Patients request their records through a verified web form. The flow validates identity, compiles the complete file from the EHR, applies required redactions for a privacy officer's review, delivers everything via a secure expiring link, and writes an auditable release log automatically.
Typical results
-95%
Turnaround time
100%
Releases logged & auditable
15 min
Staff time per request
Figures reflect typical results for this kind of automation.
The challenge
Records requests arrived by phone, fax, and front-desk visits, then sat in a shared inbox. Staff hunted documents across three EHR systems, redacted by hand, and burned CDs for pickup. Fulfillment averaged three weeks, patients called daily to chase, and nobody could prove what was released to whom, or when.
Before and after
Fulfillment time
−95%Staff time per request
−83%Chase calls per week
−93%The automation
We built a verified web request form that checks the patient's identity against the clinic database with an OTP sent to the phone number on file. A Make scenario compiles the record set from the EHR, applies the group's redaction rules, and queues the file for the privacy officer's one-click approval. Approved files deliver through a secure, expiring download link, and every step — request, verification, approval, delivery — writes to an auditable release log.
How it works
- 01
Verified request
The patient submits a web form; an OTP to the phone number on file confirms identity before anything moves.
- 02
File compiled
A Make scenario pulls the requested record set from the EHR automatically — no folder hunting.
- 03
Redactions applied
The group's redaction rules run on the compiled file, which queues for privacy review.
- 04
One-click approval
The privacy officer checks the flagged sections side-by-side and approves in one click.
- 05
Secure delivery & log
An expiring secure link goes to the patient, and every step writes to the auditable release log.
Starts from
- Verified web request form
- EHR record pull
Delivers
- Redaction review queue
- Secure expiring link
- Auditable release log
The impact
Fulfillment typically drops from three weeks to one day, with most requests delivered the same afternoon. Staff time per request falls from 90 minutes to 15, chase calls nearly disappear, and the release log answers a privacy audit in minutes instead of days.
Questions about this automation
How is the patient's identity verified before records are released?
The patient fills in a web request form, and the automation matches the details against the clinic database. A one-time code is sent to the phone number already on file, and nothing moves forward until the patient enters it. Failed or mismatched verifications are routed to staff instead of being processed.
Who checks the redactions before the file goes out?
The redaction rules run automatically on the compiled file, and the result waits in a review queue for the privacy officer. Flagged sections appear side by side with the original, so the officer can confirm or adjust them and approve in one click. No file is delivered without that approval.
How are the records delivered and logged?
Approved files are sent through a secure download link that expires after a set period, so copies do not linger in inboxes. Every step, from the request and verification to approval and delivery, is written to a release log with timestamps, which gives the clinic a ready answer to audit questions.