How to keep a missing-record log when portals are incomplete

A missing-record log is a simple table that tracks which medical records you still need, which organizations you contacted, when you asked, how you asked, and what happened next. It is useful when patient portals are incomplete, old records live outside the current health system, or a caregiver is trying to coordinate records across several organizations.

The point is not to turn you into a records lawyer or to guarantee that every request will go smoothly. The point is to keep the process visible so you do not lose track of what you have, what you still expected to receive, and who needs a follow-up.

ONC's current patient guide says to check the portal first, then use the provider website, phone, visit, email, or forms when the information you need is not available there. HHS explains that the HIPAA Privacy Rule generally gives individuals a right, with limited exceptions, to access protected health information in designated record sets maintained by or for HIPAA-covered providers and health plans. A missing-record log connects those facts to a practical workflow; it does not determine whether a particular organization, request, or record falls under HIPAA.

Use this missing-record log template

Use one row per requested item and give each submission a stable request ID. If one form asks a hospital for a visit note, lab report, and imaging report, use three rows with the same request ID, sent date, method, and request-proof location. Each item can then carry its own outcome without losing the shared request history.

Use these columns:

Column	What to write	Example
Request ID	A stable label shared by items sent together	REQ-2026-014
Record needed	The specific file or category	Cardiology visit note
Contacted organization	Where you sent the request	Northside Cardiology
Source status	Unconfirmed, reported maintained, redirected, or reported not maintained	Unconfirmed
Redirect destination	A destination the contacted organization named	Blank unless redirected
Date range	The dates you are asking for	Jan 2023 to Jun 2024
Request method	Portal, form, phone, fax, mail, in person	Website release form
Request proof	Where the confirmation, form, or message is saved	Requests / REQ-2026-014.pdf
Date requested	When you sent the request	2026-07-08
Follow-up date	When to check again	2026-07-22
Request status	Not requested, requested, acknowledged, partial received, received, written denial received, unclear	Requested
Received date	When it arrived	Blank until received
Format received	PDF, paper, CD, portal message, image file	PDF
Stored where	Where you saved it	Libby / 04_visit-notes
Notes	Confirmation number, staff name, missing pieces, next step	Asked for provider notes and labs

That is enough. Do not make the first version complicated. The log only works if you can keep it current.

What belongs in the log

Log anything you expected to see in a portal but cannot find, especially if it matters for an upcoming visit, second opinion, caregiver handoff, or personal health record.

Common missing records include:

• Visit notes
• Lab reports
• Imaging reports
• Imaging files, such as a CD or electronic image transfer
• Hospital discharge summaries
• Emergency or urgent care notes
• Procedure reports
• Pathology reports
• Referral letters
• Medication history
• Immunization history
• Billing records or explanations tied to a disputed service

ONC's Get It guide notes that a partial record may be useful when you need specific health information such as allergies, medications, immunizations, one visit note, test results, or X-rays. That is the reason to be specific in the log. "Everything from Hospital A" may be appropriate when switching primary care, but "MRI report from March 2024" is easier to track when you only need one item.

If you are building a broader personal record, pair this with the personal health record checklist for chronic conditions. If the missing records are for a consult, use how to export medical records for a specialist as the companion workflow.

Step 1: Start from the portal, but do not stop there

Open the patient portal and download what is already available. Save original PDFs or reports when possible, not just screenshots. Then write down what you expected but could not find.

For each missing item, capture:

• Which portal you checked
• What you searched for
• The date range you expected
• Whether the portal showed a summary, a partial file, or nothing
• Whether the portal points to a records department, release form, or support contact

This matters because a portal can expose only part of the information an organization maintains. It may show a lab result but not the related visit note, an imaging report but not the image files, or recent visits but not older archived records. Treat each portal gap as a question to investigate, not proof that the record does not exist or that the portal organization maintains it.

For the broader reason this happens, read why medical records are still scattered when portals exist.

Step 2: Identify the organization you will contact

In this log, the contacted organization is the place where you send the request. That is an operational label, not a legal finding that the organization maintains the requested information. It may not be the same place as the portal you normally use, and the organization that created a record is not always the only covered entity that maintains a copy.

Examples:

• The hospital that discharged you
• The imaging center that performed the scan
• The lab that processed the test
• The specialist clinic that wrote the consult note
• The urgent care that treated the immediate issue
• The primary care office that received an outside record but did not create it

When you are unsure, keep the contacted organization and label its source status unconfirmed. If the organization merely confirms receipt or says the request is processing, keep the source status unconfirmed and change Request status to acknowledged. If it specifically says it maintains the requested item, use reported maintained. If it names a different destination, do not overwrite the contacted organization. Change the source status to redirected, copy the exact destination into Redirect destination, and preserve the response in Notes. If it says it does not maintain an item and names no destination, use reported not maintained, leave the redirect blank, and preserve the exact response and proof. The reported labels record what the organization said; they are not independent conclusions about whether the item exists or is legally accessible. If you send a new request to a named destination, give that submission a new request ID and note redirected from REQ-....

HHS says that when a covered entity does not maintain requested protected health information but knows where it is maintained, it must tell the individual where to direct the qualifying access request. That rule does not mean every office knows the destination or that the named organization necessarily has the file.

Step 3: Ask for the record by type and date range

A useful request is specific enough that a records department can act on it.

Instead of:

• "Send my records."

Write:

• "Please send cardiology visit notes, ECG reports, and lab reports from January 1, 2023 through June 30, 2024."
• "Please send the written MRI report and the image files for the lumbar spine MRI performed on March 12, 2024."
• "Please send the discharge summary, medication list at discharge, and relevant lab reports from the hospital stay beginning April 9, 2025."

One submission can include several record types. In the log, give every requested item from that submission its own row and the same request ID.

HHS says an individual's HIPAA access right covers a broad array of protected health information in a designated record set maintained by or for a covered entity. Examples include medical records, billing and payment records, clinical laboratory test results, medical images such as X-rays, and clinical case notes. HHS also explains that a covered entity is not required to create new information or analyses that do not already exist in that record set. So the safer pattern is to ask for existing record types, not a custom explanation, while recognizing that limited exclusions and denial grounds can apply.

Step 4: Log the request method and proof

Record the path you used to ask:

• Portal message
• Portal request form
• Provider website form
• Medical records department phone call
• Faxed release form
• Mailed request
• In-person request
• Email, if the organization permits it

Also save proof where you can:

• Confirmation number
• Submission screenshot
• Copy of the form
• Name or department you spoke with
• Date and time of phone call
• Fax confirmation
• Portal message thread

Put the file path, folder, or stable link in Request proof. Rows that share a request ID can share the same proof location. Keep this separate from Stored where, which records the location of a received medical-record file.

This is not about being adversarial. It is about having enough detail to continue the process without starting over.

Step 5: Add a follow-up date

Every missing-record row should have a next action date.

For an individual's qualifying HIPAA request to access protected health information in a designated record set, HHS says a covered entity must act no later than 30 calendar days after receiving the request. HHS calls that an outer limit. If the covered entity cannot act within that period, it may use one extension of no more than 30 additional calendar days, but it must provide a written reason and completion date during the initial period. ONC also notes that some state or other laws may require faster access.

Those dates do not automatically govern every portal, app, organization, clinician-to-clinician transfer, authorization, or record type. Use them to ask a precise status question when the scope fits, not to declare a violation.

An editorial follow-up cadence, not a statutory timetable:

• Same day: save the request proof
• 7 to 14 days: check whether anything arrived or the portal changed
• 21 days: follow up if there is no acknowledgement
• 30 days: if the qualifying HIPAA timeframe applies, ask whether the request is delayed, subject to a written extension, denied in whole or in part in writing, incomplete, or still processing
• When received: verify the file matches the request and mark missing pieces separately

Do not wait until the week before a specialist visit if you can avoid it. Records requests often require identity verification, release forms, manual review, or separate handling for images.

Step 6: Mark partial records clearly

Partial records are common. Do not mark a row "received" if only part of the request arrived.

Use statuses like:

• Not requested
• Requested
• Acknowledged
• Partial received
• Received
• Written denial received
• Needs clarification
• Wrong record received
• Duplicate only
• No response

If request REQ-2026-014 asked for a visit note, lab report, and imaging report, and only the lab report arrived, mark the lab-report row received. Keep the note and imaging rows under the same request ID with their actual statuses, such as acknowledged or no response. Use partial received only when part of one requested item arrived. If you send a new request for any remainder, give it a new request ID and note the earlier ID in Notes.

ONC's Check It guide recommends reviewing an obtained record for completeness, correctness, and whether it is up to date. The missing-record log handles a narrower check: whether the files received match the request. It does not decide whether the clinical information inside those files is correct or sufficient.

Step 7: Keep caregiver and privacy boundaries explicit

If you are helping a parent, spouse, child, or another person, add columns for your role and the documentation the organization says it needs. Being a relative or informal caregiver does not automatically make someone the patient's HIPAA personal representative.

Track:

• Whether you are the patient, personal representative, or helper
• Whether the organization has an authorization form on file
• Whether the authorization covers this record type
• Whether the authorization has an expiration date
• Whether the request should go to you, the patient, or a clinician

HHS says a HIPAA-covered provider or health plan generally must allow a personal representative to inspect and receive a copy of protected health information about the person represented. HHS also says state law may affect how someone becomes a personal representative, and exceptions can apply. The representative's access follows the scope of that role. A helper who is not a personal representative may instead need the patient's authorization or another process specified by the organization.

Do not put someone else's private health information into shared documents, public AI chats, or tools they have not approved. If you are unsure whether you are allowed to request or store a record, ask the provider's records department or a qualified professional.

Step 8: Turn the log into a useful record

The missing-record log is not the final product. It is the control panel for finishing the record.

Once records arrive:

1. Save the original file.
2. Use a consistent file name with the date, source, and record type.
3. Link or note the storage location in the log.
4. Check whether the record covers the date range you requested.
5. Add the record to the relevant timeline, lab table, specialist packet, or health summary.
6. Keep the missing row open if something is still absent.

For file naming and lab organization, start with how to organize years of blood test results. For visit preparation, use how to prepare a health summary for a new doctor.

What Libby helps with

Libby helps with the organization layer around missing records. You can keep portal downloads, request notes, received files, timeline context, and visit questions in one place instead of spreading them across portal messages, desktop folders, screenshots, and memory.

That can mean:

• A source inventory for each clinic, lab, hospital, or imaging center
• A missing-record log with follow-up status
• A timeline that shows what each received record belongs to
• A place to keep questions for a doctor or specialist
• Better context for AI conversations, with human review still required

Libby does not automatically retrieve every missing record, guarantee that a provider will release a file on your preferred timeline, give legal advice, or decide what a record means medically.

If the first setup is the hard part, white-glove setup gives you hands-on help organizing the first version of the record. You can also watch the Libby demo to see how the product fits into the workflow.

The short version

When a portal is incomplete, keep a missing-record log with:

• Record needed
• Request ID
• Contacted organization
• Source status: unconfirmed, reported maintained, redirected, or reported not maintained
• Redirect destination
• Date range
• Request method
• Request proof location
• Date requested
• Follow-up date
• Request status
• Received date
• Format received
• Storage location
• Notes and authorization status

The habit is simple: download what the portal already gives you, list what is missing, request specific existing record types from the likely source organization, save proof of the request, follow up on a schedule, and mark partial records honestly.

Safety boundaries

This article is about personal record organization and request tracking. It is not medical advice, legal advice, diagnosis, treatment, privacy compliance advice, or a substitute for a qualified professional.

• Do not delay urgent care while waiting for records.
• Do not assume a missing portal item means the record never existed.
• Do not assume every helper has permission to request or store someone else's records.
• Do not put private health information into public forums, shared documents, or AI tools without understanding the privacy implications.
• Do not change medications, supplements, diet, or treatment based on a record, checklist, app, or AI answer alone.
• Verify important details against original source documents and discuss medical decisions with a qualified clinician.

If symptoms may be urgent, contact a clinician, urgent care, emergency services, or your local emergency number instead of waiting to finish the log.

References

• ONC: How to Get It
• ONC: How to Check It
• HHS: Individuals' Right under HIPAA to Access their Health Information
• HHS: Personal Representatives