Handling Records Requests: What Every Business Should Know

Home Blog Handling Records Requests: What Every Business Should Know

Posted On: November 24, 2025

Receiving a request for records can feel unsettling—especially if you operate in allied healthcare, senior living, or any industry that handles sensitive information. Your first thought might be, “Am I being sued?” But before panic sets in, take a breath. A records request doesn’t automatically mean litigation is underway. In fact, these requests are often routine. The key is knowing how to respond correctly and promptly.

This guide will walk you through what to do, what to avoid, and how to protect your business every step of the way.

Why Records Requests Happen

Records requests can occur for several reasons:

Regulatory audits: State or federal agencies may review compliance.
Pre-litigation investigations: Attorneys may gather facts before filing a lawsuit.
Insurance claims: Carriers may need documentation to process a claim.
Quality reviews: Accrediting bodies may request records for certification purposes.

Understanding the context helps you respond calmly and professionally.

Step 1: Don’t Assume You’re Being Sued

One of the biggest mistakes businesses make is jumping to conclusions. A records request is not the same as a lawsuit. Often, it’s part of routine compliance or fact-finding. Treat the request seriously, but avoid unnecessary panic. Overreacting can lead to missteps—like sending too much information or making changes to records—which can create legal exposure.

Step 2: Notify Your Insurance Carrier Immediately

Your insurance carrier should be your first call. Why? Because most policies require prompt notice of any potential claim or legal matter. Even if the request seems minor, reporting it ensures:

Coverage is preserved: Late reporting can jeopardize your protection.
Expert guidance: Your carrier can advise on what to send, what to avoid, and how to respond.
Risk mitigation: They may involve legal counsel to protect your interests.

Example:
A home health agency receives a request for patient records from an attorney. The agency reports it to their carrier immediately. The carrier reviews the request, confirms it’s a pre-litigation inquiry, and provides instructions on responding. This proactive step prevents unnecessary exposure.

Step 3: Respond Promptly

Timeliness matters. Most requests include deadlines, and missing them can lead to penalties or escalate the situation. Once you receive the request:

Acknowledge receipt internally.
Consult your carrier before sending anything.
Prepare your response within the stated timeframe.

Tip: Create a checklist for handling records requests so your team knows the process.

Step 4: It’s Okay to Charge for Records

Many businesses don’t realize they can charge a reasonable fee for preparing and copying records. This is standard practice, but make sure:

Fees comply with state regulations.
Charges are communicated upfront.
You provide an itemized invoice if requested.

Compliance Tip: Some states cap fees for medical records. Check your local laws before invoicing.

Step 5: Send Only What’s Requested

When responding, stick to the scope of the request. Provide only the records specifically asked for—nothing more. Including extra documents or unrelated information can:

Create unnecessary exposure.
Reveal confidential details.
Complicate the situation.

Example:
If the request asks for patient records from January to March, don’t include April or May. Over-sharing can lead to privacy violations.

Step 6: Never Alter Records

This point cannot be overstated: do not make changes to records after receiving a request. Altering or editing documents—even small adjustments—can lead to:

Legal consequences.
Loss of credibility.
Potential criminal charges in some cases.

Always provide records as they exist—unaltered and complete.

FAQs About Records Requests

Q: What if I don’t have the requested records?
A: Notify the requester promptly and explain why the records are unavailable. Document your response.

Q: Can I refuse a request?
A: It depends. If the request is legally valid (e.g., subpoena, regulatory audit), you must comply. If it’s informal, consult your carrier before responding.

Q: Should I involve legal counsel?
A: Yes—especially if the request comes from an attorney or includes language suggesting litigation. Your carrier can help coordinate legal support.

Compliance Tips

Follow HIPAA and privacy laws: Ensure patient information is handled securely.
Document everything: Keep a record of the request, your response, and any communication.
Train your staff: Make sure employees know the process for handling records requests.

Final Thoughts

Receiving a request for records doesn’t have to be overwhelming. By staying calm, reporting promptly, and following these best practices, you can protect your business and handle the process with confidence. When in doubt, lean on your VGM Insurance account manager—they’re your partner in navigating these situations.

VGM Insurance