Finding · criterion S6
Medical records and prescription transfers are different requests
Receiving a copy of a medical record does not transfer a prescription or authorize another refill. Identify the clinical record holder for the records request, and ask the pharmacies or prescriber separately about any prescription action.
Identify the holder of the clinical record
The brand handling a telehealth subscription may differ from the practice that provides care. A support inbox, payment receipt or account dashboard can identify the storefront without identifying who maintains the clinical record. Look for the medical practice in consultation documents and the notice of privacy practices.
Ask for the record-request contact and the procedure for obtaining an existing copy. Identify the dates of care and the records needed rather than assuming that downloading a receipt retrieves the consultation notes, laboratory results and medication history. The company receiving the request should be able to explain which records it holds and which belong with another provider.
Understand the scope of access
HHS explains that, with limited exceptions, people have a right under HIPAA to access medical and billing records held by covered providers and health plans. Its guidance includes clinical laboratory reports and information about prescribed medicines among the kinds of information that may be available. This does not mean that every consumer app or storefront is itself a HIPAA-covered provider.
A request can concern existing information, such as consultation notes or an old prescription record. It does not ask a clinician to create a new treatment decision. If a downloaded file is incomplete or contains an apparent error, identify the missing material or disputed entry and ask the responsible provider about its access or amendment procedure.
Separate records access from a billing dispute
HHS states that a covered provider cannot deny access to protected health information merely because a bill for healthcare services remains unpaid. That is different from questions about permissible charges for making a copy. It is also different from whether a membership renews, an order is canceled or a medication payment is refunded.
Keep the records request, cancellation request and any billing question identifiable as separate requests. An account being closed does not explain where its clinical records are maintained. Before relying on a dashboard as the only route to past care, establish a contact for requesting those records outside the subscription interface.
Ask the pharmacy about prescription status
A prescription transfer is a pharmacy process, not a synonym for sending medical notes to a new clinician. The Texas State Board of Pharmacy, for example, describes transfers between pharmacists as subject to conditions and distinguishes the prescription and remaining refills. That is an illustration from one state, not a nationwide promise that every prescription can be transferred.
Ask the relevant pharmacies whether the particular prescription is transferable, whether refills remain and whether the prescriber needs to act. A copy of a previous prescription in a medical record does not answer those questions. A new clinician may need to evaluate the patient before deciding whether to prescribe; possession of old records does not predetermine that decision.
The useful outcome is two clear answers: where the existing medical record can be obtained, and who is responsible for the next prescription decision. Peptide Alliance’s business-identity criterion helps identify a company, but it does not certify a provider’s records-access practices or a pharmacy’s ability to transfer an individual prescription.
Related standard: S6. Business address. Evidence for individual companies appears in the seller ledger.
Related reading
Sources
- HHS: accessing medical records
- HHS: information within the right of access
- HHS: unpaid healthcare bills and access requests
- Texas State Board of Pharmacy: prescriptions and transfers
Related findings
Telehealth privacy: the clinic, app and data-sharing boundaryHIPAA protection depends on who holds the information and their role, not simply whether the information concerns health. A clinic’s records and information copied into a separately chosen consumer app can fall under different protections.
How many storefronts, and how many companies?More storefronts than brands. Several brands sell from more than one domain of their own, each filed on one record, while a brand run by the same owner as another keeps a record of its own.
Where is the seller? Business address disclosure across the ledgerMost records print an address, and the addresses are not alike. Some are an office, some a registered agent's building, some a private mailbox, and a substantial minority print no address in the footer, on the contact page, in the terms or in the privacy policy.
Compounded GLP-1 labels: concentration, volume and unitsSyringe units, liquid volume and the amount of medication describe different things. A familiar syringe marking cannot establish a dose when the concentration or prescription has changed. Ask the dispensing pharmacist to reconcile the prescription, label and supplied syringe.