Patient Rights and Records Requests

Form A. Request for a Copy of My Records (Right of Access)

Version [VERSION] | Effective [EFFECTIVE DATE] | Last updated [LAST UPDATED]

About you

1. Which records

☐ All of my records

☐ Only these (check all that apply):

☐ Visit notes and clinician summaries

☐ Prescriptions and orders

☐ Lab results

☐ My intake answers and health history

☐ My messages with my clinician

☐ Billing and payment records

Dates (optional): from to . Pharmacy records are kept by the pharmacy. Tell us if you want us to tell you which pharmacy filled your orders.

2. How I want them

☐ An electronic copy (download in my portal or a secure link). Format: ☐ PDF ☐ Other readable format:

☐ A paper copy, mailed to me

☐ I want to look at my records first. Contact me to set a time.

☐ A summary of my records instead. I agree to any fee for preparing it.

3. Where to send them

☐ To me, in my portal, by secure link, or by mail to:

☐ To me by ordinary email. I understand ordinary email can be read by others, and I still want it. Email:

☐ To another person or a health app, as my written direction. Name: Where to send:

4. Fees

The Practice may charge only a reasonable, cost-based fee for the labor of copying, supplies and postage. There is no fee for searching for or finding your records. We will tell you the fee before we send anything. [FEE SCHEDULE]

5. Time

We will answer within 30 days. If we need more time, we will tell you in writing why and by when. We can take one extra 30 days at most. If your state requires a faster answer, we follow the faster rule.

6. If we say no

If we cannot give you some or all of your records, we will tell you why in writing. In some cases you can ask for a review. You can also complain to the Practice or to the U.S. Department of Health and Human Services, Office for Civil Rights.

Your name and the date

If you are asking for someone else (for example, as a guardian or under a power of attorney), also give your name and the legal authority that lets you ask. We may ask for proof.

Sending this on paper? Sign and date here.

For office use only

Form B. Request to Correct My Records (Amendment)

Version [VERSION] | Effective [EFFECTIVE DATE] | Last updated [LAST UPDATED]

About you

1. Which entry

2. What is wrong or missing

What it says now, and what it should say:

3. Why I think it is wrong

You may upload or attach documents that support your request.

4. Who should be told

☐ People or companies I name:

☐ Anyone who may have relied on the wrong entry

5. What happens next

The Practice will answer within 60 days, or tell you in writing why it needs up to 30 more days. If it agrees, it will add the correction to your record and tell the people you named. If it does not agree, it will tell you why in writing. You may then send a statement of disagreement, which becomes part of your record. You may also ask that your request and the Practice’s answer go along with any future sharing of that entry, and you may complain to the Practice or to the U.S. Department of Health and Human Services, Office for Civil Rights. A clinician’s medical judgment is not changed by this request, but your statement will be added.

Your name and the date

If you are asking for someone else (for example, as a guardian or under a power of attorney), also give your name and the legal authority that lets you ask. We may ask for proof.

Sending this on paper? Sign and date here.

For office use only

Form C. Request for a List of Disclosures (Accounting)

Version [VERSION] | Effective [EFFECTIVE DATE] | Last updated [LAST UPDATED]

About you

1. Time period

From to . You may ask for up to six years before today.

2. What the list covers

The list shows certain disclosures made outside treatment, payment and the Practice’s normal operations, and outside anything you authorized or asked for yourself. Examples are disclosures the law requires, to health regulators, and for legal proceedings. It shows the date, who received the information, what was shared, and why.

3. Fees and time

The first list in any 12 months is free. For more, we may charge a reasonable, cost-based fee and will tell you first, so you can change or withdraw your request. We will answer within 60 days, or tell you in writing why we need up to 30 more days.

Your name and the date

If you are asking for someone else (for example, as a guardian or under a power of attorney), also give your name and the legal authority that lets you ask. We may ask for proof.

Sending this on paper? Sign and date here.

For office use only

Form D. Request to Limit How My Information Is Used or Shared (Restriction)

Version [VERSION] | Effective [EFFECTIVE DATE] | Last updated [LAST UPDATED]

About you

1. What I want limited

2. Who or what it applies to

☐ Use or sharing for my treatment, payment or the Practice’s normal operations

☐ Sharing with family or friends involved in my care

☐ Other:

3. Paid out of pocket

☐ I paid in full out of pocket for this item or service, and I ask that it not be shared with my health plan. Plan name:

This program is cash-pay, and we do not bill health plans.

4. What happens next

The Practice does not have to agree to most limits. If you paid in full out of pocket and ask that information not go to your health plan, the Practice must agree. The Practice will tell you its decision in writing within [10 business days]. If it agrees, it will follow the limit, except in an emergency or when the law requires sharing. You or the Practice can end the agreement for future information by telling the other.

Your name and the date

If you are asking for someone else (for example, as a guardian or under a power of attorney), also give your name and the legal authority that lets you ask. We may ask for proof.

Sending this on paper? Sign and date here.

For office use only

Form E. Request to Be Contacted a Certain Way (Confidential Communications)

Version [VERSION] | Effective [EFFECTIVE DATE] | Last updated [LAST UPDATED]

About you

1. How and where to contact me

☐ No text messages

☐ No voicemail with details

☐ Only through my patient portal

☐ Other:

2. Which messages

☐ From the Practice (about my care)

☐ From WellPeps (orders, shipping, billing, support)

☐ Both

3. What to know

You do not have to tell us why. We will honor reasonable requests. If we cannot, we will tell you promptly. Payment receipts go to the email you used at checkout unless you name another here.

Your name and the date

If you are asking for someone else (for example, as a guardian or under a power of attorney), also give your name and the legal authority that lets you ask. We may ask for proof.

Sending this on paper? Sign and date here.

For office use only

Form F. Request for My Portal Records Export

Version [VERSION] | Effective [EFFECTIVE DATE] | Last updated [LAST UPDATED]

About you

1. How I want to get them

☐ I will use the export tool in my portal. [VERIFY: the portal export steps and what the export contains, to be written here once confirmed]

☐ I cannot or do not want to use the portal. Please send my records another way.

2. What to know

If the export does not include everything you want, use Form A. There is no charge for the portal export. If you ask us to send the records another way, we will treat your request as a request for a copy of your records, and the 30-day deadline in Form A applies.

Your name and the date

If you are asking for someone else (for example, as a guardian or under a power of attorney), also give your name and the legal authority that lets you ask. We may ask for proof.

Sending this on paper? Sign and date here.

For office use only

Part 3. Template response letters

Send on the Practice’s letterhead, or from WellPeps on the Practice’s behalf with the Practice’s approval. Fill every bracket for the specific request. In Letters 4 and 5, [DESCRIBE] names what is denied and [REASON] gives the basis in plain language. Do not put health information in the body of an ordinary email: send the letter through the portal or as a secure attachment. Keep a copy in the log.

Letter 1. Acknowledgment

Letter 2. Fulfillment

Letter 3. Extension (send before the original due date)

Letter 4. Denial of access (in whole or in part)

Letter 5. Denial of amendment

Part 4. Your Medical Record Rights (patient-facing page)

Version [VERSION] | Effective [EFFECTIVE DATE] | Last updated [LAST UPDATED]

[PRACTICE NAME] (the Practice) keeps your medical record. WellPeps, a Wyoming corporation, helps you reach the Practice and passes your requests to it. You have these rights:

• See and get a copy of your records, in electronic form if you want, and have them sent to someone else you name. We answer within 30 days. We may take one extra 30 days, and we will tell you why. Some states require a faster answer.
• Ask for a correction if something in your record is wrong or missing. We answer within 60 days.
• Ask for a list of certain disclosures of your information from the last six years.
• Ask us to limit how your information is used or shared, and ask to be contacted in a certain way or place.
• Get a copy of the Notice of Privacy Practices, which explains how your information is used and shared.
• Complain to the Practice or to the U.S. Department of Health and Human Services, Office for Civil Rights, without any penalty.

How to ask. Send a message in your patient portal at [PORTAL URL], email [PRIVACY EMAIL], or write to [BUSINESS ADDRESS]. You can use Forms A to F, or just write to us. There is no charge to ask. A fee may apply to a copy for copying, supplies and postage, and we will tell you before we charge it.

How long we keep records. The Practice keeps your medical record for at least [7] years, or longer if your state requires. Closing your membership or portal account does not delete your medical record.

Florida patients. The Practice follows the Florida Patient’s Bill of Rights and Responsibilities. [VERIFY: the statute and current text, as cited in the draft State Telehealth Consent Addendum, and the Practice’s one-page summary to insert here] Weight-loss program patients may also receive the Weight-Loss Consumer Bill of Rights. [VERIFY: whether that notice, as cited in the draft State Telehealth Consent Addendum, applies to a physician-prescribed telehealth program]

In an emergency, call 911. Do not use this page for medical questions; message your clinician in the portal.

Technical and drafting notes

Part 1. Procedure (internal; remove before publishing)

1.1 Purpose and scope

This procedure tells WellPeps and the Practice how to receive, route, decide and answer patient requests about their medical records under HIPAA. It covers six requests: access, amendment, accounting of disclosures, restriction, confidential communications, and a portal records export. It does not cover privacy-rights requests about website data (access, delete, correct, opt out) under state privacy laws; those follow the Privacy Policy and Your Privacy Choices. If one message asks for both, handle both.

The Practice (the covered entity) holds the medical record and decides every request (the agreement with the Practice section 3(a); Addendum 10(a)). WellPeps is its business associate: it receives requests, verifies identity, routes, tracks deadlines, and sends the Practice’s answers. WellPeps never decides, denies or discloses record content on its own.

1.2 Who does what

1.3 What is held where

1.4 Request types and deadlines

State law can require a faster answer (Part 1.14). Where it does, follow the faster rule. Internal target: finish access requests within [20 days].

1.5 Receiving a request

Requests may arrive by email to [PRIVACY EMAIL], by a portal message, by mail to [BUSINESS ADDRESS], through [SUPPORT EMAIL], or, only if a phone line is live ([SUPPORT PHONE AND HOURS, ONLY IF LIVE]), by phone (ask for a written follow-up, but start the clock now). Any clear written request counts, with or without a form. Do not require a form, an in-person visit or use of the portal only. Do not ask why the patient wants the records.

1. Log it the same business day (section 1.13). The clock starts on the day any of the Practice, WellPeps or the platform’s support first receives the request. [VERIFY: whether the 30-day period runs from receipt by WellPeps as business associate; this procedure uses the conservative rule]
2. Do not decide, and do not read out or email record content. Never send health information in an ordinary email.
3. Verify identity (section 1.6). Verification must not stop the clock.
4. Forward to the Practice within 1 business day by a secure channel, with the request, the verification result and the due date.
5. Send the acknowledgment (Letter 1) within 2 business days.
6. Track the due date. Check open items at day 10 and day 20. If the Practice needs more time, it must send Letter 3 before the original due date.
7. Send the Practice’s answer (Letters 2, 4 or 5) and record the outcome.

1.6 Identity and authority

Keep verification reasonable. Do not require notarization, an in-person visit or more identity information than needed.

1.7 Access requests

• Scope. The patient’s designated record set. The Practice decides what, if anything, is outside it.
• Form and format. The form and format the patient asks for, if the Practice can readily produce it. Otherwise a readable electronic format agreed with the patient. Paper if asked. A patient may ask that records go to a health app; the Practice sends them if the request is clear. [VERIFY: OCR guidance on sending records to a patient’s chosen app and on unencrypted email sent at the patient’s request]
• Delivery. Portal download, secure link, encrypted email, or mail. Ordinary email only if the patient asks for it after being told ordinary email can be read by others (Form A has the warning).
• Sending to someone else. A signed, written direction that names the person and where to send it.
• Fees. Only a reasonable, cost-based fee: labor for copying (paper or electronic), supplies for paper or media, postage, and a summary only if the patient asked for it and agreed to its fee. Nothing for searching or finding records. Tell the patient the fee before sending. The Practice sets the fee ([FEE SCHEDULE]). [VERIFY: state fee caps and the fee schedule against the HIPAA cost-based fee rule]
• Never delay or refuse because the patient canceled, left, disputes a charge or owes money.
• Inspection. If the patient wants to look at the record, arrange a time and a secure way (for example a screen-share through the portal).

1.8 Amendment requests

The Practice answers within 60 days (one 30-day extension with a written notice). It may deny if the entry is accurate and complete, was not created by the Practice, is not part of the record, or is not something the patient may inspect. If it accepts: add the correction (never erase the original), tell the patient, and tell the people the patient names and those known to have relied on the entry. If it denies: send Letter 5 with the reason, the patient’s right to file a statement of disagreement, the right to ask that the request and denial go with future disclosures, and how to complain. The Practice may write a rebuttal and must give the patient a copy. Keep everything in the record. The Practice does not change a clinician’s medical judgment, but it will add the patient’s statement.

1.9 Accounting of disclosures

The accounting lists disclosures of the patient’s information in the six years before the request, except disclosures for treatment, payment and health care operations, to the patient, under the patient’s authorization, and certain others. Each entry shows the date, the recipient and address if known, what was disclosed, and the purpose (or a copy of the request). The Practice answers within 60 days (one 30-day extension). The first accounting in any 12 months is free; later ones may carry a cost-based fee, told in advance. WellPeps and the platform must keep a record of disclosures that would appear on an accounting (for example, to a regulator or under a subpoena) and give it to the Practice within 3 business days of a request.

1.10 Restrictions and confidential communications

• Restriction. The Practice does not have to agree, with one exception: when the patient has paid in full out of pocket for an item or service and asks that it not be shared with a health plan. This program is cash-pay and bills no health plan. [VERIFY: whether the full-payment restriction right applies to a cash-pay program that bills no plan] If the Practice agrees, it records the agreement, tells WellPeps and the platform, and follows it, except in an emergency or where the law requires sharing. Either side may end it for future information with notice.
• Confidential communications. Accommodate reasonable requests (a different email, address, or no texts). Do not ask why. The Practice may ask how payment will be handled. Record the preference in GEN Health and in WellPeps support records, and check it before every outreach. Receipts go to the checkout email unless the patient names another.

1.11 Portal export

Where the portal offers a self-service export, point the patient to it and log the request as answered. If the export does not hold the whole record, or the patient cannot or will not use it, treat the request as an access request (Form A). Do not let the export become a barrier. [VERIFY: whether the patient portal offers a self-service export, its steps, and whether it covers the whole designated record set]

1.12 Denials, review and complaints

Only the Practice denies. WellPeps staff send the Practice’s letter.

• Denial without review. For example: psychotherapy notes, information prepared for a legal proceeding, and certain laboratory information restricted by law. [VERIFY: the full list of unreviewable grounds for denying access]
• Reviewable denial. A licensed health care professional decides that access is reasonably likely to endanger the life or physical safety of the patient or another person, or that the record refers to another person (not a health care provider) and access is reasonably likely to cause substantial harm to that person. The patient may ask for review by a licensed professional chosen by the Practice who did not take part in the first decision. The Practice decides within a reasonable time and tells the patient in writing.
• Partial denial. Give access to everything else.
• Written denial (Letter 4) in plain language: the basis, the review right where it applies, how to complain to the Practice (name or title and phone) and to the U.S. Department of Health and Human Services, Office for Civil Rights. If the Practice does not hold the information but knows who does, say so.

1.13 Record of requests

Keep a log. WellPeps and the Practice each keep the part they handle. Keep the log, the letters, written denials and the designation of who receives and processes requests for six years from the date created or last in effect. [VERIFY: HIPAA’s six-year documentation retention for the request log, letters and designations]

1.14 State law and information blocking

State law. Some states require faster responses, cap fees or add rules for minors and deceased patients. Where a state rule is stricter than HIPAA, follow it. States such as California, Texas, Washington and New York are reported to set shorter periods for some requests. [VERIFY: current state response times and fee caps for each state served] Keep a table for [STATES SERVED].

Information blocking (21st Century Cures Act, 45 CFR Part 171). These rules bar practices likely to interfere with access to, or exchange or use of, electronic health information unless an exception applies. The Practice is a health care provider and so an actor. The platform vendor may be an actor, and WellPeps does not appear to be one. [VERIFY: information-blocking status of the Practice, the platform vendor and WellPeps, and which exceptions apply] WellPeps still configures the portal and runs support, so it must not create delays or barriers. Do: release results and clinician notes through the portal on a documented schedule; keep request steps few; charge nothing beyond what the access rule allows; document any delay under a named exception. Do not: hold records for payment, require a visit, or send a patient to a form when a message will do.

1.15 Retention, portability and ending care (item F13)

• The Practice keeps the medical record for at least [7] years after the the agreement with the Practice ends (the agreement with the Practice 3(b)), or longer where state law requires. [VERIFY: medical-record retention minimums in the Practice’s state and in the states served]
• Closing a membership or a portal account does not delete the medical record. Tell patients this plainly.
• A patient may always ask for an electronic copy to give to another clinician or a health app (Form A).
• If care through WellPeps ends (the agreement with the Practice sections 11 and 12; the services agreement), the Practice and WellPeps give patients written notice with how to get their records. Nothing is withheld during a billing dispute.