A patient emails your front desk at 4:52 p.m. on a Tuesday: "Please send me everything from my thyroid workup — all labs, the endocrinology referral, and the notes." That message started a 30-day clock, whether or not anyone opened it before Wednesday. Charts built around a high TSH result are a common trigger for this kind of request, because the workup usually spans repeat labs, an outside reference laboratory, and often a specialist consult. This post is a records-and-privacy playbook for the people who process those requests: what starts the clock, how to verify identity without stalling, what you can charge, and which vendor relationships need paper before the request arrives.

How Long You Have to Fulfill a High TSH Records Request

Under the HIPAA Privacy Rule, a covered entity must act on an individual's request for access to their designated record set within 30 calendar days of receiving it. One 30-day extension is available, but only if you give the individual a written statement — inside the original 30 days — explaining the reason for the delay and the date you will complete the request. You get one extension. Not one per record type, not one per department.

Two things practices get wrong. First, the clock runs on calendar days, not business days, and it starts on receipt — the day the email landed in the shared inbox, not the day someone triaged it. Second, many states impose shorter deadlines or lower fee caps, and the stricter standard controls. Check your state's medical records statute and post the shorter number on your intake workflow, because your staff will not remember two competing deadlines under pressure.

HHS keeps the authoritative guidance at its individuals' right of access page. Print the fee section and the timing section and keep them in the same binder as your release-of-information procedure.

Why a High TSH Chart Lives in Three Places at Once

The administrative headache with thyroid records is not complexity of content — it is distribution. A single abnormal thyroid panel routinely generates repeat testing, and elevated results frequently prompt a referral to endocrinology. That means the record fragments immediately.

Your practice holds the order and the interpretation

Your chart contains the order, the result as it landed in your system, the note where the clinician documented the plan, and the referral. That is your designated record set, and it is what you are obligated to produce.

The reference laboratory holds its own copy

Clinical laboratories subject to CLIA have their own patient access obligations and their own request process. If a patient wants the lab's original report — including specimen details, reference ranges, and any addenda your interface truncated — they may have to ask the lab directly. Your job is not to produce the lab's records; it is to produce what is in your designated record set and to tell the patient plainly where the rest lives. "We don't have that" is an incomplete answer. "That report was performed by [lab], here is their records request line" is a complete one.

The specialist holds the consult

If the endocrinology consult note came back to you, it is in your designated record set and you produce it — even though you did not author it. Records you receive from another provider and maintain to make decisions about the patient are yours to disclose on request. Staff frequently withhold outside records out of misplaced caution. That is a right-of-access failure, and OCR has resolved a long series of enforcement actions specifically about delayed or refused patient access, with settlements that regularly reach into five figures for small practices. You can review resolved matters through the HHS enforcement agreements listing.

Verification That Protects the Chart Without Blocking the Patient

You must verify the identity of the requester. You may not turn verification into an obstacle course. The Privacy Rule requires reasonable verification — it does not prescribe a specific method, and it does not permit you to invent requirements that exist mainly to slow requests down.

Reasonable, in a normal outpatient practice:

  • Matching two identifiers already in the chart (date of birth plus address, or DOB plus last four of an account number)
  • A copy of a government ID for in-person or mailed requests
  • Portal authentication, which is verification by itself — a request submitted through an authenticated patient portal session does not need a second ID check
  • A callback to the phone number of record for high-value or unusual requests

Unreasonable, and a frequent complaint source: requiring the patient to appear in person when they asked by email, requiring notarization, requiring your own form when the patient sent a clear written request, or refusing to email records because "email isn't secure." If the patient requests unencrypted email after you explain the risk, you send it. Document the warning and the patient's choice in the request log.

Third-party directives and the paperwork that follows

Patients with abnormal thyroid results often want records routed somewhere — a new endocrinologist, a second-opinion practice, a disability or insurance file. A patient can direct you to send their records to a third party in a signed, written request that identifies the recipient and where to send it. Following the 2020 Ciox Health decision, the patient-rate fee limitation does not extend to those third-party directives in the way the 2016 guidance originally described. Your billing team needs to know which rate applies to which request type, in writing, before a dispute happens.

Train staff on the distinction between a patient-directed transmission and a third-party authorization request arriving from an attorney or insurer. They look similar on the fax machine. They carry different deadlines, different fee rules, and different verification standards.

Fees: What You Can Charge and What Generates Complaints

For a patient's own access request, you may charge a reasonable, cost-based fee limited to labor for copying (including electronic copying), supplies such as paper or portable media, postage, and the labor to prepare a summary if the patient agreed to a summary instead of the full record.

You may not charge for search and retrieval. You may not charge for the time your clinician spends reviewing the record before release. You may not charge a per-page fee for records you produce electronically from an electronic system. If a patient asks for their high TSH labs to be pushed to their portal or emailed as a PDF, your incremental cost is close to zero, and your fee should reflect that.

Post your fee schedule, tell the patient the fee in advance, and log every fee charged. Access-fee overcharges are one of the easiest complaints for a patient to file and one of the hardest for a practice to defend after the fact.

A Worked Timeline for One Request

Assume the email arrives Tuesday, July 7, at 4:52 p.m. Here is what a defensible run looks like.

  1. Day 0 (July 7): Auto-acknowledgment sends. Request logged in the ROI tracker with receipt timestamp, requester name, and scope as written by the patient.
  2. Day 1: Records coordinator verifies identity against two chart identifiers. Scope clarified by phone if ambiguous — "everything from my thyroid workup" needs a date range and a decision about whether raw lab data and the endocrinology consult are included. Clarification does not pause the clock.
  3. Day 2–5: Assembly. Labs pulled from the interface, consult note pulled from scanned documents, encounter notes exported. Coordinator confirms whether any portion sits only in a vendor system — imaging portal, standalone lab viewer, care-coordination platform.
  4. Day 6: Fee quoted if any. Delivery method confirmed in writing.
  5. Day 8–12: Release. Delivery method matches the request. Tracker updated with what was sent, in what format, to whom, and by whom.
  6. Day 30: Only relevant if something broke. If it did, the written extension notice must already have gone out — dated inside the original window.

Median fulfillment in a functioning practice is eight to twelve days. If your median is twenty-six, you have no margin for a staff absence, and your first missed deadline is a matter of scheduling luck.

The Vendor Gap That Surfaces During High TSH Requests

Assembly is where practices discover which vendors touch their data. Records requests on thyroid workups tend to expose the same handful: the transcription service that typed the consult, the release-of-information company that fulfills faxed requests, the results-delivery or patient-messaging platform that pushed the abnormal value to the patient, and the scanning contractor that digitized the outside records.

Every one of those is a business associate. Every one needs a signed Business Associate Agreement on file before it handles protected health information — not after your privacy officer notices the gap during a records pull. If you find a vendor operating without one, close it immediately; you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX the same afternoon, as a one-time purchase rather than another subscription line item.

While you are in the file, check whether the agreement actually addresses records access. A useful BAA states how quickly the associate returns PHI when you need it to satisfy an access request, because your 30 days do not extend just because your vendor is slow.

Information Blocking Sits on Top of All of This

HIPAA sets the floor. The information blocking rules set a second, overlapping obligation: you may not engage in practices likely to interfere with access, exchange, or use of electronic health information, unless an exception applies. Delaying release of an abnormal thyroid result to "let the doctor call first" is the classic risk. The preventing-harm exception is narrow and is not satisfied by a general preference to deliver bad news personally.

Your practice should have a written policy on automatic release of results to the portal, reviewed with clinical leadership, that reflects the current framework at healthit.gov's information blocking resources. If a clinician wants a delay for a specific patient, that decision needs documentation in the chart, not an informal instruction to the front desk.

What to Fix This Quarter

  • Timestamp every request at receipt, including ones arriving by email, portal, phone, or fax.
  • Write one page telling staff exactly what verification is acceptable — and what they are not allowed to demand.
  • Publish the access fee schedule and confirm no one is billing search and retrieval.
  • List every vendor that touched a chart during your last five records requests, and confirm a signed BAA for each.
  • Pull your median fulfillment days for the last quarter. If you cannot calculate it, your tracker is the first thing to fix.

Records requests on high TSH charts are not unusual, which is exactly why they make a good audit sample: they are routine enough to reveal how your process actually behaves rather than how it behaves when someone is watching. If that audit surfaces missing agreements or stale policies, start by putting the BAAs in place and then work outward to your risk analysis and policy set through the broader compliance document tooling. Fix the paperwork before the next 4:52 p.m. email arrives.