Medical Records

Find answers to some of the most commonly asked questions involving medical records.

TMA and TMLT Resources

The Texas Medical Association (TMA) offers an excellent publication Managing Your Medical Records that covers the rules of consent, release and disclosure, how to maintain and store your medical records in a HIPAA-compliant manner, how to apply appropriate measures for retaining and destroying them, and more.

TMA also provides several whitepapers, articles and other TMA resources on medical records.

The Texas Medical Liability Trust (TMLT) provides answers to FAQs.

For additional guidance from TMA and TMLT:

If disaster strikes, will your patients have access to their medical records? (TMA)
Recovering damaged records (TMLT)
Are your patient charts "missing in action"? (TMA)
Moving patient charts from paper to electronic form (TMA)
Know your rights to your patients' PHI (TMA) Can your EHR vendor block or terminate your access to your patients' records?
Access to medical records (TMA) (members only) Physicians must be aware of clauses in managed care and employment contracts.

Texas Medical Board Rules (TMB) Chapter 165 on Medical Records

For the TMB's complete and most up to date set of rules, refer to Chapter 165, Medical Records.

The Texas Medical Practice Act/Texas Occupations Code provides additional guidance regarding confidentiality and the information to be furnished by physicians under Title 3, Chapter 159: Physician-Patient Communication.

Amending Records

Medical records are legal documents and can even become evidence in legal proceedings. Altered records can make it impossible to defend a medical liability case. Even additions and comments made by well-meaning physicians who are attempting to clarify or elaborate on previous notes can compromise the integrity of a medical record.

The reality is everyone makes occasional mistakes when documenting medical records, but the methods used to correct those mistakes can make or break a physician in a legal challenge.

Guidance can be found from TMA under Never Alter Medical Records (instead, properly amend), as well as from Physicians Practice, Making Changes in Charts.

The Centers for Medicare and Medicaid Services (CMS) explains how to make amendments, corrections and delayed entries in medical documentation (refer to section 3/3.2.5).

Billing Records

TMB Rules 165.2(j) Billing Record Requests - In response to a proper request for release of medical records, a physician shall not be required to provide copies of billing records pertaining to medical treatment of a patient unless specifically requested pursuant to the request for release of medical records. TMB Rules 165.2(e)(4)(B) state a physician may charge separate fees for medical and billing records requested.

Although billing codes, including CPT and ICD-CM codes, reported on health insurance claim forms or billing statements should be supported by the documentation in the medical record TMB Rules 165.1(a)(9), the billing records themselves are not considered to be part of the medical record. Check your payer/plan contracts for any specific billing record retention requirements.

Contents of Records

TMB Rules 165.1(a) Contents of Medical Records - "Regardless of the medium utilized," each physician shall maintain an adequate medical record for each patient that is complete, contemporaneous and legible.

Also, refer to the TMB FAQs page and click on Laws and Rules, then Medical Records. It includes a link to the Position Statement by the Texas Medical Board on Electronic Medical Records.

From TMA, see Electronic medical records documentation pointers.

For more, see the TMA article Documenting Patient Care in EHRs Texas Medicine, July 2015 issue.

TMA also provides guidance on What not to include in a medical record.

TMLT, The Reporter, Volume 2 2015, provides guidance in the article EHR best practices: Complying with new TMB documentation rules. It discusses passwords, completing and locking notes, tracking and signing test results, the addendum process, the use of scribes, and more.

Deceased Patients' Records

The medical record retention guidelines also apply to the records of deceased patients.

Concerning the release of medical records of deceased patients: Outside of a court or administrative proceeding, family members do NOT always have access to a deceased patient's medical records. Instead, access to these medical records is restricted by law to someone who is designated as a "personal representative" of the deceased.

A "personal representative" is someone specifically named by the Texas Probate Code as having the authority, when appointed as such by the probate court, to transact business on the part of the estate. Before fulfilling a request for records of a deceased patient, TMLT advises physicians to ask for evidence of the person's legal capacity to obtain the deceased patient's records.

An authorized representative will have legal documents, called "Letters Testamentary" or "Letters of Administration," describing his or her legal authority. As long as the appropriate person is identified to consent to the release of medical records, the same rules apply to records of deceased patients as to the living.

Refer to the TMA whitepaper Access to Medical Records of a Deceased Patient (members only) that includes discussion on the billing exception to confidentiality.

Destruction of Records

TMB Rules 165.1(b)(8) - Destruction of medical records shall be done in a manner that ensures continued confidentiality.

The TMA Board of Councilors Opinion concerning confidentiality of patient records is: "Physicians face both an ethical and a legal responsibility to safeguard patient communications and information in patients' medical records..." 

Note: Please refer to Retention of Medical Records to determine when records may be destroyed and what types of records should be retained beyond the normal retention period.

When medical records are eligible for destruction, they can be cross-cut shredded (and recycled) or can be burned. TMA provides the following guidance when destroying medical records:
  • Maintain records scheduled for destruction in a secure location to guard against inappropriate access until the destruction is complete.
  • Whether you shred the records yourself in your office or hire a record destruction company, create a permanent record destruction log, individually listing all medical records with the following information:
    - Patient name and medical record number (or other identifier);
    - Date of destruction, combined with a notation that the record was destroyed in accordance with the retention policy; and
    - Signature of staff person performing the destruction, or if you are using a record destruction company, the name of the company and signature(s) of individuals witnessing the destruction. (Add signatures after the destruction has been completed.)
If an outside company is used,
  • First, obtain a current Business Associate Agreement with the destruction company.
  • Make sure the destruction contract specifies the method of destruction and time to elapse between acquisition and destruction.
  • Establish safeguards for confidentiality.
  • Follow the record destruction company's protocol for carrying out the actual destruction.
  • Obtain a certificate of destruction from the company and file it with your log.
  • Obtain a statement that records were destroyed in the normal course of business.
  • Indemnify your practice from loss due to unauthorized disclosure.

Refer to TMA's guidance How to Delete Data-for Real for advice on destroying electronic storage securely. Also, refer to the U.S. Department of Health and Human Services Guidance to Render Unsecured Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals consistent with NIST (National Institute of Technology and Standards) Special Publication 800-88 Guidelines for Media Sanitation such that the PHI cannot be retrieved.

Refer to the below section for document destruction resources.

Management, Storage, Retrieval, and Destruction Resources

For a list of Records Management, Storage, Retrieval, and Destruction Resources in the Houston area. (This list is provided as reference only; it is not an endorsement of any of these companies.)

Also, refer to the HCMS Buyers Guide under the sections Custodian of Records, Document Destruction, and Document Scanning and Imaging.

Photos and Videos in the Records

In some fields of practice photographs are a common way to document a patient's condition and response to treatment. These records are no different from narrative records; the photo is meant to document what is necessary to achieve an adequate medical record and should be considered part of that record. TMA provides additional information.

For patient access info, see TMB Rules 165.3 Patient Access to Diagnostic Imaging Studies in Physician's Office.

Records Request - Release Requirements

TMB Rules 165.2(a) Medical Record Release and Charges - As required by the Medical Practice Act/Texas Occupations Code 159.006, a physician shall furnish copies of medical and/or billing records requested or, if the patient prefers, a summary or narrative (members only) of the records pursuant to a written release of the info as provided by the Medical Practice Act 159.005.

However, both HIPAA and Texas code do provide some limitations if, in the physician's judgment, access to that info would be reasonably likely to endanger the life or physical safety of the patient or another person (see info below). Also, the physician may delete (from the copy only, not from the original record) confidential information about another patient or family member of the patient who has not consented to the release.

HIPAA permits physicians to disclose PHI to another health care provider for treatment purposes via fax or other means, as long as reasonable and appropriate technical, administrative, and physical safeguards are in place.

TMA's whitepaper Medical Records Release (members only) provides extensive guidance in areas such as HIPAA requirements, mental health records, 'super-confidential' information, release without consent, insurer access, and more.

The federal HIPAA requirements concerning authorization to release are very compatible (members only) with Texas law. However, HIPAA does preempt part of the Texas Health and Safety Code involving withholding mental health records.

Refer to the above TMA whitepaper Medical Records Release concerning mental health records, grounds for refusing release under Texas law for mental health and HIPAA preempts portion of the Texas code. Also, refer to grounds for refusing release under HIPAA regulations. (All links are members only)

TMA has a brief Sample Letter Authorization to Release Medical Records (members only). See also TMA's Medical Records page for a more detailed sample letter "Authorization to Release Medical Records."

Refer to information on the release of medical records of deceased patients.

TMA provides guidance on exceptions to health plan requests for PHI, as well as insurer access to medical records (members only).

For info on the rights of parents, including divorced parents, to access their minor child's chart, see our page on Treatment of a Minor (Rights of the Parents).

Records Request - Records Created By Other Physicians

TMB Rules 165.2(d) Contents of Records - For purposes of this section, "medical records" shall include those records as defined in 165.1(a) and shall include copies of medical records of other health care practitioners contained in the records of the physician to whom a request for release of records has been made.

Also, Medical Practice Act/Texas Occupations Code 159.006(a) and HIPAA guidance - Information furnished by physician: Unless the physician determines that access to the info is reasonably likely to endanger the life or physical safety of the patient or another person, a physician who receives a written consent for release of info as provided by Section 159.005 shall furnish copies of the requested billing or medical records, or a summary or narrative of the records, including records received from another physician or other health care provider involved in the care or treatment of the patient.

There is no exception in the act for documents that may be stamped "do not copy or forward" or "not for release."

Problem: While seeing a patient, a physician notices the patient's history is inconsistent with the previous medical record and is concerned about the care the patient received from a colleague.

Recommendation: TMA recommends the following: Simply note in the patient's chart, "Patient's history is inconsistent with prior medical records." Focus the conversation on the situation at hand and what treatment you can offer; and if appropriate, a physician can report to the TMB any quality or regulatory concerns.

Records Request - Processing Time Allowed

TMB Rules 165.2(b) Deadline for Release of Records - The requested copies of medical and/or billing records or a summary or a narrative of the records shall be furnished by the physician within 15 business days after the date of receipt of the request and reasonable fees for furnishing the information.

If the copy fee is not included with the request, then, within 10 calendar days from receiving the request, the physician shall notify the requesting party in writing of the need for payment. See withholding until request fee is received for information.

Records Request - Denial of Requests

TMB Rules 165.2(c) Denial of Requests for Records - If the physician denies the request for copies of medical and/or billing records or a summary or narrative of the records, either in whole or in part, the physician shall furnish the patient a written statement, signed and dated, within 15 business days of receipt of the request stating the reason for the denial and how the patient can file a complaint with the federal Department of Health and Human Services (if the physician is subject to HIPAA) and the TMB.

A copy of the statement denying the request shall be placed in the patient's medical and/or billing records as appropriate.

The federal HIPAA requirements concerning authorization to release are very compatible (members only) with Texas law. However, HIPAA does preempt part of the Texas Health and Safety Code involving withholding mental health records. (The following links are members only.) Refer to the TMA whitepaper Medical Records Release concerning mental health recordsgrounds for refusing release under Texas law for mental health and HIPAA preempts portion of the Texas code. Also, refer to grounds for refusing release under HIPAA regulations.

Records Request - Fees and Exceptions

TMA has developed an excellent whitepaper Fees for Copies of Medical Records (members only) which provides a comprehensive review of this subject. TMLT also provides guidance regarding the differences between federal and state rules in Clearing up the Confusion: Charging Your Patients for Medical Record Copies. Please note some Exceptions to the rules (below).

Under HIPAA allowable charges rules, a physician is not obligated, but may choose to use one of the following fee methods to provide a patient with a copy of the patient's medical records: 
  • Actual Cost - May calculate and charge the actual allowable cost, but only up to the allowable amount determined by the TMB (see below).
  • Average Cost - May develop a schedule of costs based on average, allowable labor costs to fulfill standard requests.
  • Flat Rate of $6.50 - May decide to charge the HIPAA flat rate of no more than $6.50 for requests of electronic copies, if he/she does not wish to calculate the actual costs up to the TMB maximum for electronic PHI. However, this flat rate is only an option and is not a cap on fees.

The Texas guidelines are different from federal rules in that the TMB allows physicians to charge patients a reasonable, cost-based fee for copies of their records based on the type of records requested – paper, electronic, or a combination. The charges should be reflective of the cost to actually produce the copies and practices should understand that the TMB charges are maximum allowable charges.  The TMB has set the following rules:

TMB Rules 165.2(e) Allowable Charges (Also, note some Exceptions to the fee allowance listed below.)
  • Paper Format (A) The physician responding to a request for such info in paper format shall be entitled to receive a reasonable, cost-based fee for providing the requested info. (B) A reasonable fee for providing the requested records in paper format shall be a charge of no more than $25 for the first twenty pages, and $.50 per page for every copy thereafter.
  • Electronic Format (A) The physician responding to a request for such info to be provided in electronic format shall be entitled to receive a reasonable, cost-based fee for providing the requested info in electronic format. (B) A reasonable fee for providing the requested records in electronic format shall be a charge of no more than: $25 for 500 pages or less; $50 for more than 500 pages.
  • Hybrid Records Format. (A) The physician responding to a request for such info that is contained partially in electronic format and partially in paper format ("hybrid"), may provide the requested info in a hybrid format and shall be entitled to receive a reasonable, cost based fee for providing the requested info. (B) A reasonable fee for providing the requested records in a hybrid format may be a combination of the fees as set forth in the above paragraphs.
  • Other Charges. (A) If an affidavit is requested, certifying that the info is a true and correct copy of the records, whether in paper, electronic or hybrid format, a reasonable fee of up to $15 may be charged for executing the affidavit. (B) A physician may charge separate fees for medical and billing records requested. (C) Allowable charges for copies of diagnostic imaging studies are set forth in §165.3 of this title (relating to Patient Access to Diagnostic Imaging Studies in Physician's Office) and are separate from the charges set forth in this section.
  • A reasonable fee for records provided in a paper, electronic or hybrid format may NOT include costs associated with searching for and retrieving the requested info, and shall include only the cost of: (A) copying and labor, including, compiling, extracting, scanning, burning onto media, and distributing media; (B) cost of supplies for creating the paper copy or electronic media (if the individual requests portable media) that are not prohibited by federal law; (C) postage, when the individual has requested the copy or summary be mailed; and (D) preparing a summary of the records when appropriate.

TMA provides additional guidance on Charging a Fee to Complete Forms. Also, refer to Exceptions below.

Practices that do not have EHRs do not have to provide patients with their medical records in electronic format. TMB rules say physicians should provide the records in electronic format if requested as such if they are "readily producible," or if not, in a format agreed upon by the physician and requester 165.2(a)

Exceptions to the fee allowance:
  • Disability Claims
    TMB Rules 165.2(k) Prohibited Fees for Records Released Related to Disability Claims - The allowable charges as set forth in this chapter shall be maximum amounts, and this chapter shall be construed and applied so as to be consistent with lower fees or the prohibition or absence of such fees as required by state statute or prevailing federal law. In particular, under §161.202 of the Texas Health and Safety Code, a physician may not charge a fee for a medical or mental health record requested by a patient, former patient or authorized representative of the patient if the request is related to a benefits or assistance claim based on the patient's disability.
  • Emergency Requests
    TMB Rules 165.2(f) Emergency Requests - The physician providing copies shall be entitled to payment of a reasonable fee prior to release of the info unless the info is requested by a licensed health care provider or a physician for purposes of emergency or acute medical care.
  • Past Due Accounts
    TMB Rules 165.2(h) Improper Withholding for Past Due Accounts - Medical and/or billing records requested pursuant to a proper request for release may not be withheld from the patient, the patient's authorized agent, or the patient's designated recipient for such records based on a past due account for medical care or treatment previously rendered to the patient.
  • Search Fee Not Allowed
    A physician may not charge a search fee when a practice must go into off-site storage to fulfill a records request. TMB Rules 165.2(e)(5) specifically prohibits charging a fee for searching for and retrieving the requested info, as does HIPAA.
  • Other Exceptions and Situations
    Refer to the TMA whitepaper Fees for Copies of Medical Records (members only) for additional info and guidance, including rules involving copy fees for mental health records, (the following links are members only) subpoenas, utilization review agents, or workers' compensation.

Records Request - Withholding Until Request Fee Received

TMB Rules 165.2(g) Non-emergent Requests - In the event the physician receives a proper request for copies of medical and/or billing records or a summary or narrative of the records for purposes other than for emergency or acute medical care, the physician may retain the requested info until payment is received.

If payment is not routed with such a request, within ten calendar days from receiving a request for the release of such records, the physician shall notify the requesting party in writing of the need for payment and may withhold the info until payment of a reasonable fee is received. A copy of the letter regarding the need for payment shall be made part of the patient's medical and/or billing record as appropriate.

If, however, the records are requested by a physician or health care provider for the purposes of providing emergency or acute medical care to the patient, then the records cannot be withheld. See 165.2(f).

Also, a physician may not withhold requested medical records based on a past due account.

TMA e-tip: See Withholding Copies of Records for Failure to Pay Copy Fee, as well as more extensive info in TMA's whitepaper on Medical Records Release on Withholding for Failure to Pay Copy Fee (members only)

See above for information on allowable fees and exceptions.

Retention Requirements and Exceptions

TMB Rules 165.1(b) Maintenance of Medical Records - (1.) A physician shall maintain adequate medical records of a patient for a minimum of seven years from the anniversary date of the date of last treatment by the physician. However, there are Exceptions:
  • Exception for minors: (2.) If a patient was younger than 18 years of age when last treated, the medical records shall be maintained until the patient reaches age 21 or for seven years from the date of last treatment, whichever is longer.
  • Exception for sexual assault victims: (3.) A licensed physician who conducts a forensic medical examination of a sexual assault victim shall maintain the medical records for 20 years from the date of the examination.
  • Exception for records related to legal proceedings: (4.) A physician may destroy medical records that relate to any civil, criminal or administrative proceeding only if the physician knows the proceeding has been finally resolved. (If in doubt, the physician may wish to place a note on the file that the records should be retained.)
  • Exception if mandated by other federal or state regulation: (5.) Physicians shall retain medical records for such longer length of time than that imposed herein when mandated by other federal or state statute or regulation. (Refer to below exception if health plan contact requirements differ.)
  • Exception if health plan contact requirements differ: It has been noted that some health plans, such as Medicare Advantage plans, sometimes include a requirement in their contracts that physicians retain their members' records for up to 10 years. Refer to each payer's contract language for any specific requirements.
  • Special consideration for Obstetric Patient's medical records: Per TMA, physicians who treat women during pregnancy may want to keep those patients' medical records longer than the seven years from date of last treatment, in case any issues arise regarding the prenatal care of the child (regardless if the physician did not actually deliver the baby, or participate in its care once it was born.) Most liability carriers suggest keeping the medical records until the baby the patient was carrying is 21 years of age; however, physicians should check with their liability carrier for recommendations specific to their situation.

These same retention guidelines apply to the medical records of deceased patients.

TMA recommends that practices design a retention schedule for each location where they maintain medical records. The plan should include provisions for the automatic transfer of eligible records to inactive storage, and later, destruction of the medical record itself. The policy should specify what to keep, how long to keep it, and what storage medium to use.

The TMA whitepaper Retention of Medical Records (members only) provides guidance in areas such as drug records, lost medical records, pathology-CLIA regulations, tax records, potential medical professional liability claims, and more.


TMA provides assistance on How to Respond to a Subpoena.

For info concerning copy fees and subpoenas, see the TMA whitepaper Fees for Copies of Medical Records-copy fees and subpoenas (members only)

For extensive guidance, see the TMA whitepaper Subpoenas for Medical Records (members only)

TMA also provides help on What to Do When You're Caught in the Middle of a personal injury suit.

TMA article provides guidance in Breaking Up Is Hard to Do: Physicians Can Get Subpoenaed in Divorce Cases.

Transfer Ownership / Discontinue Practice

TMB Rules 165.1(b)(6) Maintenance of Medical Records - Physicians may transfer ownership of records to another licensed physician or group of physicians only if the physician provides notice consistent with 165.5 of this chapter and the physician who assumes ownership of the records maintains the records consistent with this chapter.

TMB Rules 165.5 Transfer and Disposal of Medical Records - When a physician retires, terminates employment, or otherwise leaves a medical practice, he or she is responsible for:

(a) Required Notification of Discontinuance of Practice
     (1) Ensuring that patients receive reasonable notification and are given the opportunity to obtain copies of their medical records or arrange for the transfer of their medical records to another physician; and
     (2) Notifying the Texas Medical Board when they are terminating practice, retiring, or relocating, and therefore no longer available to patients, specifying who has custodianship of the records, and how the medical records may be obtained.
     (3) Employers of the departing physician...are not required to provide notification...the departing physician remains responsible for providing notification...

(b) Method of Notification
     (1) When a physician retires, terminates employment, or otherwise leaves a medical practice, he or she shall provide notice to patients of when the physician intends to terminate the practice, retire or relocate, and will no longer be available to patients, and offer patients the opportunity to obtain a copy of their medical records or have their records transferred.
     (2) Notification shall be accomplished by:
          (A) EITHER:
                (i) Posting such notice on the physician's or practice website; OR
                (ii) Publishing notice in the newspaper of greatest general circulation in each county in which the physician practices or practiced and in a local newspaper that serves the immediate practice area; AND
          (B) Placing written notice in the physician's office; AND
          (C) Notifying patients seen in the last two years of the physician's discontinuance of practice BY EITHER:
                (i) Sending a letter to each patient; OR
                (ii) Sending an email to each patient, in a manner that is compliant with state and federal law.
     (3) A copy of the posted notices shall be submitted to the Texas Medical Board within 30 days from the date of termination, sale, or relocation of the practice.
     (4) Notices placed in the physician's office shall be placed in a conspicuous location in or on the façade of the physician's office as a sign announcing the termination, sale, or relocation of the practice. The sign shall be placed at least thirty days prior to the termination, sale or relocation of the practice and shall remain until the date of termination, sale or relocation.

Note: As HCMS frequently receives calls from former patients who are looking for their medical records, please also notify our office so we may advise these patients who/where to contact to request a copy of their medical records. Call 713-524-4267, ext. 219, or send a letter to Harris County Medical Society, John P. McGovern Building, 1515 Hermann Dr, Houston, TX 77004-7126.

(c) Prohibition Against Interference (when a physician is leaving a group practice)
     (1) Other physicians remaining in the practice may not prevent the departing physician from posting notice and the sign.
     (2) A physician, physician group, or organization may not withhold information from a departing physician that is necessary for notification of patients.

For additional information, refer to our pages on Closing or Selling Your Medical Practice and Leaving a Group Practice.