Q&A: Requesting an entire medical record

Q: Does the HIPAA Privacy Rule strictly prohibit the disclosure or request of an entire medical record? If not, does there need to be a case-by-case justification every time an entire record is disclosed?

A: The Privacy Rule does not prohibit the disclosure of an entire medical record, but it does apply the “minimum necessary” rule (see 45 CFR §164.514(d)). You may release the entire record if it is specifically justified as the amount reasonably necessary to accomplish the purpose of the request (for example, a valid subpoena that requests “any and all records” on an individual). You may also release a complete copy of the record if the patient provides written authorization to do so.

Editor’s note: This question was answered by Mary D. Brandt, MBA, RHIA, CHE, CHPS. Brandt is a healthcare consultant specializing in healthcare regulatory compliance and operations improvement. She is also an advisory board member for BOH. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are those of the author and do not represent HCPro or ACDIS.