Someone arrives at the desk asking for a copy of a patient's records. The receptionist has to decide, immediately, whether to hand over confidential clinical information. Without a written procedure, she is guessing, and the consequences of guessing wrong fall on the practice.

Establish who is asking

Requests come from several sources and they are not equivalent:

  • The patient themselves. The straightforward case, subject to identity verification.
  • A relative. Common in Nigerian practice and the most difficult. Being a spouse, parent of an adult child, or sibling does not by itself confer a right of access.
  • Another practitioner, for continuing care. Usually appropriate with the patient's consent.
  • An employer, insurer or HMO. Requires specific written consent from the patient for a defined purpose.
  • A lawyer or court. Requires proper legal process, and should go to a named senior person, never be handled at the counter.
  • Police or a regulator. Requires a clear legal basis, documented.

Verify identity every time

Photo identification for the requester, and for a representative, written authority from the patient. Record what was seen and by whom. This step feels bureaucratic with patients you recognise, and it is the step that protects you when the person you recognise turns out to be estranged from the patient.

Special cases to decide in advance

Children and young people, where parental access is normal but not unlimited as they mature. Patients who lack capacity, where authority has to be established rather than assumed. Deceased patients, where the request usually comes from family and the duty of confidentiality does not simply lapse. Records containing information about a third party, which may need to be redacted.

Each of these needs a decided position and a named person to escalate to. Do not leave them to be worked out at the desk.

Write down the process

A short procedure covering: how a request is made and recorded, who approves it, what identity checks are required, how long you take, what you charge if anything, how the records are handed over securely, and how the release is logged in the patient's file.

Every release should leave a trace showing what was given, to whom, on what authority, and when.

Give it in a usable form

A patient receiving a bundle of clinical notes with no explanation is often more confused than informed. Where the content is complex or difficult, offering an appointment to go through it is both better care and fewer follow-up complaints.

Train the desk on the boundary

The person most likely to face this request has the least authority to decide it. Their training should be simple: they take the request, verify identity, and pass it to a named person. Nobody hands over records at the counter on the spot, however reasonable the request sounds.