A patient calls on day 34. She asked for her complete laryngopharyngeal reflux workup — the ENT consult notes, the flexible laryngoscopy images, the pH probe study, the outside GI records your office had faxed over — and she got two pages and a bill for $75. Your front desk says the scope video "isn't part of the chart." Your billing coordinator says the $75 covers staff time pulling it. Both answers are wrong, and both are the kind of wrong that shows up in an OCR complaint.

This post is about the administrative machinery behind that request: who verifies the requester, what counts as the designated record set, what you can charge, when the clock stops, and which vendors in the chain need paper in place before any of it moves. No clinical guidance here — the condition is context, not subject.

Why a Laryngopharyngeal Reflux Chart Is Scattered Across Four Systems

Laryngopharyngeal reflux is one of those complaints that rarely lives in a single organization. A patient with persistent hoarseness or throat clearing typically starts at primary care, gets referred to otolaryngology, may see gastroenterology, and often ends up with a speech-language pathologist for voice therapy. Each stop generates records, and several of those records sit in specialty systems that don't feed your main EHR.

That fragmentation is an administrative problem, not a clinical one. When the request arrives, your records staff is assembling from:

  • Office notes and problem lists in the main chart
  • Endoscopy images and video stored in a separate media or PACS-style archive
  • pH or impedance study data held in a device vendor's software, sometimes cloud-hosted
  • Voice therapy notes from an SLP who may be contracted rather than employed
  • Faxed or portal-delivered records from the referring practice and from GI
  • Transcription output that never got attached to the encounter

All six categories are in play. Records you received from another provider and used to make decisions about this patient are part of your designated record set. "Someone else generated it" is not a release exception.

The 30-Day Clock: What the Rule Actually Requires

Here is the short version your records coordinator should have taped to the monitor.

You have 30 calendar days from receipt of the request to provide access, and you may take one 30-day extension if you notify the individual in writing within the original 30 days, with the reason and the date you'll deliver. That is one extension, not a rolling one. The clock starts when the request arrives at your practice — not when it reaches the right department, not when the provider signs off, not when the patient pays.

Three things that do not pause the clock: waiting on a co-signature, waiting for the patient to pay a fee, and waiting for an outside facility to send you something you already have a duty to produce from your own files. State law can shorten the deadline — several states require turnaround well under 30 days — and the shorter requirement governs. Check your state's medical records statute and calendar to that number, not the federal ceiling.

HHS keeps the controlling guidance at its individuals' right to access their health information page. Print it. Give it to whoever owns records release.

Form and Format Matter as Much as Timing

If the record is maintained electronically and the patient asks for an electronic copy, you produce it electronically in the form and format requested if you can readily do so. A PDF export of a laryngoscopy image series counts. Telling the patient to come pick up a paper printout because "that's how we do it" does not.

Mail, email, secure portal, USB drive — if the patient specifies an unsecure channel like unencrypted email and you warn them of the risk in writing, you can honor it. Document the warning and the patient's confirmation in the request log.

Verifying the Requester Without Building an Obstacle Course

You must verify identity. You may not use verification as a stalling tactic, and OCR has been explicit that unreasonable verification hurdles are a barrier to access. The balance is procedural: define the acceptable methods in advance, apply them uniformly, and log which one you used.

Reasonable Methods by Channel

  • In person: government photo ID, copied or logged by number and type.
  • Patient portal: authenticated session is your verification. Do not ask a logged-in patient to also fax a driver's license.
  • Phone or mail: two or three matching data points — date of birth, address on file, last four of a stored identifier, recent date of service.
  • Personal representative: the legal document establishing authority — healthcare power of attorney, guardianship order, or parental status under your state's minor-consent rules.

Write these four lines into your access policy verbatim. When a new hire asks "can I release this," the answer should be a lookup, not a judgment call.

The Personal Representative Trap

Adult children calling about a parent's laryngopharyngeal reflux evaluation are common, and they are usually not personal representatives. A spouse's name on the emergency contact field grants nothing. Your front desk needs a scripted response — "I can accept a signed authorization from the patient, or a healthcare power of attorney naming you" — and a place to route the caller so the conversation ends cleanly.

Fees: What You Can Charge and What You Cannot

This is where practices lose enforcement actions. The permitted fee is limited to:

  • Labor for copying the PHI, whether paper or electronic
  • Supplies — paper, toner, USB drive, disc
  • Postage, if the patient asks for mail delivery
  • Preparing an explanation or summary, only if the patient agreed to that in advance

You may not charge for search and retrieval, for verification, for time spent locating the pH study file in the device vendor's portal, for QA review, for redaction, or for the systems that store the data in the first place. Those are costs of doing business.

Three pricing approaches are available: actual cost calculated per request, an average-cost schedule you develop and publish, or a flat $6.50 for electronic copies of PHI maintained electronically. Pick one, document the math behind it, and post it where patients and staff can both see it. A practice that cannot explain how it arrived at its number is a practice that will refund it.

Third-Party Directives Are a Different Animal

When a patient directs you to send an electronic copy of electronically maintained records to a third party — a new ENT, an attorney, a disability examiner — the right of access still applies to that request. Following the Ciox Health v. Azar decision in 2020, the patient-rate fee limitation does not extend to third-party directives, and the directive right itself was narrowed to electronic copies of records held in electronic form. Requests that arrive as a signed HIPAA authorization from an attorney's office are authorization requests, not access requests, and are priced under state law instead.

Train staff to sort incoming requests into two buckets on arrival — patient access versus authorization — because the timeline, the fee, and the log entry all differ. Mislabeling is the root cause of most fee disputes.

Where Your Vendors Sit in the Chain

Assembling a laryngopharyngeal reflux record set usually means touching systems your practice does not own. The imaging archive holding scope stills. The cloud platform the pH catheter vendor provides. The transcription service. The release-of-information company, if you outsource. The fax-to-email gateway your referral coordinator uses without thinking about it.

Every one of those is a business associate if it creates, receives, maintains, or transmits PHI on your behalf, and every one needs a signed agreement before data moves. Not a handshake, not a line in the master services agreement, not a boilerplate PDF from 2015 that predates your current subprocessors. HHS explains the scope at its business associates guidance page.

If your vendor inventory has gaps — and after any device or software change it usually does — you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX. One-time purchase, no subscription, which matters when you need three agreements this quarter and none next quarter. Close the gap before the next records request forces the question.

Ask Vendors One Specific Question

"How does a patient get an electronic copy of the data you hold, and how fast?" If the device vendor's answer is a support ticket with a five-business-day SLA, you have just consumed a sixth of your 30-day window. Negotiate that turnaround into the agreement or build the delay into your internal deadline.

A Day-by-Day Workflow You Can Actually Staff

  1. Day 0: Request received through any channel. Date-stamped and logged within four business hours. Classified as access or authorization. Verification method recorded.
  2. Day 1–2: Records coordinator inventories sources — main chart, image archive, device platform, SLP notes, outside records on file. Scope confirmed with the patient if the request is ambiguous ("everything" usually means everything).
  3. Day 3–5: Vendor pulls initiated. Fee quoted in writing using the published schedule.
  4. Day 10: Status check. Anything outstanding escalates to the privacy officer, not to a reminder sticky note.
  5. Day 15: Assembly complete. Reviewed for correct patient, correct date range, no other patient's PHI in the packet.
  6. Day 20: Delivered in the requested format. Delivery method and date logged.
  7. Day 25: Hard stop. If not delivered, written extension notice goes out today — with the reason and the new date — not on day 29.

The internal deadline is day 20 so the extension notice is never a scramble. Practices that calendar to day 30 miss it.

Denials, Partial Releases, and the Paper Trail

Grounds for denying access are narrow, and most of them do not apply to a routine specialty workup. Psychotherapy notes and information compiled for legal proceedings are excluded outright. Reviewable denials require a licensed professional's determination and a documented review process — that is not something your records clerk decides on a Tuesday.

If you deny in part, you still release everything else, on time, with a written explanation of the denial basis and the patient's review rights. A partial release with a clear letter is defensible. Silence is not.

Keep the request log for six years: date received, requester, verification method, scope, fee charged and basis, delivery format, delivery date, and any extension notice. This log is the single most useful document you will hand an investigator, and OCR's Right of Access Initiative — running since 2019 with dozens of announced resolutions, most involving small and mid-sized practices — has repeatedly turned on whether one existed.

Information Blocking Overlaps This Workflow

Delaying electronic health information without a qualifying exception can be information blocking, a separate regulatory exposure from HIPAA with its own enforcement path. Providers face disincentives under the framework finalized in 2024. The practical overlap: a records process that stalls on internal approvals is exposed twice for the same delay. ASTP/ONC maintains the exception details on its information blocking resource page.

If your policy set has not been reviewed against both frameworks, that review belongs on this quarter's list alongside your risk analysis and policy documentation.

Three Sentences for the Front Desk

Most access failures start at the counter, not in the records room. Give your staff exactly three lines:

"I can take that request right now and date-stamp it." / "Here is our fee schedule in writing before you decide." / "You'll hear from our records coordinator within five business days with a status."

No one says "we don't release scope video." No one quotes a price from memory. No one tells a patient to come back with a subpoena.

Pull your last ten completed requests this week. Check the received date, the delivery date, the fee charged, and whether a business associate agreement covers every system you touched to fill them. If any vendor in that chain lacks current paper, draft and export the agreement before the next laryngopharyngeal reflux referral turns into a records request you cannot fulfill on time.