When a patient requests access to their medical records, what is the proper response?

• A. Verify identity, provide access in a timely manner per law, and explain any limitations.
• B. Refuse to disclose records.
• C. Release all records immediately without verification.
• D. Only provide a summary without verification.

Answer: (D)

Access to medical records is a patient right, and the proper response centers on confirming who is asking and then providing access in a timely, lawful way. Start by verifying the patient’s identity to ensure you’re releasing information to the right person. Once identity is confirmed, locate the records and make them available in the form the patient requests—copy, file transfer, or secure electronic access—within the timeline set by law. If there are any limitations or specific exclusions (for example, certain notes kept separately or information that can legally be withheld under privacy rules), explain those clearly. If access cannot be granted in full for a lawful reason, provide a written justification and outline the patient’s right to appeal. Providing only a summary without verifying identity or ensuring proper access would miss the patient’s guaranteed rights and could breach privacy rules.