How to fax medical records and forms

Who this guide is for

HIPAA’s privacy rules apply to health plans, health care clearinghouses, most health care providers and the businesses that work on their behalf. HHS says an organization outside those definitions doesn’t have to comply. As a patient asking about your own records, you’re on the other side of those rules: they’re what give you rights.

If you work for a health care provider or a health plan, this isn’t the service for patient information: FaxTonic doesn’t sign HIPAA business associate agreements, and its terms ask you not to send information protected by HIPAA through it.

Your right to your records

Under HIPAA, you have the right to see and get a copy of the health information your providers and health plans keep about you, with a few exceptions such as psychotherapy notes.

• In writing: a provider may require your request in writing, as long as it tells you so. Many offices have their own request form.
• Within 30 days: the provider must act on your request no later than 30 calendar days after receiving it. It can extend that once, by up to 30 more days, if it tells you in writing within the first 30 days why, and when it will finish.
• Fees: for your own copy, it may charge only a reasonable, cost-based fee for copying labor, supplies, postage and any summary you agree to. It can’t refuse you access because you owe a medical bill.
• To someone else: you can ask a provider to send a copy straight to another person, such as a new doctor, with a written, signed request naming that person and where to send the copy. Since a 2020 court ruling, the cost-based fee limit no longer applies to these requests.

For requests to send your records to someone else, HHS says a provider may accept a faxed copy of your signed request.

Authorizations: letting a provider release your records

When a third party such as an insurer, an employer or a lawyer wants your records, the provider generally needs your written authorization. A valid HIPAA authorization includes:

• a specific description of the information to be released;
• who may release it, and who may receive it;
• the purpose (“at the request of the individual” is enough when you’re the one asking);
• an expiration date or event;
• your signature and the date.

It must also tell you that you can revoke it in writing, and be in plain language. It doesn’t need to be notarized or witnessed, and HHS says a provider may act on a copy of a signed authorization received by fax.

Before you fax

• Call the office to confirm its fax number and ask whether it wants its own form. HHS suggests providers confirm a number before faxing health information to it, and it’s a good habit for patients too.
• Send only what’s needed: the request or authorization, plus a copy of your ID if the office asks for one.
• Tick the option on FaxTonic’s cover page that prints a confidentiality notice.

FaxTonic deletes your document once the fax is delivered, and after 24 hours at the latest: see the privacy policy.

How to fax a records request with FaxTonic

1. Fill in and sign the request or authorization, then scan it or photograph it flat and in good light. FaxTonic takes PDF, JPEG, and PNG files.
2. Open FaxTonic and add the file. On the free cover page, add your name and phone number, write “Medical records request” or the form’s title in the subject, and tick the confidentiality notice.
3. Enter the office’s fax number and check the total: $1.49 a page to the United States, cover page free.
4. Pay by card and keep your status page. It shows when the office’s machine received your request, which is when the 30 days begin.

FaxTonic only sends faxes, so your records can’t come back to you through it. Ask the office to send them by mail or through its patient portal, or to fax them directly to your new doctor.