Medical Record Access Report Template: HIPAA-Compliant Documentation

Purpose

This template documents **who accessed a patient's medical record, why, when, and what information was disclosed** – required for HIPAA Accounting of Disclosures, breach investigation, and workforce accountability.

Medical Record Access Report

Field	Description / Example
Report ID	Unique tracking number (e.g., MRAR-2024-004521)
Patient Name / MRN	Full legal name + Medical Record Number
Date/Time of Access	YYYY-MM-DD HH:MM (24-hr); timezone
Accessing Individual	Name, title, employee ID, department, NPI if provider
Access Method	EHR (Epic/Cerner/etc.), paper chart, imaging system, portal, API, fax, verbal
Reason for Access (Purpose)	Treatment, Payment, Operations, Patient Request, Legal/Subpoena, Public Health, Research (IRB#), Quality, Emergency
Information Accessed	Specific modules: Progress notes, Labs, Radiology, Meds, Demographics, Psychotherapy notes (special protection), Billing, Entire record
Information Disclosed/Exported	Printed, faxed, emailed, downloaded, printed to PDF, verbal summary – to whom?
Authorization Basis	Patient consent (signed), TPO (no auth needed), Court order, Subpoena, Mandatory reporting, Research waiver, Emergency
Minimum Necessary Met?	Yes/No/Partial – explanation if No
Action Taken / Outcome	Clinical decision, claim submitted, record mailed, quality review completed, breach containment
Additional Notes	Unusual circumstances, patient complaint, system error, training issue
Reported By	Name, role, date/time
Privacy Officer Review	Name, date, determination (routine / investigate / breach)

Signature & Attestation

I attest that the above information is accurate and complete. I understand my obligation to protect PHI under HIPAA and organizational policy. Unauthorized access or disclosure is subject to disciplinary action and legal penalties.

Signature: _________________________   Date: ______________
Printed Name: ______________________   Role: ______________

Regulatory Context

• HIPAA §164.528: Right to accounting of disclosures (6 years).
• HITECH Act: EHR access logs required (3 years).
• State laws: May require broader accounting (e.g., CA, TX).
• Audit trail integrity: System-generated logs are primary; this form supplements for non-electronic or contextual detail.

Best Practices

• Automate via EHR audit logs; use this form for manual/paper disclosures.
• Train all workforce on minimum necessary & logging.
• Quarterly privacy officer audit of high-risk accesses (VIP, coworkers, self, family).
• Retain reports 6+ years.

This template is a framework. Adapt to organizational workflow, EHR capabilities, and state law. Not legal advice.