What Is a HIPAA-Compliant Record Transfer?

A medical record transfer is HIPAA-compliant when the practice has a permitted reason to send the records, protects them reasonably on the way, and documents what went where. This entry gives front desk and records staff a three-part check they can use at the desk, everyday clinic examples, and the HHS rules behind each point.

What is a HIPAA-compliant record transfer?

A HIPAA-compliant record transfer is the release of a patient's health records to a recipient for a purpose HIPAA permits, through a channel with reasonable safeguards, with the release documented. The phrase is industry usage. HIPAA does not define "record transfer" as a term. The rules that apply are the Privacy Rule, which covers who may receive records and why, and the Security Rule, which covers how electronic records are protected in transit.

Before any release, check three things:

A permitted reason. The release is for treatment, the patient's right of access, or a valid signed authorization.
A reasonable safeguard for the channel. The fax number, email address or portal account is verified and protected.
A record of what was sent. The log shows what was released, to whom, when and why.

In practice at a clinic or small practice

Front desk and records staff see different kinds of requests in the same week, and each has a different basis:

Treatment. A cardiology office asks for recent visit notes before a referral appointment.
Patient right of access. A patient asks for a copy of their own chart.
Patient-directed transfer. A patient who moved asks you to send records to a new primary care practice.
Signed authorization. A life insurer or an attorney asks for records.

Records usually move through an EHR exchange or Direct secure messaging, a patient portal, encrypted email, fax, or paper pickup. Most problems are simple ones:

a mistyped fax number
a full chart emailed when only one lab result was needed
skipped identity verification for a walk-in requester
a release that never made it into the log

The office manager usually owns the release-of-information procedure. Staff should follow it rather than improvise. Staff may track a request internally, but the records themselves should move only through the approved records channel.

Not to be confused with

HIPAA-compliant messaging is ongoing secure messaging between people, staff-to-staff or patient-facing, under a BAA. A record transfer is the disclosure of a defined set of records to one recipient for one purpose.
Direct secure messaging is a specific standards-based protocol for provider-to-provider exchange, often built into certified EHRs. It is one channel for a record transfer, not the same thing.

What the rules say

No law defines "HIPAA-compliant record transfer." The rules below are the ones that apply.

Treatment disclosures. A provider may share PHI with another provider for treatment without the patient's authorization.
Right of access. Patients can get copies of their records and can direct the provider to send copies to a third party. Response timelines and fee limits apply. Check current HHS guidance for the details.
Authorization. Most disclosures outside treatment, payment, operations and other permitted purposes need a valid signed authorization. Requests from a life insurer or most attorneys are typical examples. See HIPAA authorization vs consent.
Minimum necessary. Send only what the purpose requires. The minimum necessary standard does not apply to disclosures to a provider for treatment or to the patient.
Safeguards in transit. Electronic transfers need reasonable safeguards. Encryption is an addressable specification, not an absolute requirement. A patient may ask to receive records by unencrypted email after being warned of the risk. See the HIPAA Security Rule.
Vendors in the path. An outside service that handles PHI on the practice's behalf, such as an EHR exchange, a records-release vendor or an e-fax service, typically needs a business associate agreement (BAA).
- For background on BAAs for internal tools rather than record transfer, see how a BAA and safeguards work for staff chat.
Mistakes. Records sent to the wrong recipient may be a breach that requires a risk assessment and notification.
Information blocking. ONC rules expect providers not to unreasonably delay or interfere with access, exchange or use of electronic health information.

HIPAA-compliant record transfer