Can You Mail Medical Records to a Patient?

What HIPAA Says About Mailing Patient Records

Under the HIPAA Privacy Rule, patients have the right to access their protected health information (PHI) in the format they request. The practice must reasonably accommodate that format.

Physical mail is a valid delivery method. The rule does not restrict record delivery to digital portals or in-person pickup.

When a patient asks for records by mail, the practice must respond within 30 days. HIPAA allows a single 30-day extension if the practice notifies the patient in writing and explains the reason for the delay.

Most routine requests (visit summaries, lab results, treatment records) can ship well within that window.

How to Mail Records Securely

Compliance does not end at putting papers in an envelope. The method of mailing determines whether the practice meets HIPAA's safeguard requirements.

Verify the recipient's identity. Confirm the request came from the patient or their authorized representative. A phone request should be followed by a signed authorization form before records leave the office.

Use the patient's confirmed address. Mail records only to the address the patient provides in their written request. Do not use an address from an older record or a third-party directory.

Choose a trackable delivery method. USPS Certified Mail with Return Receipt provides a paper trail confirming delivery. For sensitive records — behavioral health notes, HIV-related information, substance abuse treatment records — consider requiring a signature on delivery.

Mark the envelope appropriately. Do not print "Medical Records" or the practice name's clinical specialty on the outside of the envelope.

Use a plain outer envelope with a return address that uses the business name without clinical identifiers. This reduces the risk of inadvertent disclosure.

Log the disclosure. HIPAA requires practices to maintain a disclosure log (accounting of disclosures) for certain types of record sharing. Document the date, recipient, content, and purpose of every mailed record.

When Mailing Is Not the Best Option

Physical mail works for straightforward requests, but digital alternatives are faster, more secure, and easier to audit.

A HIPAA-compliant patient portal lets patients download their records immediately without waiting for postal delivery. Calysta Pro EMR's patient portal, for example, gives patients 24/7 access to visit summaries, treatment notes, and appointment history — no mailing delay, no envelope to misroute.

For practices that still receive mail requests, understanding what an EMR letter is helps staff prepare records in the format patients expect. And for patients who want to restrict how their records are shared, learn more about patient opt-out rights.

What to Include in Mailed Records

Patients are entitled to the designated record set, which includes clinical notes, lab results, imaging reports, medication lists, and billing records.

Psychotherapy notes maintained separately by a provider are excluded under HIPAA unless the patient specifically requests them and state law permits disclosure.

When preparing records for mailing, include a cover letter that identifies the enclosed documents, references the patient's written request, and provides a contact number for questions. The cover letter also serves as your internal confirmation that the request was fulfilled.