■ Duties and responsibilities:

Expectations of physicians in practice

Did you know? You need authorization to provide medical records to lawyers

When a lawyer requests a patient’s records, consent is key

A stamp being applied to a document

2 minutes

Published: January 2018 /
Revised: October 2023

The information in this article was correct at the time of publishing

If you are the custodian of the medical records and receive a request from a lawyer asking for a patient’s medical records, you can provide the records only once you have authorization from the patient or the patient’s substitute-decision maker, or when required by law. Ideally, the authorization should be in writing. The authorization should state to whom you can release the records and which records you are authorized to release. If the patient does not provide authorization to release the records, you generally cannot release them until there is a court order or warrant compelling you to produce the records, or unless production is otherwise required by legislation or regulation. If you are not the custodian of the medical records, you will need to direct the lawyer’s request to the individual or entity that is the custodian (e.g. hospital, clinic owner, etc.).

Be alert to potentially sensitive information

If you do have authority to release a medical record, you should review it for potentially sensitive information, which may or may not be directly relevant to the request. This could include information relating to the patient’s mental health, substance use, or family history.

Where the patient authorizes the disclosure of records, but your review reveals the records contain sensitive information, you should ask the patient whether they intended for this information to be released. Redact any information the patient does not want released, as well as any personal information about other people. When sending a redacted record, tell the lawyer that some relevant information has been redacted at the patient’s request or because it contains personal information about third parties.

In situations where the records are being released without the patient’s consent due to a legal requirement, and there is sensitive information in the records, call the CMPA before disclosing the information.

Provide copies

When you provide records, send copies, not originals, unless otherwise ordered by a court. Remember that you can recover reasonable copying and administrative expenses associated with providing the material. Some Colleges and medical associations or federations have guidelines about what amount would be considered reasonable.

If you are in doubt about how to respond to a request for medical records, contact the CMPA for advice.


DISCLAIMER: The information contained in this learning material is for general educational purposes only and is not intended to provide specific professional medical or legal advice, nor to constitute a "standard of care" for Canadian healthcare professionals. The use of CMPA learning resources is subject to the foregoing as well as the CMPA's Terms of Use.