A patient falls off a bike on a Saturday, gets an X-ray at urgent care, leaves in a splint, sees a hand surgeon eleven days later, has an MRI at a freestanding imaging center, and ends up with a confirmed scaphoid fracture and a surgical consult. Six weeks after that, your front desk receives a one-page request asking for "all records and images." Four separate organizations hold pieces of that chart, and only one of them is you. This article covers the administrative side of that request: the 30-day access clock, how much verification is defensible, what you can charge, which pieces of the record you actually owe, and which vendor agreements have to be in place before anything leaves your building.

Why a Scaphoid Fracture Chart Lands on Four Different Desks

Wrist injuries of this type routinely generate repeat imaging and a specialist referral — initial films are frequently inconclusive, so a second study weeks later is common. That clinical pattern has an administrative consequence you live with: the record fragments across an urgent care or primary care visit, one or more imaging facilities, an orthopedic or hand practice, and often physical or occupational therapy afterward.

Each of those organizations is a separate covered entity maintaining its own designated record set. You are obligated to produce what you maintain, not what a downstream specialist maintains. But patients rarely know that, and a request that says "everything about my wrist" will land in your inbox expecting the imaging center's DICOM files too.

Your policy needs a documented answer for that moment. The correct answer is not a denial. It is: produce your designated record set within the deadline, and tell the requester in writing which other organizations hold the remainder, with contact information if you have it. That single sentence in your response letter prevents most complaints.

How Long Do You Have to Release Scaphoid Fracture Records to a Patient?

Thirty calendar days from receipt of the request. You may take one extension of no more than 30 additional days, and only if you give the patient a written statement within the original 30 days explaining the reason for the delay and the date you will deliver. There is no second extension.

  • Day 0: the date the request arrives at your practice — not the date it reaches the records clerk.
  • Day 30: records delivered, or a written extension notice issued.
  • Day 60: absolute outside limit if an extension was properly noticed.
  • State law may be shorter. Several states impose tighter deadlines and lower fee caps. Your written procedure should follow whichever rule is more protective of the patient.

HHS's right of access guidance is the controlling reference here, and it is worth keeping a printed copy in the records binder. Most access complaints OCR resolves involve nothing more exotic than a practice that took ninety days and never sent an extension notice.

What "Receipt" Means in Practice

The clock starts when the request reaches your organization through any channel you've held open: patient portal message, fax, mail, email to a published address, or a form handed across the front counter. If a request sits unread in a clinical inbox for two weeks, you have burned two weeks.

Fix this with routing, not vigilance. Every intake channel needs a named owner and a same-day handoff to whoever runs release of information. Date-stamp on arrival, log it, and treat the log as the primary evidence you'd hand an investigator.

Verification That Holds Up Without Becoming an Obstacle Course

You must verify the identity of the requester. You may not build a process so burdensome that it functions as a denial. Those two obligations coexist, and the practical middle ground is narrower than most front-desk habits assume.

Defensible: matching identifiers against the chart, a portal login, a copy of a photo ID, a callback to the phone number on file, or a signed request form. Not defensible: requiring notarization, requiring the patient to appear in person when they asked for electronic delivery, requiring them to explain why they want the record, or refusing to accept a request that didn't use your preferred form.

Personal Representatives and Minors

Wrist injuries of this kind show up frequently in adolescent athletes, so parent and guardian requests are common. A parent is generally the personal representative of an unemancipated minor and steps into the patient's shoes for access purposes — but state law governs the exceptions, including situations where the minor consented to care independently or where a court has limited a parent's authority.

Write your minor-access rules down, with a citation to your state statute, and train to them. Do not leave that judgment call to whoever happens to be covering the front desk on a Friday afternoon.

Attorney and Third-Party Requests

A letter from a personal injury attorney is not automatically a right-of-access request. Sort incoming requests into three buckets on arrival:

  1. Patient access under 45 CFR 164.524 — patient-rate fees, 30-day clock.
  2. Patient-directed transmission to a third party — still an access request, but it must be in writing, signed, and clearly identify the recipient and delivery destination. Note that a 2020 federal court decision in Ciox Health v. Azar narrowed the scope of the mandatory third-party directive; treat that pathway as applying to electronic copies of PHI held in an electronic record.
  3. Disclosure on authorization under 164.508 — a valid authorization with all required elements, and standard fees may apply.

Misfiling bucket 2 as bucket 3 is how practices end up overcharging patients. Misfiling bucket 3 as bucket 2 is how practices end up releasing more than the authorization covered.

Images Are Part of the Record, and Format Requests Are Binding

If your practice maintains the radiographs, the radiology report, or copies pulled in from an outside facility for treatment purposes, those items sit in the designated record set. A patient who asks for the images gets the images — not just the narrative report.

You must provide the copy in the form and format the patient requests if it is readily producible. If it isn't, you negotiate: an agreed alternative electronic format, or a hard copy. "Our imaging vendor doesn't make that easy" is not an exception, and refusing an electronic copy you're capable of producing can also raise information blocking exposure under the Cures Act rules. ONC's information blocking resources spell out the actors, exceptions, and complaint pathway.

One practical step: before the next request arrives, test your own export path. Have someone produce a complete de-identified sample package — visit notes, imaging report, image files, referral correspondence — and time it. If it takes four hours and two phone calls to a vendor, you have a workflow problem that a 30-day deadline will eventually expose.

Fees: Cost-Based, Narrow, and Frequently Wrong

For patient access requests, you may charge a reasonable, cost-based fee limited to labor for copying, supplies such as media, postage, and — only if the patient agreed in advance — preparing a requested explanation or summary.

You may not charge for search and retrieval, for data storage or maintenance, for the time a clerk spends verifying identity, or for per-page fees that exceed your actual costs when the record is electronic. HHS guidance also describes an optional flat fee not to exceed $6.50 for electronic copies of PHI maintained electronically, which many practices adopt simply to remove the argument.

Post your fee schedule. Put it on the request form. When a patient asks for six weeks of records spanning multiple imaging studies, quoting a per-page charge you can't justify is the fastest route to a complaint.

Workers' Comp and Employer Requests Follow Different Rules

Many of these injuries happen at work — a fall from a ladder, a slip on a loading dock. Within weeks, you will hear from a workers' compensation carrier, a third-party administrator, or the employer directly.

These are not right-of-access requests, and the analysis is separate. Disclosures for workers' compensation purposes are permitted as authorized by and to the extent necessary to comply with state workers' comp laws under 45 CFR 164.512(l). Disclosures to an employer conducting medical surveillance or evaluating a work-related injury have their own narrow conditions, including written notice to the individual.

Keep a one-page decision tree at the records desk: Who is asking? Under what authority? What is the minimum necessary set that authority reaches? The most common failure is sending a full chart — including unrelated history — when the carrier's authority reached only the injury episode.

The Vendor Layer Nobody Logs Until an Audit

Count the third parties that touch a scaphoid fracture record on its way out the door. A release-of-information or copy service. A fax-to-email gateway. An image exchange or CD-burning service. A transcription vendor. A courier. A secure messaging platform. An e-signature tool used for the authorization itself.

Every one of those is a business associate, and every one needs a signed agreement on file before it handles PHI. When you add a new imaging exchange partner because a referring surgeon prefers it, the agreement has to exist on day one — not after the first transfer. If you need to close that gap quickly, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX, one-time purchase, which is usually faster than routing a request through counsel for a routine vendor.

Maintain the vendor inventory as a living list with three columns: vendor, function, agreement date. Review it quarterly against your accounts payable ledger. Shadow vendors show up in the ledger long before they show up in your compliance file.

A 30-Day Workflow You Can Hand to Staff

  • Day 0 — front desk: date-stamp, log, classify as access / third-party directive / authorization / workers' comp. Confirm receipt to the requester in writing.
  • Day 1 — records staff: verify identity using an approved method. Confirm the scope requested and the delivery format.
  • Days 2–5 — records staff: assemble the designated record set, including imaging held by your practice. Note which items belong to outside organizations.
  • Day 7 — privacy officer: review any request touching a personal representative, a minor, or a legal dispute before release.
  • Days 8–20 — records staff: deliver by the requested method. Quote fees in advance, in writing, if any apply.
  • Day 25 — privacy officer: anything unfulfilled gets an extension notice with a stated reason and a firm delivery date.
  • Day 30 or Day 60 — closeout: log delivery date, method, contents, and fee charged. Retain the log for six years.

Three Ways These Requests Actually Go Wrong

Silence. The request arrives, gets forwarded to a clinician for review, and nothing happens for seven weeks. OCR's Right of Access Initiative has produced a long series of enforcement actions since 2019, most resolving with monetary settlements and corrective action plans, and delay is the recurring theme.

Misdirected delivery. A fax number transposed by one digit, or a record mailed to a prior address on file. That is an impermissible disclosure requiring risk assessment and, in most cases, notification through the HHS breach reporting portal. Confirm the delivery destination against the signed request before transmitting, every time.

Over-disclosure. An attorney authorization limited to a single injury episode, answered with a complete longitudinal chart. Assign one person to compare the authorization scope to the assembled packet, and document that check.

None of this requires new software. It requires a routing rule, a log, a fee schedule, a decision tree, and a vendor inventory that matches reality. If your broader policy set, risk analysis, and workforce training documentation are thinner than your records workflow, the automated HIPAA document and risk analysis toolset is a reasonable place to close that gap. Start with the vendor list, though — pull it up today, and confirm that every name on it has a current signed agreement behind it.