Which describes the proper handling of patient requests for access to medical records?

• A. Verify identity, provide records in compliance with applicable laws and policies, and document the request.
• B. Verify identity only.
• C. Delay the request until a formal court order.
• D. Provide records without verifying identity.

Answer: (A)

Access to medical records must protect patient privacy while honoring the patient’s right to access. The correct approach is to verify the requester’s identity to prevent disclosures to the wrong person, then provide the records in a manner that complies with applicable laws and internal policies (including format, redactions if needed, and timeliness), and document the request and the disclosure for accountability. This combination ensures legitimate access and a proper audit trail. Verifying identity alone isn’t enough without delivering records per policy, delaying a standard request for a court order isn’t appropriate, and providing records without verification risks improper disclosure.