Requesting medical records from another provider: a letter you can copy

Ayush Gondley · 12 October 2026 · 6 min read

Two medical office desks with a folder of patient records passing from one to the other, and a calendar showing an upcoming appointment

A records request from one office to another is quick to send. The time goes into making sure the records arrive before the visit.

Key takeaways

Under the HIPAA Privacy Rule, a provider may send a patient's records to another provider for that provider's treatment of the patient without the patient's written authorization.
Psychotherapy notes are the exception: they need the patient's authorization even for treatment. Substance use disorder records from programs covered by 42 CFR Part 2 have their own rules, and a state law that protects privacy more than HIPAA does still applies.
A good request letter names the patient, the records, the reason, the date they are needed by and the secure place to send them. A template is below.
Logging each request, following up on a schedule and telling staff when records are late can run by themselves. Deciding what to ask for and reviewing what arrives stay with people.

When a new patient books, or a patient comes back from a specialist, your practice often needs records held by another office. The request itself takes a few minutes. What takes the time is everything after it: the follow-up calls, the fax that never arrived, and the visit that starts without the records the clinician needed.

What HIPAA allows

The HIPAA Privacy Rule lets a health care provider disclose a patient's protected health information to another health care provider, without the patient's authorization, for that provider's treatment of the patient.¹ HHS gives the example of a physician who mails or faxes a copy of a patient's medical record to a specialist who intends to treat the patient.²

Three more points from HHS guidance matter for a records request:

Phone, fax and email are all allowed for treatment communications, as long as the practice uses reasonable safeguards. For a fax number that is not regularly used, HHS gives the example of first confirming the number with the intended recipient.²
The minimum necessary standard does not apply to disclosures to, or requests by, a health care provider for treatment purposes.³ Our recommendation is still to ask for what the clinician needs, which is faster for both offices.
This is not the patient's own request. When a patient asks for their own records under the HIPAA right of access, a 30-day clock and fee limits apply. That path is covered in our records requests article.

Where the rules are stricter

Psychotherapy notes. With few exceptions, the Privacy Rule requires the patient's authorization before psychotherapy notes are disclosed for any reason, including for treatment by another provider.⁴ These are a therapist's separate session notes, not the rest of the mental health record.
Substance use disorder records. Records from programs covered by the federal Part 2 rule (42 CFR part 2) have their own rules for when they may be used and disclosed.⁵
Your state. A state law that gives patients greater privacy protection than the HIPAA Privacy Rule is not overridden by it.⁶ Check your state's rules for sensitive records.

Many offices ask for a signed release before sending anything, whatever HIPAA allows. Our recommendation: if the patient has already signed a release form, attach it to the request. It costs nothing and avoids a round of calls. This is a short summary, not legal advice.

What the request letter should say

Who the patient is: full name, any previous name, date of birth, and the dates they were seen there, if you know them.
Which records: a short, specific list, such as recent visit notes, the problem and medication lists, allergies, immunizations, and lab and imaging results for a stated period.
Why: for the treatment of the patient, and when the patient's appointment is.
When you need them: a date a few days before the appointment.
Where to send them: a secure fax number or secure email address that you have confirmed, and a named contact with a direct phone number.

Request for records · fax or secure email, on practice letterhead

To: Medical Records, [Practice name]
From: [Your practice], [address], [phone]. Contact: [Name], [direct phone]
Date: [date]

Re: Request for medical records for treatment
Patient: [Full name] (previous name: [if any]) · Date of birth: [DOB]
Dates seen at your practice: [dates, if known]

[Patient name] is a patient of [Clinician] at [Your practice] and has an appointment on [date]. For their treatment, please send:
· Visit notes from [period]
· Current problem list, medication list and allergies
· Immunization record
· Lab and imaging results from [period]

Please send them by [date, a few days before the appointment] to our secure fax [number] or secure email [address]. [The patient's signed release is attached.]

If anything is needed from us, please call [Name] at [direct phone]. Thank you.
[Name], [Title], [Your practice]

Adapt the list to what your clinician needs. For psychotherapy notes or Part 2 records, include the patient's signed authorization.

A tablet at a front desk showing a short list of outgoing records requests, each with a due date before the patient's appointment and a status

Follow-ups you can copy

Most records arrive after one request. The ones that do not are the reason to have these ready.

First follow-up · fax or secure email, if nothing has arrived after [3] business days

Re: Records request sent [date] for [Patient name], DOB [DOB]. We have not received these yet. The patient's appointment is on [date]. Please send them to secure fax [number] or secure email [address], or call [Name] at [direct phone] if anything is missing from our request. Thank you. — [Your practice]

Note to the patient · text, when the request goes out

[Your practice]: we have asked [Previous practice] for your records ahead of your visit on [date]. If they ask you to sign a release form, please do, so they can send them to us. Reply STOP to opt out of texts.

Alert for the team · inside the practice, two days before the appointment

Records for [Patient name] (appointment [date]) have not arrived from [Practice name]. Requested [date], followed up [date]. Call [phone] today.

What can run by itself

These parts can be set up to run by themselves, inside the practice software, forms and messaging a practice already uses:

A log of outgoing requests, each with the date the records are needed by, worked out from the appointment.
Follow-ups on a schedule, sent only for requests that are still open.
A note to the patient when the request goes out, so a release form from the other office does not stall it.
An alert to the team when records are still missing shortly before the visit, while there is time to call.

What stays with people

Deciding what to ask for. The clinician knows which records matter for this patient.
Reviewing what arrives and adding it to the chart.
Sensitive records. Psychotherapy notes, Part 2 records and anything your state treats differently.
The phone call when a request has stalled and a person at the other office needs to be reached.

Count it first

For two weeks, list every records request your practice sends: the date sent, the date the records arrived, and whether they arrived before the visit. If you tried the tally in our front-desk article, add these to its records column. The share that arrives late tells you how much the follow-ups would save.

Requests in the other direction, from patients asking for their own records, follow different rules, which our records requests article explains. The same reminder messages that keep records on time also keep patients on time, as in our no-show policy article for medical offices and our vet reminders article for clinics.

Questions practices ask

Do we need the patient's signed authorization to request records from another provider?

Under the HIPAA Privacy Rule, no, when the records are for your treatment of the patient. Psychotherapy notes and Part 2 records are exceptions, and your state's law may add requirements. Many offices still ask for a signed release, so attaching one if you have it avoids delays.

Can medical records be sent by fax or email?

Yes, for treatment, with reasonable safeguards, such as confirming a fax number that is not regularly used before sending.

Can we ask for the whole chart?

The minimum necessary standard does not apply to requests for treatment, so it is allowed. Our recommendation is a specific list, which the other office can usually send faster.

How is this different from a patient asking for their own records?

A patient's own request falls under the HIPAA right of access, with its 30-day clock and fee limits. A request from one provider to another for treatment is a separate path under the Privacy Rule.

Sources

U.S. Department of Health and Human Services, HIPAA FAQ: Does a physician need a patient's written authorization to send a copy of the patient's medical record to a specialist or other health care provider who will treat the patient? (45 CFR 164.506).
U.S. Department of Health and Human Services, HIPAA FAQ: Does the HIPAA Privacy Rule permit a doctor, laboratory, or other health care provider to share patient health information for treatment purposes by fax, e-mail, or over the phone?
U.S. Department of Health and Human Services, Minimum Necessary Requirement (45 CFR 164.502(b), 164.514(d)).
U.S. Department of Health and Human Services, HIPAA FAQ: Does HIPAA provide extra protections for mental health information compared with other health information? (45 CFR 164.508(a)(2)).
U.S. Department of Health and Human Services, Understanding Confidentiality of Substance Use Disorder (SUD) Patient Records or "Part 2".
U.S. Department of Health and Human Services, HIPAA FAQs: Preemption of State Law.

About the author

Ayush Gondley founded Gondley Consulting, which automates front-desk work for small US medical, therapy and veterinary practices. Before that he was a marine engineer at Maersk, keeping complex systems running at sea. Gondley Consulting on LinkedIn