If you were diagnosed with a serious infection after an ERCP or other duodenoscope procedure — or you are reading this on behalf of a family member who was — the single most useful thing you can do right now is collect and preserve the medical records. The records tell the story of the procedure, the infection, the treatment, and the harm. They are also the records hospitals sometimes lose, archive, or overwrite if no one is asking for them. Federal law gives you the right to all of them. This is how to use that right.
Your Right Under HIPAA
The federal Health Insurance Portability and Accountability Act (HIPAA) gives every patient (and the personal representative of a deceased patient) the right to access and obtain a copy of their medical record from any covered healthcare provider. The U.S. Department of Health & Human Services Office for Civil Rights enforces this right. The hospital does not get to decide whether you "need" the records. They are yours. The hospital must respond within 30 days of a valid request, may charge only a reasonable cost-based fee for copies, and cannot require you to come in person to make the request.
If a hospital refuses or delays, the HHS Office for Civil Rights accepts complaints, and HIPAA Right of Access enforcement actions have resulted in publicly reported settlements. In our experience, a written reference to the HIPAA Right of Access Initiative in a follow-up letter usually resolves the delay quickly.
What to Request — A Complete List
Hospitals often respond to a vague request ("send me my records") with a vague response. A specific request gets a complete response. For a suspected scope infection, ask for:
The procedure itself
- The pre-procedure history and physical (H&P) documenting why the procedure was indicated.
- The signed informed consent form for the procedure.
- The procedure note and dictated report from the endoscopist — including the scope model and serial number if recorded. Our scope identification guide explains why this matters.
- Anesthesia record for the procedure.
- Pathology reports from any biopsy taken during the procedure.
- The recovery-room and discharge notes, including discharge instructions.
The infection workup and treatment
- Every return-visit or readmission record after the procedure, including ED triage notes and time stamps.
- All blood culture results, urine cultures, and other microbiology data — the species identification and the antibiotic sensitivity panels.
- Lactate, white count, CRP, procalcitonin and other sepsis markers over time.
- Antibiotic order and administration records, with time stamps for ordering and first dose.
- ICU records if there was an ICU admission, including ventilator settings, vasopressor doses, daily progress notes, and the discharge summary.
- Imaging studies — abdominal CT, ultrasound, MRI — with both the radiologist reports and the actual image files (DICOM format on disc or via portal).
- Operative reports for any surgical procedures performed during the infection course.
The institutional record
- Any letters or notifications the hospital sent to you about possible scope exposure, reprocessing concerns, or infection-control investigations — keep the envelope too.
- Patient portal messages — export or screenshot anything time-stamped before they are archived off the active view.
- Billing records and EOBs for the entire treatment course — useful for documenting the cost of care.
Our evidence guide walks through how each of these record categories ties into the case.
How to Submit the Request
Most hospitals have a Health Information Management (HIM) or Medical Records department. The hospital website usually has a downloadable HIPAA authorization or release form. Submit the completed form by certified mail, fax, or via the portal that the hospital designates for this purpose. Keep a copy of what you sent and the date you sent it.
Key fields on the request:
- Date range: from at least 30 days before the procedure through the present (or through the most recent treatment if you have moved on from this hospital).
- Format: request both a paper copy and an electronic copy. Specifically ask for imaging studies on disc in DICOM format, not just the written reports.
- Designation of recipient: request the records be sent to you, not "to your physician" or to anyone else. You can always forward them later.
- Fee: ask in writing for the cost up front. HIPAA limits the fee to reasonable cost-based charges — not the high per-page rates some hospitals try to charge.
If the Hospital Drags Its Feet
If the 30-day deadline passes without a complete response:
- Send a written follow-up referencing the HIPAA Right of Access Initiative and stating the date of your original request.
- Escalate to the hospital's patient advocate or risk-management office.
- File a complaint with the HHS Office for Civil Rights — this can be done online.
- If you have engaged an attorney, the attorney can issue a HIPAA-compliant authorization on your behalf and follow up directly with HIM. In scope-infection cases we routinely take this step.
Preserving What You Already Have
Records that exist outside the hospital's chart often turn out to be the most useful pieces of evidence. They are also the easiest to lose. Pull these together while the details are fresh:
- Your own timeline. When the procedure was, when symptoms started, what you did, when you returned for care. Write it down in your own words, signed and dated.
- Photographs. Of incisions, drains, ICU equipment, you in the hospital bed. Cameras include time stamps; do not delete the originals.
- Text messages and emails with family during the illness — these are contemporaneous accounts that hold up well.
- Names of clinicians. The endoscopist, the ER physician who saw you on return, the ICU attending, the infectious disease consultant. Note who said what and when.
- Pharmacy records for antibiotics and other medications you continued after discharge.
- Employment records documenting missed work, FMLA paperwork, short-term disability filings.
- Mileage and out-of-pocket logs for medical travel, parking, prescriptions, equipment.
If the Patient Did Not Survive
If a family member died after a suspected scope-related infection, the personal representative of the estate (executor, administrator, or surviving spouse depending on the state) has the same HIPAA right of access. The records needed for a wrongful death analysis are similar, plus:
- The death certificate and the cause-of-death documentation.
- Any autopsy report — particularly if cultures or organ studies were performed.
- The hospital's discharge summary documenting the cause of death and the contributing conditions.
- Funeral and burial expense documentation.
Our companion post on wrongful death after a scope-acquired infection walks through the records and the analysis in more detail.
When to Get a Lawyer Involved
You do not have to wait until you have all the records to talk to a lawyer. A short conversation early is often more useful than a long one later. We can help identify which records to chase first, draft a HIPAA authorization that captures everything you need in one request, and follow up with hospitals that respond slowly. The free case review is exactly that — a conversation. No obligation.
- See if your situation fits the case profile: 3-part qualification test.
- Read the post-procedure sepsis explainer: Post-procedure sepsis after ERCP.
- Identify whether your hospital used Olympus: Did your hospital use Olympus?
- Read the latest litigation update: Mid-June 2026 litigation status.
Free case review. No Fees Unless We Recover Money for You.
Sources
- U.S. Department of Health & Human Services, Office for Civil Rights — HIPAA Right of Access. hhs.gov/hipaa
- HHS Office for Civil Rights — HIPAA Right of Access Initiative enforcement actions. hhs.gov
- Code of Federal Regulations, Title 45, § 164.524 — Access of individuals to protected health information. ecfr.gov
- American Health Information Management Association (AHIMA) — Patient access to health records resources. ahima.org
- U.S. Food & Drug Administration — Duodenoscope reprocessing and infection-control communications. fda.gov
- Patient Advocate Foundation — HIPAA access enforcement resources. patientadvocate.org
Think You May Have a Case?
The 3-part qualification test takes 2 minutes. If it fits your situation, a free case review is the next step. No Fees Unless We Recover Money for You.