, maintained by the UNR Med Privacy Officer, with the following details:
         • Date received
         • Requester name
         • Verification steps completed
         • Type of request (paper/electronic)
         • Action taken and completion date
      2. Copies of authorization forms and correspondence will be retained in UNR Med compliance files.
   8. Denial of Requests
      1. Requests may be denied under the following conditions:
         • Failure to provide a complete and valid written authorization form
         • Inability to verify the identity of the individual making the request
         • Insufficient proof of authority to receive requested records
         • Records not maintained by UNR Med
         • Access to the requested record is reasonably likely to endanger the life or physical safety of the individual or another person.
      2. Written notice of denial, including reasons will be provided by the UNR Med Privacy Officer.
   9. Method of Transmission
      1. Health Care Records may be transmitted only through one of the following methods:
         • Providing the requestor access to the records through the EHR patient portal; or
         • U.S. mail, in a sealed envelope; or
         • An in-person review of the records, copies of which may be provided.
   10. Training & Responsibility
       1. A designated Records Compliance Officer will oversee the processing of all requests and maintain compliance logs.
2. References
   • Nevada Revised Statutes Chapter 629, Health Care Records Retention Requirements