A medical records request is the process of requesting access to a client’s protected health information (PHI) or medical records. This requires a Release of Information (ROI).
An ROI is a document that allows a client to authorize what information is released from their medical record, who receives the information, how long it can be released, and under what guidelines.
This article covers:
Requesting medical records
Rula is the custodian of client records, and therapists are prohibited from releasing medical records to clients. Clients can request a copy of their records directly from Rula, and have their request fulfilled by our partner, Datavant.
- For client-initiated requests, provider authorization is required—learn how to review client medical records requests below.
Therapists can also request records on behalf of their client. The most common reason is to facilitate coordination of care.
If you need to request client records, the first step is to request an ROI, which will begin the process to access records. Rula’s internal team fulfills provider-initiated requests.
Requesting an ROI for your clients
Follow the steps below to complete an ROI request form. From there, our Records team will assist by sending your client an email to obtain their electronic signature on a release form that authorizes their provider to release client-specific information to others.
- From the provider portal, click the Resources tab.
-
Under Documents and forms, find the release of information request form.
- Note: You can also find this form on our medical records request page, by clicking Get started and selecting Rula Provider.
-
To initiate the request, complete all required fields—this will ensure your request can be processed more efficiently.
- It’s recommended to complete this form during a session with the client when possible.
-
Our Records team will email the client to sign a release form electronically. Once completed, we’ll upload the signed ROI and inform you once the process is complete.
- You can find the signed form in the provider portal by opening the client’s chart and clicking the Notes & Documents tab—it will be listed under “Documents” on the right.
- Keep in mind that ROIs can take 14 – 30 days to process, but most are processed sooner.
When an ROI is needed
Generally speaking, you'll need a signed ROI from the client to correspond with an external party that is not a covered entity (e.g. a school, case worker, probation officer, attorney, etc.).
You don’t need an ROI to:
-
Communicate with another healthcare provider—a physician, another therapist or psychiatrist, hospital staff, etc.—to coordinate care for a shared patient, both within Rula and externally.
- More on this: The HIPAA Privacy Rule allows healthcare providers to coordinate care without a client's authorization when connecting with another healthcare provider. These communications are covered under Treatment, Payment, and Operations (TPO). TPO also allows healthcare providers to make a referral to connect the client with services or resources or communicate with an insurance company without an ROI.
- Release information to the client for things like letters or paperwork (e.g. disability letters) you've completed at the client's request.
-
Speak with a parent/guardian of a client for anyone who is aged 17 and younger.
- More on this: Unless a biological parent’s rights have been terminated or there is information in the minor client’s record that could reasonably be harmful to the minor child if the information was released, both biological parents will have the right to access the minor client’s medical records regardless of who signed consent for the minor. Please review the Medical Records section of Rula's Clinical Quality Practice Guidelines for Minors for more information.
- To meet a client’s request to talk with a partner, relative, or friend. Document the request in your note and confirm you obtained verbal consent from the client.
- To have someone else join a session at the client's request. Document the circumstance in your note to specify the client AND guest provided verbal agreement.
- More on this: Please review the Rula Agreement for Guest Participation for more information.
Reviewing client medical records requests
We partner with Datavant, a leading vendor in the healthcare industry, to securely process and fulfill medical record requests from clients.
For client-initiated requests, HIPAA requires that we confirm with you, as the provider, that releasing the records would not pose a risk to the client or others. This verification step is now managed by Datavant.
Provider verification for client requests for records
- You may receive outreach directly from a Datavant team member, which will come from the rula@datavant.com inbox.
- Please respond to them within three business days whenever possible to ensure timely fulfillment.
Updated