Free HIPAA sign-in sheet & records request generator

Frequently Asked Questions

01Are patient sign-in sheets allowed under HIPAA?

Yes. HIPAA permits sign-in sheets as an incidental disclosure, as long as you limit the information to the minimum necessary (45 CFR 164.502(a)(1)(iii) and 164.502(b)). That means a sign-in sheet should not ask for the reason for the visit, the provider being seen for sensitive care, medical details, or a Social Security number. Keeping the sheet to a name or initials and a time is the privacy-safe approach this tool uses by default.

02What makes a sign-in sheet privacy-safe?

Collect only what you need and avoid revealing why someone is there. Use first name or initials rather than full names where possible, do not include the reason for the visit or the treating provider for sensitive services, and never ask for Social Security numbers or insurance details on a shared sheet. Covering completed names or using a single-line-per-patient design that is removed as each person checks in also reduces what the next patient can see.

03Can a patient request a copy of their medical records?

Yes. The HIPAA right of access (45 CFR 164.524) gives patients the right to inspect and obtain a copy of their own records in a designated record set. You must respond within 30 days (with one possible 30-day extension), provide the records in the form and format the patient requests if it is readily producible, and charge no more than a reasonable, cost-based fee. This tool produces the patient's request form; the provider still fulfills it under the access rule.

04How much can be charged for records?

Under the right of access, a covered entity may charge only a reasonable, cost-based fee for copying records, which can include the cost of labor for copying, supplies, and postage if mailed. You cannot charge for search and retrieval or for the time spent reviewing the request. Many providers offer electronic copies of electronic records at little or no cost.

05Do you store the information I enter?

No. Both documents are assembled locally in your browser. Patient names, dates of birth, and everything else you type are never sent to or stored on any server, which is why no sign-up is required.

06Is this a substitute for legal advice?

No. This tool generates starting-point documents aligned with HIPAA's minimum necessary and right-of-access rules, but it is not legal advice and is not guaranteed to be complete or suitable for your specific situation. Your policies and state law may add requirements. Have your compliance or legal team review these documents before you rely on them.