ABA Health Record Access Identity and Authority Verification Follow-Up Worksheet for Families

Families and Caregivers / Progress, Quality, Rights and Ethical Care.

Start with the exact verification event

Use the ABA health record access identity verification worksheet for families when a records office asks for identity or authority verification. Record what the organization actually asked for. The request for verification does not by itself show that access was approved or denied. Do not use this page to decide who has legal authority.

These events can sound similar but may involve different processes:

EventWhat to record hereKeep separateIdentity verificationThe organization's request to confirm who the requester isPortal password reset or account recoveryAuthority verificationThe organization's request for a source showing why the requester may act or receive recordsTreatment consent, custody and guardianship decisionsPersonal-representative reviewThe role claimed, source presented and organization's responseA general family role mapAuthorization to discloseThe form or process named by the organizationThe individual's own access requestAccess denialThe written denial and review routeVerification that is still pending

If the office changes the issue from verification to a written denial, preserve that transition and move the next steps to the appropriate denial tracker. Do not relabel the event yourself.

Preserve the original access request

Copy details from the submitted request and receipt evidence before responding to a verification question.

Original request factFamily entryOrganization and office contactedWrite here. For item 1, add evidence when available.Process named by the organizationWrite here. For item 2, add evidence when available.Person whose records are involvedWrite here. For item 3, add evidence when available.Requester name and stated relationship or roleWrite here. For item 4, add evidence when available.Submission date, time and routeWrite here. For item 5, add evidence when available.Receipt date, reference and evidenceWrite here. For item 6, add evidence when available.Records and date range requestedWrite here. For item 7, add evidence when available.Inspection, copy or bothWrite here. For item 8, add evidence when available.Requested form, format and delivery routeWrite here. For item 9, add evidence when available.Communication or accessibility need statedWrite here. For item 10, add evidence when available.Location of the saved original requestWrite here. For item 11, add evidence when available.

Keep sensitive documents in a family-controlled location appropriate to the family's circumstances. The worksheet can point to that location without copying identification numbers, diagnoses, signatures or legal documents into every row.

Copy the organization's verification request verbatim

Preserve the request before summarizing it. A short label such as “proof of guardianship” may omit an important detail about what the office requested or why.

Verification-request fieldFamily entryDate and time receivedWrite here. For item 12, add evidence when available.Person or office that sent itWrite here. For item 13, add evidence when available.Channel usedWrite here. For item 14, add evidence when available.Exact request or questionWrite here. For item 15, add evidence when available.Identity, authority or both statedWrite here. For item 16, add evidence when available.Document, statement or other evidence namedWrite here. For item 17, add evidence when available.Reason stated by the organizationWrite here. For item 18, add evidence when available.Submission route providedWrite here. For item 19, add evidence when available.Response date requested, if anyWrite here. For item 20, add evidence when available.Reference numberWrite here. For item 21, add evidence when available.Family question about unclear wordingWrite here. For item 22, add evidence when available.

The current verification provision at 45 CFR 164.514(h) says a covered entity must verify identity and authority before a permitted disclosure when they are not known, and it describes documentation, statements or representations in specified circumstances. This worksheet cannot determine whether that rule applies, which evidence is sufficient or whether a person has authority.

Separate the people and roles involved

One person may make the request while another person is the record subject. A caregiver, portal delegate, emergency contact, records recipient or person helping with paperwork does not automatically have the same role as a personal representative.

PersonStated roleWhat the person is asking to doSource presentedOrganization responseUnresolved questionWrite here. For item 23, add evidence when available.Write here. For item 24, add evidence when available.Write here. For item 25, add evidence when available.

Use the personal representative, caregiver and supporter role map when the broader task is to distinguish several ongoing roles. This page stays tied to one verification request and one access workflow.

Ask what is needed and where to send it

The HHS professional right-of-access guidance explains that covered entities may take reasonable steps to verify identity and that HIPAA does not require one particular verification form. It also says a verification process may not create a barrier or unreasonable delay. Those are general federal explanations, not conclusions about this request.

Questions a family may ask through the organization's verified contact route include:

• Is the office verifying identity, authority or both?
• What exact item or statement is requested, and what purpose does it serve?
• Are there accepted alternatives if the named item is unavailable?
• Which office should receive the response?
• What secure route does the organization provide for sensitive evidence?
• Can the office confirm receipt without repeating sensitive details?
• How can the family request language or communication support?
• What written status will the office provide after review?

Do not send identity or authority evidence to a new email address, text number or upload link solely because it appears in an unexpected message. Confirm the route through contact information the family already trusts or through the organization's official process. If the route cannot be confirmed, pause and contact the responsible records or security office. This is a cautious workflow step, not a certification that any channel is secure.

Log the family's response without deciding validity

Response itemFamily entryDate and time sentWrite here. For item 26, add evidence when available.Verified destination or officeWrite here. For item 27, add evidence when available.Route usedWrite here. For item 28, add evidence when available.Exact item or statement suppliedWrite here. For item 29, add evidence when available.Information withheld as unnecessary, if anyWrite here. For item 30, add evidence when available.Alternative requested or suppliedWrite here. For item 31, add evidence when available.Receipt evidenceWrite here. For item 32, add evidence when available.Family's stated communication needWrite here. For item 33, add evidence when available.Question sent with the responseWrite here. For item 34, add evidence when available.Storage location for the underlying evidenceWrite here. For item 35, add evidence when available.

Record the name of a document rather than reproducing sensitive numbers in this worksheet. Do not mark a document “valid,” “controlling” or “legally sufficient.” Record that it was supplied and preserve the organization's response.

Keep a dated follow-up log

Date and timeDirectionPerson or officeWhat was asked or statedEvidence savedNext step and ownerIncoming / outgoingWrite here. For item 36, add evidence when available.Incoming / outgoingWrite here. For item 37, add evidence when available.Incoming / outgoingWrite here. For item 38, add evidence when available.Incoming / outgoingWrite here. For item 39, add evidence when available.

Attribute each status. For example, write “records office email dated May 8 says the identity check is complete” rather than “identity approved” if the office did not use that wording.

Use a copyable follow-up message

I am following up on the health-record access request submitted on [date], reference [number]. Your [message or letter] dated [date] asked for [quote the identity or authority verification request]. I responded on [date] through [route] with [brief description, without sensitive numbers]. Please confirm receipt, whether any specific item remains unresolved, the responsible office and the written next step. If an alternative is available, please describe it. My communication or accessibility need is [need, if relevant].

Keep the message focused on the verification event. A family does not need to restate unrelated clinical details merely to ask for status.

Record communication and accessibility needs

The Department of Justice effective-communication guidance describes context-specific auxiliary aids and services for covered organizations. Applicability and the appropriate support are fact-specific. Record the need and response without declaring compliance.

Communication itemFamily requestOrganization responseArrangement confirmedStill open?Preferred languageWrite here. For item 40, add evidence when available.Interpreter or relayWrite here. For item 41, add evidence when available.Accessible form or noticeWrite here. For item 42, add evidence when available.Communication methodWrite here. For item 43, add evidence when available.Support person participationWrite here. For item 44, add evidence when available.

If communication support is needed to understand or answer the verification request, keep that issue visible in the same dated log.

Close with an observed endpoint

EndpointEvidence and dateOrganization says identity verification is completeWrite here. For item 45, add evidence when available.Organization says authority verification is completeWrite here. For item 46, add evidence when available.Organization requests a specific additional itemWrite here. For item 47, add evidence when available.Organization accepts an alternativeWrite here. For item 48, add evidence when available.Verification remains pendingWrite here. For item 49, add evidence when available.Written access denial receivedWrite here. For item 50, add evidence when available.Request redirected to another responsible officeWrite here. For item 51, add evidence when available.Access provided and reconciledWrite here. For item 52, add evidence when available.

An endpoint records what happened. It does not decide whether the organization's process was legally required, reasonable, timely or correct.

Fictional filled example

This example is invented. It does not establish identity, authority or access rights.

FieldFictional entryOrganizationCedar Harbor ABA records officeOriginal requestMay 2 portal request for treatment plans and progress summaries from January through AprilRequester and stated roleJordan Lee, parent of a minor clientVerification requestMay 6 portal message asks for a current statement showing authority to act for the child and gives the records-office upload routeFamily questionMay 6 message asks what alternatives the office accepts and whether the existing registration record can be reviewedFamily responseMay 7 upload through the existing portal; worksheet records the document name but not its identifying numbersReceipt evidencePortal receipt CH-418 saved May 7Accessibility needPlain-language written response requestedOrganization statusMay 8 portal message says verification is complete and the records request remains in processEndpointVerification follow-up closed; access delivery remains on the records-request tracker

Jordan records only the office's language. The worksheet does not label the submitted item legally sufficient or decide whether the request was reasonable.

Limits of this worksheet

This worksheet cannot determine whether HIPAA or another law applies. It cannot decide covered-entity status, record-set scope, identity, personal-representative status, document validity, controlling sources or access rights. It also cannot decide whether verification is reasonable, creates a barrier or affects timing, or whether a violation or remedy exists. Preserve evidence and obtain current guidance from the responsible privacy, records, security, payer, regulator, state-law or legal source.