You have 30 calendar days. The clock started the moment a parent emailed your front desk asking for "everything from the surgery," and nobody logged it. Requests tied to a meckel's diverticulum workup are among the messiest your release-of-information queue will see, because the record almost never sits in one building. This article is for the administrator, privacy officer, or ROI clerk who has to assemble that chart, verify who is allowed to receive it, and close the request inside the deadline — without triggering an access complaint or an information blocking claim.

No clinical guidance here. The only clinical fact that matters administratively is this: the condition is congenital, frequently identified in childhood, and workup typically pulls in an emergency department, an imaging facility, a surgical practice, and a pathology lab. Four organizations, four record systems, one patient asking you for the whole story.

How long does a practice have to respond to a records request?

Under the HIPAA Privacy Rule, you must act on an individual's request for access within 30 calendar days of receiving it. You may take one 30-day extension if you give the requester a written notice inside the original window that states the reason for the delay and the date you will deliver. Only one extension is permitted.

  • Day 0: the day the request arrives at any intake point — fax, portal message, email, front desk, mailed letter.
  • Day 30: deliver the records, deliver a written denial with review rights, or send the extension notice.
  • Day 60: hard outer limit if you took the extension.

State law may be shorter and more protective, and where it is, it controls. Several states require production in 15 business days or less. Build your internal service level to the shortest applicable deadline, not the federal one. HHS's individuals' right of access guidance is the controlling reference; keep a printed copy in your ROI binder.

Why a meckel's diverticulum encounter produces a fragmented record trail

Because the diagnostic and surgical pathway crosses organizations, the "chart" a requester pictures does not match the chart you hold. A primary care practice may hold the referral note and a discharge summary someone faxed over. The imaging center holds the study and the radiologist's report. The surgical group holds the operative report. The lab holds the pathology report and the specimen.

Two consequences for your workflow. First, you owe the requester the protected health information in your designated record set — including records you received from other providers and use to make decisions about the patient. Second, you should not silently drop the parts you don't have. Tell the requester what you produced and where the rest lives.

What belongs in the designated record set

Anything your practice maintains and uses to make care or payment decisions about that patient. For a meckel's diverticulum episode, that commonly includes:

  • Office notes, referral letters, and the referral order
  • Outside reports you filed into the chart — radiology impressions, operative reports, pathology reports
  • Imaging your practice holds, in the format you hold it
  • Lab results, vitals, growth records for pediatric patients
  • Billing and claims records, including denials and appeal correspondence

Not in scope: psychotherapy process notes, information compiled for use in a legal proceeding, and quality-assurance material that isn't used to make decisions about the individual. Do not use "peer review" as a catch-all to withhold ordinary clinical documentation — that argument does not survive an OCR review.

Verification: the step that gets skipped and then investigated

You must verify the identity and authority of the requester before you disclose. HIPAA does not prescribe a specific method, which means your written procedure is the standard you'll be measured against. Write it, then follow it every time.

Minors and personal representatives

Most pediatric requests come from a parent acting as the patient's personal representative. A personal representative generally stands in the shoes of the individual and gets the same access. Your intake form should capture the relationship, and your procedure should specify what documentation you require when the relationship isn't obvious — guardianship orders, custody documents, or an adoption decree.

Split custody is where practices lose control. Absent a court order limiting a parent's access, both parents typically retain rights as personal representatives. Do not let one parent instruct you to block the other on a phone call. Require the document, file it, and note the file location in your ROI log. HHS's personal representatives guidance walks through the framework and the narrow circumstances where you may decline to treat someone as a representative.

Adults requesting their own childhood records

This is common with this diagnosis. A 31-year-old needs documentation of a childhood bowel resection for a pre-operative evaluation, a military accession file, or a life insurance underwriting question. The patient's name may have changed. Your legacy system may be archived, read-only, or held by a vendor you no longer pay monthly.

Two things to fix before that request arrives. Keep a documented retrieval path for retired systems, including who at the vendor can produce a legible export and how long it takes. And keep the vendor relationship papered — an archive holding PHI is a business associate, whether or not you're still an active customer.

Fees, formats, and the third-party directive trap

When an individual exercises the right of access, you may charge only a reasonable, cost-based fee: labor for copying, supplies such as media, postage if mailed, and preparing an explanation or summary if the individual agreed to one in advance. You may not charge for search and retrieval. HHS's access guidance also describes a flat-fee option — $6.50 or less — for electronic copies of PHI maintained electronically.

Format matters too. If the individual requests an electronic copy and you can readily produce it in the requested form, produce it that way. A patient asking for a PDF should not receive a 90-page paper packet and a bill for it.

Be careful distinguishing a patient access request from a third-party authorization. Litigation in 2020 narrowed the reach of HHS's earlier position on third-party directives and the patient-rate fee cap, and the two request types now follow different fee and handling rules in practice. Train your ROI staff to classify at intake: is the individual asking for their own copy, or is an attorney, insurer, or disability examiner asking on the strength of a signed authorization? Route them down different tracks with different fee schedules and different logs.

Vendors in the chain — and the BAA you can't find

Walk the path a meckel's diverticulum record actually takes out of your office. A transcription service touched the operative note. A release-of-information or copy-service vendor may print and mail the packet. An imaging archive holds the study. A secure file transfer tool moved the pathology report. A fax-to-email gateway received the discharge summary.

Every one of those is a business associate, and every one needs a signed agreement in place before PHI moves. In records-request work the gap is almost always the copy service or the archive vendor — the ones nobody thinks of as "IT." If your vendor inventory has names without corresponding agreements, close that gap now; you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX, one-time purchase, which is faster than waiting for a vendor's legal team to send a draft you'd have to redline anyway.

Keep the executed agreements where the ROI staff can see them, not only in the CFO's contract folder. The person about to upload a chart to a portal should be able to confirm in 30 seconds that the portal's operator is under agreement.

Information blocking is the second rulebook

Right of access is one obligation. Information blocking under the 21st Century Cures Act is another, and it applies to electronic health information regardless of whether a formal HIPAA access request was made. Practices that interfere with access, exchange, or use of EHI without an applicable exception face disincentives, and HHS finalized provider disincentives in 2024.

Practical translation for a records clerk: delay is a risk, not just a service failure. "We only release imaging after the physician reviews it with the family" is the kind of informal policy that reads as a blocking practice. Review your standing holds against the exceptions listed on ONC's information blocking resource page and document which exception you're relying on when you do delay.

A worked example: twelve days, four sources

A guardian requests "all records" for a 10-year-old following a hospitalization and surgical consult four months earlier.

  1. Day 0. Front desk logs the request in the ROI tracker with timestamp, requester name, relationship, and delivery preference. Due date auto-calculated to the shorter of state law and day 30.
  2. Day 1. Privacy officer verifies guardianship documentation; scans it to the request file.
  3. Day 2. ROI clerk scopes: office notes, referral, outside radiology and pathology reports on file, immunization record, billing ledger. Flags that the practice holds the radiology report but not the images.
  4. Day 4. Clerk confirms requested format (encrypted portal delivery) and quotes the fee in writing.
  5. Day 9. Packet assembled, second reviewer checks for another patient's PHI misfiled into the chart — the single most common cause of small breaches in ROI work.
  6. Day 11. Delivered via portal. Cover letter identifies the imaging facility and lab by name and address so the guardian can request the remainder directly.
  7. Day 12. Log closed with delivery confirmation retained for six years.

That second-reviewer step at day 9 is the cheapest control in the whole workflow. Misdirected records are a reportable breach, and they show up on the OCR breach portal alongside far more dramatic incidents.

Denials, partial production, and review rights

If you withhold anything, say so in writing, in plain language, and explain the basis. Certain denials carry a right to review by a licensed professional who was not involved in the original decision. Your notice must tell the individual how to seek that review and how to complain to you and to OCR. A partial production with no explanation of what was left out invites a complaint that would otherwise never have been filed.

Three sentences your front desk should have memorized

  • "I'm logging your request right now and I'll give you the date we'll have it by."
  • "I need to confirm your identity and your authority to receive this child's records — here's exactly what I need from you."
  • "We hold part of this record; here's the name and address of the facility that holds the imaging."

Those three lines convert most access disputes into routine transactions. Post them at the desk.

Close the loop before the next request

Pull your last twenty records requests this week. Check three things: was every request timestamped on arrival, was verification documented, and does every vendor that touched a packet have a current agreement on file. If the third question stalls you, start with a Business Associate Agreement you can execute today, then work outward to the broader documentation set — risk analysis, policies, and workforce training — through automated HIPAA compliance documentation. Records requests tied to a meckel's diverticulum episode will keep arriving years after the encounter. The workflow you write now is the one that answers them.