Medical records quality and privacy checklist

Define the collection before requesting it

Begin with the purpose: documenting the relevant condition, treatment, current status, and work-related effects for your disability-retirement application. List the practices, dates, and reports needed. Include significant earlier records when they explain onset, progression, or treatment history. Do not use an arbitrary “past year only” cutoff, and do not assume more pages automatically make a stronger or clearer submission.

Identify current gaps separately: a missing specialist assessment, a recent treatment change, a test report mentioned but not attached, or an unsigned statement. Organizing records makes information accessible; it does not diagnose, determine whether a treatment was medically appropriate, or certify retirement eligibility. Keep those distinctions in mind when deciding which questions require a clinician.

Request and track the records

1. Ask each practice’s records office for the relevant record types and date range. Confirm its identity-verification and release procedure.
2. Ask about format, expected response, and any permitted charges before requesting duplicate copies. An electronic copy may be easier to search and preserve.
3. Log the request date, requested items, contact, expected follow-up, and received date. Follow up on missing items rather than repeatedly requesting the same complete set.
4. Open the files after receipt and compare them with your request. A portal visit summary may not include the full treatment note or the separately stored test report.

HHS explains that HIPAA generally gives people access to medical records held by covered providers, with exceptions such as separately maintained psychotherapy notes. A practice can explain its process for requesting an amendment if a record contains an error. Do not change the provider’s original record yourself or assume every requested amendment must be accepted.

Check readability and identity

• The records belong to the correct person; unrelated patient pages are flagged for the practice.
• Dates and provider names are legible, pages are upright, and margins are not clipped.
• Multipage reports appear complete and in order.
• The actual clinical note or report is included, not only a billing entry or appointment reminder.
• Statements have the needed signature, date, and contact information.
• Password-protected files can be opened by the authorized recipient using the agreed process.
• Searchable text has been checked against the scanned image; OCR errors have not been treated as clinical facts.

If a page is unreadable, request a better copy. Do not guess medication doses, dates, or test results from a poor scan. Where a duplicate is removed from a working set, retain the untouched original collection and note the cleanup in the index.

Make an index another person can use

Organize by a consistent method, such as provider and date, then add continuous working page numbers if useful. Keep the original page markings visible. An index can list reference number, date range, provider, document type, and working page range. A factual chronology can point to those references without replacing the source documents.

Separate originals, working copies, and the final submission set. This prevents accidental edits to source records and makes it easier to answer a later request for a specific report. Do not silently crop out context or remove material to create a misleading impression.

Match the disclosure to the recipient

Before sending anything, verify the recipient’s identity, purpose, authorized destination, and requested information. A practice, accommodation office, retirement office, and general business inquiry channel have different functions. Use the designated secure channel and send only what is appropriate for that request, while fully answering official application requirements. A privacy preference does not authorize altering required official forms.

Avoid full Social Security numbers in filenames, optional worksheets, or ordinary email subject lines. Protect devices and accounts, limit shared-folder access, and check recipient permissions before delivery. Keep a record of what was sent, when, and how. The TFDR staging website does not accept medical-record uploads; do not paste medical history into its general contact fields or public tools. Wait for verified secure instructions.

Worked example and submission check

• Relevant history and current clinical information are both available.
• SF 3112’s current-evidence instruction is considered without discarding older relevant records.
• Index references match actual files and page numbers.
• Factual errors are flagged to the originating practice.
• Recipient and delivery channel are verified.
• Current employees confirm ORA steps with HR; former employees follow OPM’s ORA instructions.
• Submission confirmation and an exact final copy are retained.