Read this guide freely. Request download access with your name and email.
GDF records the selected resource in its lead intake and private Stats.
Open your emailed link for seven days of preparation downloads in this browser.
No marketing subscription is created. Keep completed records in controlled systems.
Help a legal and technical team identify relevant clinical, administrative and audit records for a medical matter and prepare a lawful, precise specialist handoff.
Attorneys, paralegals, business/medical contacts, project coordinators and client IT
Medical treatment, documentation, privacy and related disputes. It is not a medical opinion, determination of altered records, an EMR vendor extraction manual or authority to access patient data.
Use the clinical episode, relevant issues, patient identifiers and date range selected by counsel. The EHR/EMR may be one of several systems. Ask about separate imaging, laboratory, pharmacy, practice-management, claims, portal, interface, legacy and backup sources.
Distinguish a chart rendering, the underlying clinical record, version/amendment information, audit events and billing records. They can answer different questions. Ask what the actual export includes before assuming a printed chart is the full electronic record.
HIPAA audit-control requirements and health IT certification guidance support asking about logging; they do not establish that a particular product/site logged every action, kept every version or retained it for a fixed period. Request vendor/version, enabled events, field definitions, clock information and earliest/latest available dates.
A subpoena is not automatically the same as a court order under HIPAA. Counsel and the covered entity must resolve the lawful disclosure route and conditions. Additional protections can apply to substance-use-disorder records, psychotherapy notes and other state-protected categories. Do not upload real patient records into a generic preparation form.
The 2024 Part 2 final rule has a February 16 2026 compliance date according to HHS. Use specialist review for Part 2 records and their use in proceedings against a patient. A general treatment/payment/operations permission should not be treated as blanket litigation authority.
HIPAA does not supply a universal patient-chart retention period. Determine current state, provider/licensure, payer, contract and preservation obligations for the actual record type and patient circumstances. Six years for certain HIPAA documentation is not a general six-year rule for all medical records.
Give each request to the suggested owner. Record what is available and what is unknown in the editable CSV checklist. Use a secure evidence location agreed with the recipient; the checklist is an index, not a place for passwords, real patient data or controlled technical information.
Records to find
Download the editable gathering checklist. CSV files contain plain records, without saved column widths or workbook formatting. Import as UTF-8, keep IDs as text, wrap text and widen columns before use. Blank client fields are intentional.
MED-R01 Matter scope and legal authority
Ask
Counsel and privacy officer
Gather
Issues, relevant care episodes/periods, providers, jurisdiction, proper patient/representative authority and applicable authorization, order or other approved process.
Where to ask
Counsel and privacy/HIM files
Why it may be needed
Defines the lawful, proportionate request and recipients.
If missing or uncertain
Do not collect/disclose pending authority questions; obtain counsel-approved route.
Available chart components, signed/unsigned status, notes, orders/results, attachments, flowsheets, medication/administration and export format/options for the selected episode.
Where to ask
Clinical record system and departmental records
Why it may be needed
Allows the recipient to specify what is needed beyond a routine printout.
If missing or uncertain
Ask for a component list, data dictionary and exclusions rather than a claim of complete EMR.
Meaning of entered/service/event/signed/imported/modified times; local/UTC/time-zone/DST rules; clock sources; shared/delegated/service users and ID mappings.
Where to ask
Application data dictionary and administrators
Why it may be needed
Prevents false sequences or attribution.
If missing or uncertain
Ask vendor for a written explanation where needed; do not silently convert ambiguous times.
MED-R12 Relevant communications and external copies
Ask
Counsel and custodians
Gather
Permitted relevant internal/provider messages, secure texting, mail, incident communications, outside care records and legal/practice-management files.
Where to ask
Clinical communication tools, D04 to D12, D28 and D35
Why it may be needed
Finds sources outside the clinical chart.
If missing or uncertain
Counsel separates privilege, patient protections and third-party authority. Do not request unlimited unrelated patient or personnel material.
Export method, account/role, dates/time zone, parameters, counts by component, metadata/attachments, errors, field legend, hashes where used and transfer receipt.
Where to ask
Collection reports and approved evidence repository
Why it may be needed
Makes completeness and limitations reviewable.
If missing or uncertain
Specialist chooses any additional export; do not edit originals to repair differences without retaining them and recording the change.
Download the response template. A useful answer names the actual system, period, supporting record and limits. If you do not know, name the person or provider who can answer.
1. Which systems contain the selected patient episodes and which system owns each component?
Suggested responder
HIM, privacy officer and clinical IT as appropriate
Useful supporting record
System/module/owner and identifier map.
2. What does your routine chart export include and omit?
Suggested responder
HIM, privacy officer and clinical IT as appropriate
Useful supporting record
Written component/format description and a permitted masked sample.
3. Can earlier note versions, addenda, signatures and corrections be separately retrieved?
Suggested responder
HIM, privacy officer and clinical IT as appropriate
Useful supporting record
Vendor/site-specific capability and actual availability statement.
4. Which events are in the audit export and which are not logged?
Suggested responder
HIM, privacy officer and clinical IT as appropriate
Useful supporting record
Event dictionary, enabled settings, query scope and retention dates.
5. What do the different timestamps and user identifiers mean?
Suggested responder
HIM, privacy officer and clinical IT as appropriate
Useful supporting record
Data dictionary, time zone/DST rules and identity/proxy mappings.
6. What records remain in old systems, departmental platforms, exchanges or backups?
Suggested responder
HIM, privacy officer and clinical IT as appropriate
Useful supporting record
Historical system and retention inventory with owners.
7. Which requested records require separate authority or segregation?
Suggested responder
HIM, privacy officer and clinical IT as appropriate
Useful supporting record
Privacy/counsel-approved release route and restrictions.
8. What errors, patient-matching limits, missing intervals or excluded components affect the response?
Suggested responder
HIM, privacy officer and clinical IT as appropriate
Useful supporting record
Exception report linked to the record request IDs.
Sample questions for counsel
Sample questions are drafting prompts for counsel. They are not a complete discovery request or a direction to serve them. Define the event, source, period and parties. Check relevance, proportionality, privilege, privacy, possession/custody/control, current local rules and case orders. Federal Rule 33 ordinarily limits interrogatories to 25 including discrete subparts absent stipulation or order. New York uniform and Commercial Division rules and CPLR 3130 impose separate limits and restrictions; especially check the interrogatory/deposition choice in negligence personal injury/property/wrongful-death actions. Split or narrow prompts only as permitted; do not disguise subparts. Use a document request, interview or deposition topic where that is the appropriate device. No requests are sent by these packages.
Supporting procedural sources: LG01, NY05, NY06, NY07 and NY08. These questions are separate from the internal IT interview.
Identify the systems and responsible custodians maintaining records of [defined patient episode] during [period], subject to the authorized disclosure scope.
Identify the patient, encounter, accession and account identifiers used to link the responsive components, under the agreed privacy protections.
Describe the components included in and excluded from [identified chart export] and the export parameters used.
Identify available records of amendments, addenda and signature events for [defined documentation], without assuming those records establish improper alteration.
Identify the recorded audit-event types, retained periods and person able to explain the fields for [specified system and period].
Describe the meanings and time-zone conventions of the date/time fields in [identified export].
Identify relevant predecessor/departmental systems or migration limitations affecting [defined record category].
Identify the factual preservation/collection steps and known omissions for [defined source], excluding privileged legal advice and respecting protected-record restrictions.
Example only: The chart printout shows a note signed two days after the visit. The coordinator asks HIM for definitions of service, entry and signature times and any available amendment/audit records. The specialist reviews workflow and evidence before interpreting the sequence. The timing alone is not called falsification.
Missing facts and specialist decisions
These are explicit handoff questions. Marking records Received does not resolve them. Add client-specific questions and a responsible person.
MED-Q01 What legal authority permits each disclosure and recipient, including specially protected material?
Ask
Counsel and privacy officer
Gather
Actual process/consent/order, case purpose and record categories
Resolution needed
Written release instructions; no disclosure from checklist completion alone.
MED-Q02 Which record components, event types and versions exist in this deployment?
Ask
HIM, vendor and clinical forensic specialist
Gather
Vendor/version, configuration, dictionary, masked sample and actual retention
Resolution needed
A scoped export plan with coverage limits, not a promise based on certification.
MED-Q03 Which retention and preservation requirements apply to these records?
Ask
Counsel and records specialist
Gather
Jurisdiction, provider/license, patient/record facts, schedules and case holds
Resolution needed
Record-specific schedule and preservation instructions; no blanket six-year chart period.
Counsel/privacy authority and sensitive-record restrictions are recorded before disclosure.
Clinical, audit, diagnostic, portal and administrative records are requested as separate components when relevant.
Timestamps, identities, system versions, formats and missing intervals have explanations or named questions.
Restricted evidence is delivered only through the agreed route; the ordinary index uses masked identifiers.
Download the record index. Use the shared walkthrough for custody, restricted records, missing information and receipt steps.
Sources for this package
Official laws/rules establish duties within their scope. Guidance explains programs; NIST supplies methods; vendor documentation describes possible product behavior. Actual contracts, facts, configuration and case orders still matter.
