A family that suspects someone improperly opened or shared a medical chart needs to do more than ask for “the HIPAA records.” A copy of the chart, an accounting of disclosures, and an investigation of employee access answer different questions. A carefully written request should identify each one and preserve the evidence needed to determine what happened.
By Stephen Babcock · Louisiana Legal Research · Reviewed October 27, 2026.
This guide explains the available requests without assuming that suspected access was unlawful. It includes a printable family checklist (PDF) and a sample letter below. A pending lawsuit, disputed custody arrangement, or threatened disclosure warrants advice tailored to the records and people involved.
Four requests that serve different purposes
Scroll horizontally to see all columns. Use the arrow keys when the table is focused.
| What you need | What to request | What it does not establish |
|---|---|---|
| Your medical information | A copy of the treatment and billing records covered by the right of access. | The chart alone may not identify everyone who viewed it. |
| Information about covered disclosures | An accounting under 45 C.F.R. § 164.528, with a specified date range. | An accounting is not a complete history of all internal access or all permitted disclosures. |
| Evidence about suspected access | Preservation of relevant access logs, messages, exports, and investigation materials. | A preservation request does not automatically entitle you to every underlying document. |
| An explanation and corrective action | A written complaint to the provider’s privacy officer, followed when appropriate by an OCR complaint. | A complaint does not itself establish liability or award damages. |
Start with the chart and the Louisiana records statute
HIPAA’s access rule, 45 C.F.R. § 164.524, generally covers protected health information in a designated record set. Request the relevant treatment dates, billing records, test results, and records used to make decisions about the patient. Separately maintained psychotherapy notes and information prepared for litigation are among the exclusions; the ordinary treatment chart is not excluded merely because care involved mental health.
The federal rule generally requires action within 30 days, with one additional 30-day extension if the provider supplies the required written explanation and completion date. A denial must identify its basis and explain applicable review and complaint rights. Request an electronic copy if it is readily producible in that form, and ask for a fee estimate before agreeing to a charge.
Louisiana supplies an additional basis for the request. La. R.S. 40:1165.1(A)(1) addresses copies of patient-related information a provider transmitted to another person or organization. Subsection (A)(2)(c) addresses production within a reasonable period, no longer than 15 days after receipt of the request and written authorization, and provides a particular notice-and-court-enforcement procedure. A missed date does not produce an automatic damages payment.
Identify the patient, the records sought, the delivery method, and your authority to receive them. Keep proof of receipt. Louisiana’s copying-charge provisions and HIPAA’s cost-based fee limitations must be considered together; a state fee ceiling does not excuse a charge prohibited by applicable federal law.
An accounting is not a list of every employee who opened the chart
Under 45 C.F.R. § 164.528, a patient may request an accounting covering as much as the preceding six years, or a shorter period. A covered entry generally identifies when information was disclosed, who received it, what was disclosed, and the purpose. The regulation excludes categories that include disclosures for treatment, payment, and health care operations, and disclosures made under an authorization.
The response period generally is 60 days, with one permitted extension of up to 30 days and written notice. The first accounting in a 12-month period is free. Internal viewing by an employee is a different issue from a disclosure to someone outside the organization. An empty accounting therefore does not prove that no one improperly accessed a chart.
Ask the privacy officer to preserve and investigate access
Describe the event that raised the concern: a statement, letter, message, portal notification, or information someone appeared to possess. Give dates and explain what you know firsthand. Separate those facts from what you suspect. Avoid sending unnecessary medical details to people who are not handling the complaint.
Ask the provider to preserve the relevant electronic access history, audit records, downloads or exports, communications, and investigation materials. HHS guidance on audit controls explains their role in recording and examining activity involving electronic health information. Those security obligations do not create a blanket patient right to receive every security log or employee investigation file.
Request an explanation of the findings that can lawfully be shared, the reason any access was considered authorized, and any corrective measures affecting the patient. A preservation letter identifies evidence to retain; it is not a subpoena or a court order. Counsel may need to pursue other lawful means of obtaining evidence.
When a parent is requesting a child’s records
Under 45 C.F.R. § 164.502(g), a parent or guardian with legal authority to make health care decisions generally acts as the child’s personal representative for the relevant information. Exceptions can arise when a minor lawfully consents to particular care, a court or another authorized person consents, or a parent agrees to a confidential relationship. State law and the circumstances of the care matter.
The rule also addresses situations involving abuse, neglect, or endangerment. Supply the custody order, guardianship papers, or other authority requested through a secure channel. If access is refused, ask for the legal basis and whether the refusal concerns all records or only a particular category.
School health records require a separate analysis. The joint guidance from the U.S. Departments of Education and Health and Human Services distinguishes records governed by FERPA from those governed by HIPAA. FERPA-covered education records are excluded from HIPAA’s definition of protected health information; some private schools are not subject to FERPA. A hospital’s chart and a school’s copy should not automatically be treated as having identical access rules.
Sample request to the provider’s privacy officer
Adapt this letter to the facts. Use the provider’s designated secure submission method, and include the identification or authorization it reasonably requires. Keep a dated copy and confirmation of delivery.
Subject: Patient records request, disclosure accounting, and preservation request
I am [patient’s name / the legally authorized representative of patient’s name]. My authority is [brief description]. Please tell me how to submit any necessary identification securely.
Please provide an electronic copy of the treatment and billing records for [date range], together with patient-related information transmitted to [identified recipient, if known], as applicable under 45 C.F.R. § 164.524 and La. R.S. 40:1165.1. Please provide a fee estimate before incurring charges.
Separately, I request an accounting of disclosures for [date range] under 45 C.F.R. § 164.528. I understand that this accounting has exceptions and may not include internal employee access.
My privacy concern is [concise facts, dates, and supporting documents]. Please preserve relevant access and audit records, exports, communications, and investigation materials, and investigate whether access or disclosure was authorized. Please explain the findings and corrective action that can lawfully be shared.
Please confirm receipt, identify the person handling each request, and state any additional information needed. For any denial or limitation, please provide the basis and applicable review or complaint procedure. My secure contact information is [contact].
Complaints and civil claims follow different procedures
A complaint to the federal Office for Civil Rights can address suspected HIPAA privacy, security, or breach-notification violations. OCR’s complaint instructions generally require filing within 180 days after the complainant knew the act or omission occurred; OCR may extend that period for good cause. Identify the entity, describe the conduct, and retain the submission. Do not assume that an internal hospital investigation extends that deadline. Retaliation for filing a complaint is prohibited.
HIPAA does not itself create a private cause of action for damages. The Fifth Circuit made that clear in Acara v. Banks, 470 F.3d 569 (5th Cir. 2006). Whether Louisiana law supplies a separate claim depends on the conduct, injury, parties, and applicable deadlines. An OCR complaint and a civil case are different proceedings; neither should be treated as automatically preserving the other.
Keep a short, complete file
- The original notice, message, or other evidence that raised the concern.
- A timeline separating what occurred, when you learned of it, and what remains uncertain.
- The chart request, authorization, disclosure-accounting request, and preservation letter.
- Delivery confirmations, fees, responses, denials, and follow-up dates.
- A record of who received sensitive information, using secure storage rather than a public shared folder.
Download the one-page medical-record privacy checklist. Related guides explain hospital inspection and deficiency records and Louisiana child-care licensing records. Those public regulatory records serve different purposes from a child’s confidential medical chart.
Part of Louisiana Legal Research. This guide provides general legal information, not advice about a particular patient, disclosure, or lawsuit.