In 15 states, some people with high-risk medical conditions are eligible to receive the COVID-19 vaccine at publicly run sites.
People generally need to prove that they have one or more eligible medical conditions before they can get the vaccine. Figuring out how to get this information, or which documents to ask for, can be overwhelming. But fortunately, under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), you have the right to access your own medical information. (This is also a useful skill to learn since you may also need to request your medical records in the future.)
At the time of writing, these states are giving the vaccine to people with high-risk medical conditions: Alaska, Mississippi, Missouri, Montana, Nebraska, New Hampshire, New Jersey, New York, North Dakota, Ohio, Pennsylvania, South Dakota, Texas, Virginia, and Wyoming.
The Centers for Disease Control and Prevention has a list of high-risk medical conditions for COVID-19, which include cancer, kidney disease, liver disease, pregnancy, diabetes, sickle cell disease, a developmental disability, a heart condition, a pulmonary disease like asthma, a neurological condition like dementia, immunocompromising diseases like AIDS, and obesity on the basis of body mass index (a flawed measure of health).
States are using the CDC’s list of high-risk medical conditions as a guide for who could qualify for the vaccine, but you should check your state’s specific guidelines. For instance, in Maryland and Ohio, the only qualifying medical condition is a developmental disability. In New Hampshire and North Dakota, you need at least two high-risk conditions to qualify.
To show you’re eligible, you’ll need to bring a doctor’s letter or personal medical records that indicate you have an eligible high-risk medical condition. At some vaccination sites, workers will simply ask you to sign a letter certifying that you have a condition rather than requesting to see a doctor’s letter or medical records. But since implementation varies from site to site, you should bring documentation just in case.
(If you use MyChart or a similar service that hosts electronic medical records, you may already have access to them — just text or email them to yourself and print them out.)
But what if you don’t have your records? Here’s how to do it.
1) Name the exact records.
There are some common documents that you can request. The face sheet gives an overview of a particular patient. You can also ask for hospital discharge summaries, test results, operation records, and copies of your health history and yearly physical records.
Medical records can also include documents from specialized treatments. This could include cardiology, radiology, pathology, immunization, medication, and laboratory records, as well as mental health evaluations, electroencephalograms, and sleep reports. There are also confidential records, which include treatments and testing for HIV/AIDS, psychiatry, alcohol and drug abuse, sexually transmitted diseases, and genetic conditions.
If you’re not sure which records you need to get the COVID vaccine, think about what happens when you go to the doctor. When you go to the pulmonologist for asthma, they’ll likely perform a pulmonary function test. So, you can request these test results from your pulmonologist.
You can also think about how you treat your medical condition, such as if you have heart disease and you take a blood thinner. In this case, you can request your prescription and medication records from your cardiologist.
Also, take note of when you were diagnosed with your condition and when you started to treat it. When you request your medical records, the facility may ask for a date range.
2) Determine who has the records.
Take note of the name of your doctor, or the person who has been treating you for your medical condition.
Next, ask yourself where you usually see this doctor. Is it a private practice? A specific wing of a hospital? A treatment center? If you’re getting treated for liver disease, take note that you’re seeing, for example, Dr. Jane Doe at [ABC] Hospital’s Institute for Liver Medicine. This is important to know for the next step.
3) Find the authorization form.
Under HIPAA, big hospitals and small practices alike must have your written permission before they share medical records with anyone — even if that person is you.
So you’ll need to find, or ask for, the appropriate authorization form to release your medical records. This form will generally be called an “authorization for release of information” form, an “authorization to use/disclose healthcare information” form, or something to that effect.
If you see your doctor in a hospital, the facility should have a page on its website dedicated to patients who need to request their medical records. Try searching for “[ABC] Hospital HIPAA” or “[ABC] Hospital request medical records” in your search engine of choice. Somewhere on the hospital’s website, there should be a downloadable authorization form.
A smaller practice may not have a page on its website dedicated to this. So try calling or emailing the office. Ask them to email you the appropriate authorization form for releasing medical records and where you should mail, fax, or email your completed form.
4) Fill out the form and send it.
Generally, you can fill out the authorization form digitally or print and fill it out on paper.
This form should ask you which medical records you would like to request. Refer back to step 1. Which ones do you need? What is the date range for them? You may have to write out the names of these records (like “laboratory test results”), or you may have the option of checking boxes that name certain kinds of records.
Generally, the form will also ask to whom the medical records will be delivered, where they will be sent, and how they will get there. In this case, say the records should be released to you. If you want the records mailed to you, give them your address or PO box. If you want them faxed to you, give them your fax number.
If you want the records emailed to you, don’t just give them your Gmail or Outlook address. Under HIPAA, doctors are required to securely deliver medical records, so you would need to give them an encrypted email address. Common mail services like Gmail and Outlook won’t cut it. Instead, go to ProtonMail.com and sign up for an encrypted email address if you don’t already have one. The free plan should be enough to meet your needs. On the authorization form, make sure you provide a ProtonMail address or another encrypted address.
The policies about fees for delivering medical records vary depending on the hospital or treatment center. The form should have information about this, but in most cases the records should be delivered for free.
Once you’re done, send the form by post, fax, or email to the appropriate address or number. If you’re dealing with a hospital, this physical address, email address, or fax number should be on the HIPAA page of its website. Don’t send your form to a general fax number or email address. If you’re dealing with a private practice, call or email the office and ask where you should send the form.
5) Follow up.
Once you’ve submitted the authorization form, you might have to wait. This could take a few days, but it certainly shouldn’t drag on for weeks or months. Try calling or emailing the hospital or practice every few days or so, depending on how urgently you need the medical records. First, make sure that the facility received your authorization form and that it was completed correctly. Then, ask when you should expect to receive your records.
Feel free to say that your request is urgent and that you need your records to prove that you are eligible for the COVID-19 vaccine.
If the hospital or treatment center is dragging its feet or has stopped responding, know your rights under HIPAA: You have a legal right to view and access your own medical records, with some exceptions. You can try sending an email to the hospital or practice to remind it of your rights under HIPAA and include some basic information. Here are some suggestions for what you might include:
- State your name, and which doctor has been treating you.
- Say how long has it been since you submitted your request for medical records.
- You might note that you have a right to your own medical records under your state’s patient privacy/HIPAA law.
- You might note that in some states, HIPAA violations also constitute a breach of contract between patient and doctor.
- Ask them to provide your records by a particular day.
This should encourage the doctor or practice to get back to you as soon as possible. You may need to continue following up in order to get your records, but hopefully things will work out.
Once you get your records, print out one or two documents that attest to your medical condition. Make sure you print it and have it on hand at your vaccine appointment.
