Prompt Pilotby Write.law
All prompts

Draft

Respond to a medical records request

Sorts a records request into the right legal pathway (patient access, authorization, or subpoena), then produces the validity checklist, the release-and-withhold call on sensitive categories, and the letter that goes back.

About 20 minintermediateHealthcare, Privacy

Your prompt5,043 characters

Still to fill in: The request, verbatim, What the chart holds, State law to layer on HIPAA

RoleYou are a health-information lawyer who has answered records requests from patients, plaintiffs' firms, insurers, and prosecutors. You decide which pathway a request travels before you decide what to send, because the pathway sets the deadline, the fee, the scope, and the grounds for refusing. You never release a chart because a document arrived on letterhead.What I needRespond to the request below for Who I am, on the Individual right of access (patient or personal representative) pathway, with the records law of State law to layer on HIPAA layered over HIPAA.InputsThe request, verbatim: The request, verbatim Pathway I selected: Individual right of access (patient or personal representative) What the chart holds: What the chart holds Who I am: Who I am State law to layer on HIPAA: State law to layer on HIPAA Received, and any clock running: Received, and any clock already runningHow to work this1. Test the pathway against the paper first. Access (§ 164.524), authorization (§ 164.508), and judicial disclosure (§ 164.512(e)) carry different deadlines, fees, and refusal grounds. If what I pasted does not match the pathway I picked, say so in your first line. 2. Validate the instrument, each element marked present, defective, or missing: the § 164.508(c) core elements for an authorization; which § 164.512(e)(1)(ii) assurance route a subpoena claims and whether it is actually made; for access, what proof of representative authority you want first. 3. Sort What the chart holds into release, withhold, and needs-its-own-order. Part 2 substance use disorder records, psychotherapy notes, HIV and genetic results, and a minor's records where the minor holds the right need more than an authorization or a subpoena. 4. Fix the clock and the fee, federal kept separate from state. Give HIPAA's outer limit and the cost-based access ceiling, then mark the State law to layer on HIPAA deadline, per-page schedule, and pre-release notice rule [UNVERIFIED - confirm in the current code]. 5. Draft the letter: what is enclosed, what is not and on what ground, the fee itemized to what this pathway permits, and the deadline you are meeting. 6. For anything withheld, name the requester's next move: § 164.524(a)(4) review, a motion to compel, a Part 2 order under subpart E, then write the release-log entry.Close with these four sections, every time, without being askedAssumptions I made. Who holds the right to this record, whether the authorization is still live, what sits in the designated record set, and which State law to layer on HIPAA statute governs. Mark each [verify] or [safe]. Where this is weakest. The two or three sentences most likely to draw a motion to compel, a patient complaint, or an OCR inquiry. Name the sentence, not "the response generally." What only you can decide. Options with tradeoffs, not flags. At minimum: object and force a qualified protective order (slower, costs a motion, keeps the chart under an order you can enforce) versus serve the objection, let the window run, and produce, which is faster and puts the record in a file you no longer control. Whether to charge the full permitted fee to a firm standing behind a patient's signature is yours. What would make this materially better. Rank by impact: the signed authorization itself, proof of service on the patient's counsel, the designated-record-set inventory, and the current state fee schedule.Output formatA one-line pathway determination; the instrument-validity checklist; the release / withhold / needs-its-own-order table; the clock and fee with state items flagged for verification; the letter ready to send; the release-log entry; then the four closing sections.Never do this- If the letter would fit any request at any provider, it is too generic. Name this requester, this chart, this instrument, this date. - No hedging filler. Cut "arguably," "it should be noted," and "out of an abundance of caution" used in place of a determination. Do not tell me to consult privacy counsel. I am privacy counsel. - Never invent a state statute number, a fee figure, a deadline, or a regulatory citation. Anything outside my inputs is marked [UNVERIFIED - confirm before releasing]. - Where you do not know whether State law to layer on HIPAA demands more than HIPAA here, say you do not know and name where to look. Do not smooth the gap over with fluent prose. - Do not pad. A refusal resting on one clean ground beats one resting on four. Length is not value.Before you answer- Did I test the pathway against the actual paper before drafting? - Is every element of the instrument marked present, defective, or missing? - Is every sensitive category in this chart in one of the three columns? - Did any state deadline or fee figure go out unmarked? - Would this letter fit a different request? It should not.

Adds driver's-seat tunes: options instead of answers, questions before work, every citation flagged. Your values come with it.

2

Pressure-test it

Makes the AI switch hats and attack its own answer.

This response is the exhibit to somebody's motion to compel. Read it as the requesting lawyer who drafted the subpoena and has moved to compel four times this year. Which objection do you attack first as boilerplate, which withheld category do you argue the patient already put in issue by filing suit, and where does the letter concede more scope than it had to? Then rewrite the two weakest sentences and tell me which ground I should drop because it will not survive a hearing.
3

Go deeper

Pushes the work further once the basics are right.

On day one this request should have hit a protocol, not a lawyer. Write that intake and routing protocol: the four questions the records clerk asks of every incoming request, the decision tree that sorts it into a pathway, the categories that must be escalated to counsel before anything ships, the log fields captured on every release, and the two-sentence script for telling a requester their paper is defective.

Before you run it

What to gather first

  • The request itself, verbatim: cover letter, subpoena, and any attached authorization
  • Whether the chart contains substance use disorder treatment, psychotherapy notes, HIV or genetic results
  • Whether the patient is a minor, deceased, or represented by a personal representative
  • The date the request was received and how, and whether any extension has been taken
  • Which state's health-records statute and fee schedule applies to this provider

Watch for

  • State response deadlines and per-page fee schedules run shorter and lower than the federal floor and change frequently. Read the current code. Do not accept any deadline or fee figure the model produces without checking it.
  • Substance use disorder records under 42 C.F.R. Part 2 do not travel on a subpoena, and a HIPAA authorization plus a subpoena together is still not enough. A court order meeting the Part 2 standard is a separate application.
  • A third-party request routed through a patient's signature is not a right-of-access request. Getting this backwards either overcharges a patient or misapplies the access clock.
  • Producing more than was asked for is a disclosure the patient can complain about. Match the release to the scope of the instrument, not to the convenience of exporting the whole chart.
  • Do not paste identified patient records into a model. Describe the chart's contents and categories instead of pasting them.

What comes back

A one-line pathway determination; an instrument-validity checklist marking each required element present, defective, or missing; a three-column release / withhold / needs-its-own-order table keyed to the actual chart; the clock and the fee with every state-law item flagged for verification; the response letter ready to send; the release-log entry; and the four collaboration sections.

See an example of what you’ll get
Pathway determination. This is not an authorization request, whatever the cover letter calls it. Vance & Roth attached a Rule 45 subpoena plus a 2/28/2024 authorization signed for a workers' compensation claim that expired by its own terms. It travels § 164.512(e), and roughly half the chart does not travel that road at all. Instrument validity - Subpoena: no written statement of notice to Ms. Alvarez, no qualified protective order, no proof of service on her counsel. § 164.512(e)(1)(ii) is not satisfied. Do not produce on this paper. - Authorization: fails § 164.508(c)(1)(iv): stated purpose is "workers' compensation claim," not this litigation. Fails § 164.508(c)(1)(v): expiration date passed 3/1/2025. Names Sentry Insurance as recipient, not Vance & Roth. Release / withhold / needs its own order | Portion | Call | Ground | |---|---|---| | ED note 6/12/2024, imaging, ortho follow-ups | Release once assurances land | Within the scope the plaintiff put in issue | | IOP episode, Northshore Recovery | Withhold; needs a Part 2 court order | 42 C.F.R. §§ 2.64–2.66; subpoena plus authorization is still not enough | | Psychotherapy notes, Dr. Rennell | Withhold | § 164.508(a)(2): separate authorization required | | HIV serology 7/3/2024 | Hold; state rule controls | [UNVERIFIED - confirm the Illinois AIDS Confidentiality Act release standard before any release] | Clock. Return date 5/2/2026, but the operative date is the Rule 45(d)(2)(B) objection window: 4/24/2026. [UNVERIFIED - confirm the state analogue's objection period if this is a state-court subpoena.] Letter (excerpt). "Northshore is a covered entity and, as to a portion of the requested records, a Part 2 program. We object to the subpoena served April 10, 2026 because it is unaccompanied by the assurances required under 45 C.F.R. § 164.512(e)(1)(ii). Separately, records of Ms. Alvarez's treatment at Northshore Recovery cannot be produced on a subpoena, on a HIPAA authorization, or on both together; a court order satisfying 42 C.F.R. §§ 2.64–2.66 is required, and this office will not treat any narrower instrument as sufficient." Fee. Nothing chargeable under § 164.524. This is not an access request, so the cost-based cap does not apply and the state litigation-copy schedule governs instead. [UNVERIFIED - confirm the current Illinois per-page rate and handling charge.] --- Assumptions I made. Ms. Alvarez is an adult with capacity and no guardian [verify]. Her personal injury complaint pleads physical injury only, not emotional distress, which is why the psychotherapy notes are not in issue [verify against the complaint]. Northshore Recovery is a federally assisted Part 2 program [safe - per your input]. Where this is weakest. The sentence conceding the ortho records are "within the scope the plaintiff put in issue." You have not seen the complaint. If the pleading is narrower than assumed, you just volunteered scope you did not have to give. What only you can decide. Object and force them to a qualified protective order: costs a motion, buys two months, and keeps the chart under an order you can enforce, or serve the objection, wait out the window, and produce the non-sensitive portion, which is cheaper and faster and puts the record in a file you no longer control. Also yours: whether to charge the state litigation rate to a firm that is nominally acting for your former patient, and whether anyone calls Ms. Alvarez before this mails. What would make this materially better. Ranked by impact: (1) the complaint in *Alvarez v. Metro Transit*: it decides whether the IOP episode and the psychotherapy notes are in issue at all, and it is the one document that would let me narrow or widen the withhold column instead of assuming; (2) proof that the subpoena was served on Ms. Alvarez's counsel, which is the single missing § 164.512(e)(1)(ii) element that could still be cured this week; (3) the designated-record-set inventory for the Northshore Recovery episode, so the Part 2 boundary gets drawn by your own records rather than by my assumption about where the program's chart ends; (4) the current Illinois per-page schedule and AIDS Confidentiality Act release standard: the two [UNVERIFIED] marks still sitting in the letter and the fee line.
Why this prompt is built the way it is
## Framework 1. **Pathway first.** Access under 45 C.F.R. § 164.524, authorization under § 164.508, and judicial disclosure under § 164.512(e) are three regimes with different deadlines, fees, scopes, and refusal grounds. Nothing else can be decided until this is. 2. **Validate the instrument, element by element.** An authorization missing a core element is not an authorization. A subpoena without satisfactory assurances is not a release. 3. **Watch for the pathway swap.** A third-party request routed through a patient signature to reach the access fee cap is the most common one, and it changes the fee, not the scope. 4. **Sensitive categories carry their own key.** Part 2 substance use disorder records, psychotherapy notes, HIV and genetic results, and some minors' records need more than HIPAA paper. 5. **Federal floor, state ceiling.** State deadlines and fee schedules routinely run shorter and lower. Read them; never recall them. 6. **Say what is withheld and why.** Silent redaction is how a records dispute becomes a sanctions motion. 7. **Log it.** The release-log entry is the document that answers the complaint two years later.