Free template

Records request response template

By Albert Wong, PhD, Clinical Psychologist

A release-of-information request arrives — from a client, a new provider, an attorney, an insurer — and it deserves a response that is prompt, exact, and no wider than the authorization behind it. This template is that response: a cover letter with interchangeable sections for the common situations (fulfilling the request, asking for a valid authorization first, excluding separately kept psychotherapy notes, offering a summary, charging a fee), and a before-you-send checklist that catches the mistakes that actually happen — expired authorizations, scope creep, and the wrong recipient.

A starting point, not a finished document. Records-release rules combine federal privacy law with state law and your profession's rules, and the details — deadlines, fees, minors, withholding provisions — differ by state. Have your attorney and your licensing board's current guidance review your version, and call your attorney or malpractice carrier before denying any request.

The template

Plain text — paste into any EHR or document

[Practice letterhead]

[Date]

[Requester name]
[Organization]
[Address]

RE: Request for records — [Client name], DOB [date of birth]
    Your request dated [date], received [date]

Dear [Requester name],

I am writing in response to your request for records relating to the above client's
treatment at this practice.

[Keep the sections that apply, and delete the rest:]

[A — Fulfilling the request:]
Enclosed are the records authorized for release: [describe — e.g., treatment summary /
progress notes from (date) to (date) / intake and assessment records]. This disclosure
is made under the authorization signed by [client name / legal representative] on
[date], which permits release of [scope] to [recipient].

[B — A valid authorization is needed first:]
I am not able to release records based on the request as received, because the request
[is not signed by the client or their legal representative / has expired / does not
specify what information may be released or to whom / other]. Enclosed is an
authorization form; once I receive it completed and signed, I will respond promptly.
This is not a refusal — it is a step I am required to take to protect the client's
confidentiality.

[C — Psychotherapy notes, if you keep them separately:]
Please note that psychotherapy notes maintained separately from the general record are
not included in this release. Under federal privacy rules they require their own
specific authorization, and the enclosed records constitute the releasable clinical
record: [list].

[D — A summary in place of the full record, where appropriate and permitted:]
In place of the complete record, I have enclosed a treatment summary covering
[dates of service, diagnoses, treatment provided, and progress]. If the full record is
required, please let me know and we can discuss what is needed.

[E — Fees, if you charge one:]
A fee of $[amount] applies for [copying / preparation], calculated as permitted by
applicable law. [An invoice is enclosed / The fee was received on (date).]

If you have questions about this response, please contact me at [phone / email].

Sincerely,

[Name, credentials]
[License type and number]
[Practice name, address, phone]

Enclosures:  [ ] Records ([n] pages)   [ ] Authorization form   [ ] Invoice

--------------------------------------------------------------------------------
BEFORE-YOU-SEND CHECKLIST (keep this half; do not mail it)

[ ] The authorization is signed, dated, and not expired or revoked
[ ] It names this practice as the party releasing information
[ ] It names the recipient, and the enclosed records are going to that recipient
[ ] It describes what may be released — and the enclosures match that scope exactly
[ ] Separately kept psychotherapy notes are excluded unless specifically authorized
[ ] Information about third parties has been reviewed before release
[ ] For minors or represented clients: the signer has authority to authorize release
[ ] The response is within the required timeframe
[ ] Records are sent by a secure, trackable method
[ ] A copy of the request, the authorization, and this letter is filed in the chart

How to use it

Log the date every request arrives — response deadlines run from receipt.
Keep only the lettered sections that apply; a response that includes section B and section A together contradicts itself.
Match the enclosures to the authorization's scope exactly — releasing more than was authorized is the classic error, and the checklist half of the template exists to catch it.
Remember the client's own access request is the one you should be slowest to question and fastest to fulfill — clients generally have a right to their records.
File the request, the authorization, and your response letter in the chart; the paper trail is half the point.

Common questions

How quickly do I have to respond to a records request?

Federal privacy rules generally give covered providers up to 30 days to respond to a client’s own access request, and many states set shorter deadlines — sometimes much shorter. Requests tied to legal proceedings can carry their own dates. Treat every request as a clock that started the day it arrived, log that date, and check the timeframe that applies to your state and profession.

Are psychotherapy notes included when someone requests "the records"?

Not automatically — but only if you actually keep them as psychotherapy notes in the technical sense: process notes maintained separately from the general clinical record. Those get special protection and need their own specific authorization. Your regular progress notes, kept in the chart, are part of the record and do not get that protection, no matter how sensitive their content.

Can I send a summary instead of the full record?

Sometimes. For many third-party requests, a treatment summary is both permissible and kinder to the client — and many requesters (a new provider, a disability reviewer) actually prefer one. For a client’s own access request, federal rules generally allow a summary only if the client agrees to it. When in doubt, ask the requester what they actually need; it is often less than "everything."

What if I believe releasing the records could harm my client?

There are narrow provisions for withholding information when a licensed professional judges that access is reasonably likely to endanger someone — but they are exceptions, not a general veto, and clients typically have review rights when they are invoked. Discomfort, awkward content, or an unpaid balance is not a lawful basis for refusal. If you are considering denying a request, this is precisely the moment to call your attorney or malpractice carrier first.

Can I charge for copies?

Generally yes, within limits — federal rules constrain what you can charge clients for their own records to reasonable, cost-based fees, and states cap fees in various ways. Third-party and attorney requests often follow different fee schedules. Whatever you charge, state it in your response rather than surprising the requester, and never hold records hostage to an unrelated unpaid therapy balance.

Related tools

Practice Harbor — an EHR built by a psychologist — keeps notes, intake documents, and signed authorizations in one chart, which makes assembling a records response a search instead of an excavation.

More free templates

Browse the full template library → · See our free practice tools →

This template is general information, not legal advice. Federal and state records-release rules differ and change — have your attorney and your licensing board's guidance review your final version before use.