Log a request for personal information the practice holds
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- Record the date the request arrived, who sent it, and what it asks for, in the request's words. Do not produce the file and do not start a 30-day count unless you decide the health-privacy rule applies.
- What the lawyer must review
- You decide which rule governs. For protected health information in a designated record set, 45 CFR § 164.524(b)(2) says the covered entity must act on an access request no later than 30 days after receipt, with one extension of no more than 30 days if it gives a written statement of the reasons and the completion date within the original time. You read paragraph (b)(2)(ii) before you use the extension, and paragraphs (a)(2) and (a)(3) before you deny access. That rule is for a covered entity and for protected health information. It is not a general right to a law-firm file. Other information relating to a representation stays under Model Rule 1.6 until you decide a permission applies. You do not produce either category from this log.
- Written for / version
- United States versionUS
Who does what
| Role | What they do |
|---|---|
| Assistance | Do not begin AI assistance until the responsible lawyer has defined and confirmed its permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.