Did you know? You need authorization to provide medical records to lawyers

If you are the custodian of the medical records and receive a request from a lawyer asking for a patient’s medical records, you can provide the records only once you have authorization from the patient or the patient’s substitute-decision maker, or when required by law. Ideally, the authorization should be in writing. The authorization should state to whom you can release the records and which records you are authorized to release. If the patient does not provide authorization to release the records, you generally cannot release them until there is a court order or warrant compelling you to produce the records, or unless production is otherwise required by legislation or regulation. If you are not the custodian of the medical records, you will need to direct the lawyer’s request to the individual or entity that is the custodian (e.g. hospital, clinic owner, etc.).

Be alert to potentially sensitive information

If you do have authority to release a medical record, you should review it for potentially sensitive information, which may or may not be directly relevant to the request. This could include information relating to the patient’s mental health, substance use, or family history.

Where the patient authorizes the disclosure of records, but your review reveals the records contain sensitive information, you should ask the patient whether they intended for this information to be released. Redact any information the patient does not want released, as well as any personal information about other people. When sending a redacted record, tell the lawyer that some relevant information has been redacted at the patient’s request or because it contains personal information about third parties.

In situations where the records are being released without the patient’s consent due to a legal requirement, and there is sensitive information in the records, call the CMPA before disclosing the information. Never alter a patient's medical record after a complaint or legal action is initiated, or after receiving a verbal threat or a written letter indicating that legal action may be launched.

Provide copies

When you provide records, send copies, not originals, unless otherwise ordered by a court. Remember that you can recover reasonable copying and administrative expenses associated with providing the material. Some Colleges and medical associations or federations have guidelines about what amount would be considered reasonable.

If you are in doubt about how to respond to a request for medical records, contact the CMPA for advice.

DISCLAIMER: This content is for general informational purposes and is not intended to provide specific professional medical or legal advice, nor to constitute a "standard of care" for Canadian healthcare professionals. Your use of CMPA learning resources is subject to the foregoing as well as CMPA's Terms of Use.