Respond to a patient's request for their medical records

Help me handle a request for medical records at our practice. Who is asking: [the patient / parent of a minor / personal representative / another provider / attorney / third party named by the patient] Date received and how: [DATE, portal, email, mail, in person] What they asked for: [e.g. "complete record", "last 2 years of visit notes and imaging"] Format requested: [paper, PDF by email, portal download, send to an app or third party] Our record systems: [EHR, old paper charts, outside imaging system] Our state: [STATE] Anything sensitive in the record: [e.g. psychotherapy notes, substance use treatment records, minor's confidential services] Walk me through: 1. Whether this is a HIPAA right-of-access request or a disclosure needing the patient's authorization, and what verification we need for the requester. 2. The response clock: 30 calendar days, with one 30-day extension if we notify the patient in writing with a reason. Note if state law is shorter: [CONFIRM STATE RULE]. 3. Providing the records in the form and format requested if readily producible, including unencrypted email if the patient asks after being told the risk. 4. Fees: only a reasonable, cost-based fee for copying labor, supplies, and postage; no fees for search or retrieval. Mention the flat-fee option and that state limits may apply. 5. Items with special rules: psychotherapy notes, 42 CFR Part 2 records, and limited grounds for denial with review rights. 6. Information blocking considerations under the 21st Century Cures Act. Return a step-by-step checklist, a response letter template (fulfilling, extending, or partly denying), and a log entry template. This is general information; confirm state law with our privacy officer or counsel.