A patient who transferred out of your practice at 32 weeks calls on a Monday and asks for "everything" from her prenatal care. Your front desk has thirty calendar days to respond, the chart is scattered across your EHR, an outside reference lab's portal, an ultrasound archive your imaging vendor hosts, and a maternal-fetal medicine consult note that arrived as a fax-to-PDF. This post is the administrative playbook for that request: how to start the clock correctly, who you must verify and how, what you can charge, and which vendors in that chain need a signed agreement before any of it moves.

Nothing here is clinical. It is release-of-information workflow, role assignment, and contract hygiene — the parts that generate complaints to the Office for Civil Rights when they go wrong.

Why a Prenatal Care Chart Is Never in One System

Obstetric episodes are long, scheduled, and multi-organizational by design. A single pregnancy generates encounters across your office, an outside laboratory, an imaging service, sometimes a specialist practice, and eventually a hospital labor and delivery unit that receives a transferred prenatal record packet late in the second or third trimester.

That matters administratively for one reason: your designated record set is defined by what you maintain and use to make decisions about the individual, not by what your EHR happens to display on one tab. If a genetic screening result arrived by interface and sits in your system, it is in the set. If an ultrasound report is stored only in a vendor-hosted archive that you control through a contract, it is still yours to produce.

Build the inventory once, on paper, before the next request lands. List every place prenatal care documentation lives, who at your practice can pull from it, and how long the pull takes. Most practices discover two or three surprises — a legacy scanning folder, a standalone fetal monitoring platform, a secure messaging thread with clinically relevant content.

How Long Do You Have to Fulfill a Prenatal Care Records Request?

Under HIPAA, you have 30 calendar days from receipt of the request to provide access, with one 30-day extension available if you notify the individual in writing within the original 30 days, state the reason for the delay, and give a firm completion date. The clock runs on calendar days, not business days. It starts when the request arrives at your practice — not when it reaches the release-of-information coordinator's desk, and not when the patient pays a fee. Several states impose shorter deadlines for medical records than HIPAA does, and where state law is more protective of the individual, the shorter deadline governs. Check your own state's medical records statute and calendar to the tighter of the two.

HHS's right of access guidance is the authoritative reference here, and it is worth printing and keeping in the ROI binder.

What "Received" Actually Means

Requests arrive by phone, portal message, walk-in, fax from the new practice, and occasionally a note handed to a medical assistant. All of them start the clock. Give your front desk one instruction: any request for records gets date-stamped and logged the same day, in the same log, regardless of channel.

You may require requests in writing and on your form, but only if you tell patients that and only if the form does not create an unreasonable barrier. You cannot require an in-person visit to submit it, and you cannot require the patient to explain why she wants her prenatal care records.

Verification: The Four Requesters Your Front Desk Will Actually See

Verification failures cause more trouble in obstetric records than timeline failures, because the requester pool is unusually crowded. Train to these four categories.

1. The Patient Herself

Verify identity by a reasonable method — photo ID for walk-ins, authenticated portal login for electronic requests, or knowledge-based questions plus a callback to the number on file for phone requests. Document which method you used. Do not overbuild this; requiring notarization is the kind of barrier OCR has repeatedly criticized.

Name changes are common across a pregnancy. If the request comes under a name that does not match the chart, verify against date of birth and address history rather than rejecting the request outright. Log the discrepancy and the resolution.

2. The Delivering Hospital, MFM Practice, or New OB

This is a treatment disclosure, not an access request, and it does not require patient authorization under the Privacy Rule. It also should not sit in your 30-day access queue for three weeks — clinical handoffs run on their own urgency. Route provider-to-provider requests to a separate fast lane, verify the requesting organization (fax cover from a known number, callback to a published main line, or a direct interface), and disclose the minimum necessary standard's exception for treatment: minimum necessary does not apply to treatment disclosures.

Track these separately in your log anyway. When a patient later complains that records "never got sent," you want a timestamped entry.

3. A Spouse, Partner, or Parent

A partner is not a personal representative simply by being a partner. Absent a written authorization, a health care power of attorney, or applicable state law making the person a representative, the answer is no — even when the person is standing at the desk, listed as an emergency contact, and paying the bill. HHS's personal representatives guidance is the reference to hand your staff.

Give the front desk a scripted decline that does not sound like an accusation, and give them one person to escalate to. Improvised answers at the desk are where this goes wrong.

4. Attorneys, Insurers, Employers, and Apps

These require either a valid authorization signed by the patient or a written, signed individual directive telling you to send her records to a named third party. The two paths have different fee rules and different documentation requirements — keep them on separate forms so staff cannot blend them.

If the patient asks you to send records to a consumer app, send them and document it. Once the data lands in an app that is not acting on your behalf, it leaves HIPAA's scope and may fall under the FTC's Health Breach Notification Rule instead. That is the app developer's problem, not yours, but your privacy officer should be able to explain the boundary in one sentence.

Minors, Emancipation, and the Newborn's Separate Chart

State law, not HIPAA, decides whether a parent is the personal representative of a minor patient. Many states allow a minor to consent to her own prenatal care, and in those states the minor generally controls the records of the care she consented to. Some states are silent, some carve out exceptions, and some tie the answer to emancipation status.

Do not let this get decided at the front desk. Build a one-page, state-specific matrix with your counsel, date it, and re-review it annually. Every minor-related request escalates to the privacy officer, full stop.

After delivery, the newborn is a separate individual with a separate designated record set, and the mother is ordinarily the newborn's personal representative. If your system ever co-mingles the two charts, fix that before the first request forces you to redact by hand. Separate MRNs, separate release workflows, separate logs.

Fees and Format: Two Places Practices Overcharge

When the individual requests her own records, you may charge a reasonable, cost-based fee limited to labor for copying, supplies, postage, and preparing an explanatory summary if she agreed to one in advance. You may not charge for search and retrieval, and you may not charge for the staff time spent verifying identity or reviewing the request. Requests directed to third parties follow a different fee analysis, and the case law here has shifted since the original 2016 guidance — have counsel confirm your fee schedule rather than copying a template.

Format matters just as much. If the patient asks for an electronic copy and you can readily produce it electronically, you must. Ultrasound imaging is where this gets awkward: a report PDF is not the same thing as the study. If she asks for images and your archive can export them, export them; if it cannot in the requested format, document the limitation and agree on an alternative in writing.

Unreasonable delay or an artificial barrier can also implicate the information blocking rules that apply to providers. The federal information blocking materials spell out the exceptions; "we only release on Fridays" is not one of them.

The Vendor Layer Underneath Every Prenatal Care Release

Walk the path a prenatal record travels and count the outside companies: the release-of-information service, the transcription vendor, the cloud imaging archive, the patient portal host, the fax-to-email gateway, the secure messaging platform, the courier, the shredding company. Each one that creates, receives, maintains, or transmits PHI on your behalf needs a signed business associate agreement before it touches a single chart.

Two clarifications staff get wrong. The delivering hospital is not your business associate — it is a covered entity receiving a treatment disclosure. The patient's health plan is not your business associate either. But the small ROI company your practice hired last spring absolutely is, and so is the imaging archive.

If your vendor list has grown faster than your contract file, you can generate a signature-ready business associate agreement through a six-step wizard and export it as PDF or DOCX — a one-time purchase, no subscription, which is usually the right shape for a practice closing three or four contract gaps at once. For the broader document set, including the risk analysis and policies that OCR asks for first in an investigation, automated HIPAA compliance documentation covers the same ground at the organizational level.

A Worked 30-Day Timeline

  1. Day 0 (Monday, June 1). Request arrives by portal message. Front desk date-stamps and logs it within the hour, assigns a request ID, routes to the ROI coordinator. Identity is verified by authenticated portal session; the coordinator notes that.
  2. Day 1. Coordinator scopes the request against the record inventory: EHR encounters, outside lab results, ultrasound reports and images, MFM consult. Sends the imaging export request to the archive vendor with a five-business-day service expectation.
  3. Day 4. Coordinator confirms format with the patient in writing — electronic delivery through the portal for documents, and a separate answer on image format.
  4. Day 12. Imaging export returns incomplete. Coordinator escalates to the privacy officer and re-requests.
  5. Day 22. Documents are ready; images are not. Privacy officer sends a written extension notice stating the reason and a completion date of Day 55, then releases the completed document portion immediately rather than holding everything.
  6. Day 41. Images delivered. Log closed with delivery method, date, and fee charged.

Note what made that work: partial release instead of an all-or-nothing hold, a written extension inside the first 30 days, and an escalation trigger tied to a specific day rather than a feeling.

What Your Log Has to Capture

One log, every request, six fields minimum: date received, requester category, verification method used, scope requested, date and method of fulfillment, and fee charged. Add a field for extension notices and one for denials with the reason and the review rights you offered.

Review the log monthly. You are looking for two patterns — requests that closed past day 30, and any requester category that keeps generating escalations. Both are training problems before they are enforcement problems. If you want to see how access complaints actually surface, the OCR breach portal and OCR's published enforcement summaries show how routine the underlying failures usually are.

One more housekeeping item worth a calendar entry: notice of privacy practices content has shifted over the past two years, including requirements tied to the substance use disorder confidentiality rule with a compliance date in early 2026, and a 2024 rule addressing reproductive health information that a federal court vacated in 2025. Ask your counsel to confirm which version of your NPP is current before your next print run.

Start With the Contracts

Pick the shortest path to a real improvement: pull your vendor list, mark every company that touches a prenatal chart, and find out which ones have a signed, current agreement on file. Close the gaps with a business associate agreement you can generate and sign this week, then fix the log, then run a timing audit on last quarter's requests. In that order.