You are switching specialists and need your chart from the old clinic. You call, the front desk confirms your name and date of birth, agrees to send the records as a PDF and says it should take a week or two. Six weeks later nothing has arrived, and the clinic says it has no request on file.
HIPAA gives you a real deadline for that request. Whether the deadline ever started depends on something most patients never check: whether the phone call counted as a request at all.
The Problem: The Request Was a Phone Call
HIPAA gives you a legal right to your own records. Under 45 CFR 164.524(b)(1), a provider “must permit an individual to request access to inspect or to obtain a copy” of the health information it keeps about you. The same rule adds a condition. The provider “may require individuals to make requests for access in writing, provided that it informs individuals of such a requirement.”
That one sentence splits every phone request into two cases:
- The clinic requires writing. If its notice or patient forms say requests must be in writing, the call started nothing. The deadline waits for a written request.
- The clinic does not. Then the call itself was the request, and the provider “must act on a request for access no later than 30 days after receipt of the request”.
In both cases, the only record of what you asked for and when is whatever the person at the front desk typed.
Why Current Solutions Fail
The call often does more than start the request. Under 164.524(c)(3)(i), the provider “may discuss the scope, format, and other aspects of the request” with you. That conversation decides which visits, which format and which fee. You remember it one way. The clinic logged it another way, or not at all.
Where patients lose:
- The receipt date is theirs. The 30 days run from “receipt of the request”. If the call was never logged, the clinic can treat the clock as not started.
- The extension is quiet. A provider may take one extra 30 days, but only if it gives you “a written statement of the reasons for the delay and the date” within the first 30. The rule adds that the provider “may have only one such extension of time”. You need your own timeline to know whether that statement ever came.
- The format promise fades. If you asked for an electronic copy and it is readily producible, the provider must provide it “in the electronic form and format requested”. A spoken promise of a PDF is hard to hold anyone to without the words.
Sending Records to Your New Doctor Is a Separate Rule
Many records calls are not really about the patient getting a copy. They are about getting the chart to a new specialist before an appointment. HIPAA treats that differently. Under 164.524(c)(3)(ii), if your request directs the provider to send the copy to another person you name, “the individual’s request must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy”.
So a phone call asking the old clinic to send everything to the new office starts no third-party transfer under that paragraph, no matter how friendly the front desk was. The practical fix is the same as everywhere else in this rule: turn the call into a signed written request that names the new practice and its address, and keep a copy.
What the Clinic Can Charge, and How It Must Say No
Two more points tend to come up on the call and then vanish from memory.
The fee. If you ask for a copy, 164.524(c)(4) allows the provider to charge “a reasonable, cost-based fee”, and lists what that fee may include: labor for copying, supplies when you ask for paper or portable media, postage when you ask for the copy to be mailed, and preparing a summary only if you agreed to one. If the person on the phone quotes a number, you want that number, and what it was said to cover, in writing.
The denial. A refusal is not supposed to happen over the phone either. Under 164.524(d)(2), the provider “must provide a timely, written denial”, in plain language, that gives the basis for the denial, any review rights, and a description of how you may complain to the provider or to the Secretary of Health and Human Services. A front-desk “we can’t release that” is not that document. If that is all you got, ask for the written denial.
What Actually Works
The fix is a verbatim, timestamped record of every call with the clinic, then a written request built from it and sent the same day.
Record the call in the room. Put the clinic on speaker and let AmyNote record from a second device nearby, such as an iPad. Tell the staff member the call is being recorded, and follow your state’s consent law, since some states require every party to agree.
Capture the exact words. Transcription runs on OpenAI’s latest Speech API, so dates of service, the staff member’s name, the format promised, the fee quoted and any statement about a written form land in the transcript as spoken.
Keep the speakers straight. Speaker identification separates you from each staff member and remembers voices across calls, so the first call and the follow-up call sit in one timeline.
Turn the calls into a request. AI analysis runs on Anthropic’s Claude Opus. Ask for every date, promise and fee with timestamps, then draft a written request that names the records, the format, any person the copy should go to, and the date of your first call.
Privacy stated plainly. Transcription runs through OpenAI and Microsoft Azure speech services, and AI analysis through Anthropic. AmyNote states that it does not use customer data to train AI models and does not sell content. Audio and text are encrypted in transit with TLS, and the saved library stays on the patient’s own iPhone or iPad, where recording, playback and export work with no network.
Local first is not local only. When transcription or a summary runs, the needed audio or text is uploaded, and a processing copy may be retained to complete the request. AmyNote publishes that trade-off rather than hiding it.
Getting Started
Next time you need your records, work through it in this order:
- Ask on the call whether requests must be in writing, and where to send one. Record the answer, with consent.
- Send a written request the same day that lists the records, the format you want, any person the copy should go to, and the date of your call. Sign it if it sends records to someone else, and keep proof of sending.
- Mark day 30 on a calendar. If the clinic needs longer, it must tell you why in writing, and by when, before that day.
- If the answer is no, ask for the written denial. It must explain how to complain to the provider or to HHS.
AmyNote offers transcription by OpenAI, analysis by Anthropic’s Claude Opus, zero-training commitments from both, and a three day free trial with no credit card.
Originally published as an X Article by @AmyNoteApp.
