The patient chart — Chart Sharing

Send part of a chart to someone outside the practice

A cardiologist wants the last two visit notes. A lawyer has a signed authorization for a date range. A patient asks you to send their records to a new doctor. Chart Sharing does that without a fax machine and without attaching records to an email: you pick exactly what to send, the practice prepares each item as its own PDF, and the recipient opens them on a web page protected by an access code and an expiry date.

It lives in Patient Information under Care workflow, as the Chart Sharing tab. The tab opens on the shares already sent for this patient, newest first, with New share at the top right.

The tab, the permission, and what each person may include

Sharing a chart is a disclosure of protected health information, so it is deliberately narrower than reading a chart. Two things are checked: whether you can open the tab at all, and — separately — which categories you are allowed to put in a share.

1. Physicians and organization admins have it already. The Chart Sharing tab appears in Patient Information without anything being switched on.
2. Staff need one permission. An admin grants Share chart records (records.share) from staff & assistants. It is marked sensitive, and it is part of the office-manager and owner presets — front desk, medical assistant and biller presets do not include it. Without it the tab is not in the list.
3. You can only share what you can already see. A staff member gets a category only if they hold that category’s own read permission. Someone who cannot open lab results in the chart sees Lab results greyed out with a padlock and a line saying they do not have permission to share it. Physicians and admins get all nine categories.
4. Every share names its author. The list row and the detail dialog both read Created by and your name. Revoking, extending and resetting the code are recorded under the name of whoever did them.

Three steps: what, to whom, and confirm

New share opens a three-step dialog. You can move back and forth freely; nothing is created and nothing is sent until the last button on the third step.

Step 1 — What to share

1. Entire chart is the top card, and it tells you the size. It reads like Everything you are able to share — 145 files across 9 categories. Consider whether the recipient needs all of it. It is there for the rare request that genuinely covers everything; the sentence under it is the hint that most requests do not.
2. Otherwise work down the nine categories. Clinical summary, Progress notes, Documents & scans, Lab results, Imaging, Questionnaires, Prescriptions, Billing, Forms & letters. Each row carries a one-line description and a count. Ticking the row takes the whole category.
3. Open a category to pick individual items. The chevron on the right expands the list. Each item shows what it is and a detail line — a note reads Progress Note with Apr 20, 2026 · Dr. Romero · Final · v5. Categories with more than a handful of items get a search box, and Select all / none works within the open category. A part-selected category shows a dash instead of a tick.
4. Unsigned notes cannot be shared, and say so. A draft is listed greyed out with Not signed on its detail line and its checkbox disabled. A share is a legal disclosure of the record, and a draft is not the record yet — sign the visit first and it becomes selectable.
5. The footer counts as you go. 17 files will be prepared updates on every tick, and Next stays disabled until you have chosen something.

Step 2 — Recipient & access

1. Name and email are the address. Organization is optional and appears on the share row later, which makes a list of shares much easier to read.
2. Relationship and Purpose of disclosure are what the record will say you did. Relationship is Treating provider, Patient, Legal representative, Attorney, Insurer or Other. Purpose is Treatment, Payment, Health care operations, Patient request, Legal or Other, and the hint under it — Recorded in the patient’s disclosure log. — is literal. Choosing Other asks you to write the reason.
3. The message is optional and travels in the link email. Plain text, up to a thousand characters. It is the place for “these are the two visits we discussed on the phone”. Never put the access code in it.
4. Set how long the link lives. One, three, seven, fourteen, thirty, sixty or ninety days — seven by default. The line underneath resolves it to a date, The link stops working on Sep 6, 2026., in your practice’s time zone. Shorter is safer; you can always extend it later.
5. Decide how the access code reaches them. Email the access code to the recipient in a separate message (recommended) sends it as its own email, so the link and the code never sit in one message. Show it to me once — I’ll give it to the recipient by phone or in person puts it on screen when the share is created and never again.

Step 3 — Review & confirm

1. Three cards restate the whole share. Contents lists each category with its count and the total files; Recipient repeats the name, email, relationship, organization and purpose; Access shows the expiry date and how the code is being delivered. Read the recipient’s email address here, out loud if it helps. It is the one mistake that cannot be taken back quietly.
2. The confirmation is a real attestation. The yellow box states that the disclosure is permitted — for treatment, payment or health care operations, at the patient’s request, or under a signed authorization on file — and that you have limited it to the minimum necessary. Create secure share stays disabled until you tick I confirm this disclosure is permitted and limited to the minimum necessary.

What happens in the minutes after you press create

Creating the share does not send anything. It queues the work, and the dialog swaps to a Share created pane that tells you so: Preparing 66 files, and Dr. Marcus Webb will get the link by email as soon as everything is ready.

1. Each selected item becomes its own PDF. A note renders as the note; a scanned document keeps its pages; a lab order, an imaging study, a prescription record or a visit’s billing becomes a clean printed page. Every page is stamped with the patient’s name and date of birth, the practice, and a confidentiality footer naming the recipient and the date.
2. If you chose to be shown the code, this is the only time you will see it. It sits in a large block with a Copy button and the warning This is the only time the code is shown. Give it to the recipient by phone or in person — never in the same email as the link. Nobody can look it up afterwards, including you and including support. If you lose it, reset it (§ 7.22).
3. Copy link works immediately. Useful when you are on the phone with the receiving office and want to read them the address while the files build.
4. The recipient gets one email, or two. The link email — subject … has shared medical records with you — goes out when the last file is finished, and carries your message and the expiry date. With emailed delivery a second, separate email carries only the access code. Neither email ever contains both.

Statuses, and everything you can still do after sending

The tab list is the status board. While files are still building the row polls and updates on its own; the rest of the time the chip tells you where the share stands.

Clicking a row opens the share detail, which is three stacked sections.

Access

1. Copy next to the link gives you the address again at any time.
2. Extend pushes the expiry out by 7, 14, 30 or 90 days from now — ninety days is the ceiling, always measured from today rather than added to the old date.
3. Resend link email sends the link again to the same address. It does not resend the code, because the code is never stored anywhere it could be read back.
4. Reset access code issues a new one and lets you choose delivery again. The previous code stops working immediately, and so does any session the recipient already had open.
5. Revoke kills the link on the spot. It asks first, because it cannot be undone: the recipient sees the “no longer available” page from that second, and the prepared files are deleted seven days later. The share and its log stay in the chart for ever.

Contents

1. Each file shows its state. Ready · 34 KB · 1 page, or a red line explaining exactly why one failed.
2. Preview opens the finished PDF as the recipient will see it, stamps and all. Use it to check you sent what you meant to send.
3. Retry failed files queues just the failed ones again, once the underlying problem is fixed.
4. Download all (ZIP) gives you the same bundle the recipient can download, for your own records.

The accounting of disclosures, written for you

HIPAA gives a patient the right to ask who their records went to. The Activity section at the foot of the share detail is that answer, kept automatically: Every open, unlock, view and download, for accounting of disclosures.

1. It starts at creation and never stops. Created by you, then the files finishing, then each email going out, then everything the recipient does — Link opened with the IP address it came from, Wrong access code (1 of 5), Access code accepted, Viewed Progress Note, Downloaded all files.
2. Your own later actions are in it too. Extending the expiry, resetting the code, retrying files and revoking the share are each logged with the name of the person who did it.
3. Every line is stamped in your practice’s time zone, so the log reads the same for everyone in the office regardless of where they are sitting.
4. The log outlives the files. Revoking a share or letting it expire removes the prepared PDFs a week later. The share, its contents list and this log stay in the patient’s chart permanently.

Two emails, a code, and a page of files

Knowing the recipient’s side is most of what you need to answer their phone call. They never sign in, never create an account, and never install anything.

1. The link opens a locked page. Your practice’s name and logo, Secure medical records from …, who shared them, one field, and Open records. The hint reads Enter the 12-character code the practice sent you separately. and the foot of the page carries your phone number under Didn’t get a code?
2. The code is forgiving about format, strict about tries. It formats itself as they type and case does not matter. A wrong one says That code isn’t right. 4 attempts left. Five wrong tries locks the page for fifteen minutes; the lockout clears itself, and a Reset access code from your side clears it at once.
3. Unlocked, they get a list, not a download dump. The patient’s name and date of birth, who shared it and when, a chip with the expiry date, your message, and the files grouped under the same category headings you picked them from. Each row has View and Download, and Download all (ZIP) sits above the list with its size and file count.
4. View opens the file beside the list. On a wide screen the PDF fills a pane on the right and they can keep clicking down the list; on a phone or tablet it opens full screen or in a new tab.
5. The page tells them the rules. A confidentiality notice at the foot states that the records are for the named recipient and the stated purpose, that re-disclosure is prohibited, and what to do if they received it in error — with your phone number beside it.

Four habits that keep a share defensible

1. Send the minimum necessary. “Entire chart” is almost never what a cardiologist needs, and it is the hardest choice to defend later. Ask what the request is actually for, then pick the categories — or the individual items — that answer it. The one exception the rule itself carves out is a disclosure to another provider for treatment; even then, a targeted share is easier for them to read.
2. Choose the purpose honestly. The purpose you pick is written into the disclosure log, and the log is what the practice would produce if the patient or a regulator asked. Records for an attorney are Legal, not Treatment, even when a clinician is the one sending them.
3. Never let the link and the code travel together. Two channels is the whole design. Emailed delivery keeps them in two messages; manual delivery keeps the code off email entirely. Pasting the code into the message field, or into a follow-up email, collapses it back into one.
4. Revoke the moment something looks wrong. A mistyped address, a request that turns out not to be authorized, a recipient who says they never asked — revoke first and sort it out afterwards. Revoking is instant, it kills any session the recipient has open, and the log records who did it and when.

The four calls you will actually get