Key points
- Confirm who is asking, and whether they are entitled to the answer, as part of approving each reply.
- The ICO asks for reasonable and proportionate checks, with formal ID only where necessary, and the one-month clock for a subject access request starts once identity is confirmed.1
- HIPAA requires a covered entity to verify the identity and authority of anyone requesting protected health information when either is not already known.2
- Use two identifiers every time. In 67 root cause analyses of misidentification in the US Veterans Health Administration, the most common feature, in 39%, was that two identifiers were not used.4
Summary
Confirm who is asking and whether they are entitled to the information, using two identifiers matched to the record, before sharing anything about a patient. Keep the check quick for a known patient on a known channel and stronger for a new number or a third party, and run it at the moment a person approves the reply.
Patients ask for results and letters on WhatsApp, by email and on the phone, and get an answer within minutes that reaches exactly the right person. A short identity routine, run by the person who approves each reply, keeps the desk fast and every record safe.
See it in your clinicThirty minutes on your own patients and doctors.
Request a demoSee a message from an unknown number arrive, matched against the patient's record, with the reply drafted and held until your team confirms who is asking.
| Situation | Check before sharing | Escalate when |
|---|---|---|
| Known patient, WhatsApp or text from the number on file | Full name and date of birth match the record | The request is for the full record or a third party's details |
| Known patient, email from the address on file | Full name and date of birth match the record | The email asks to send results to a new address |
| Message from a new number or new email address | Two identifiers, then a call back to the number already on the record | Details do not match or the caller refuses the call back |
| Inbound phone call | Two identifiers plus one detail only the patient would know, such as their last appointment date | The caller hesitates on identifiers or asks for someone else's information |
| Family member or carer | The patient's recorded consent or legal authority for that person | No consent is on file, or the patient is an adult who has not been asked |
| Solicitor, insurer or employer | Signed patient authority covering exactly what is requested | The authority is older than the clinic's policy allows or the scope is unclear |
| Subject access request for the full record | Proportionate identity check, logged with the date it was confirmed | Identity cannot be confirmed within a few days of asking |
Identity and entitlement
A patient asking for their own blood results is both who they say and entitled to the answer. A spouse asking on the patient's behalf may be exactly who they say and still need the patient's consent.
The ICO says an organisation needs to be satisfied of the requester's identity and that the information relates to the person in question, with ID requests that are reasonable and proportionate and formal identification only if necessary.1
In the US, 45 CFR 164.514(h) requires a covered entity, before a permitted disclosure, to verify the identity and authority of a person requesting protected health information where either is not already known, and to obtain any documentation the rule requires.2
Proportionate checks keep the clock moving
Under UK GDPR a clinic answers a subject access request without undue delay and within one month, and where it asks for identity information the month runs from when that information arrives. It can extend by up to two further months only for complex or repeated requests.1
Under HIPAA a covered entity acts on a request for access within 30 days of receipt, with one extension of up to 30 days if it explains the delay in writing.3
Scale the check to the risk. A known patient on a known channel confirms two identifiers. A new channel, a third party or a request for the full record gets a stronger check, and a call back to the number already on the record is often the quickest strong check.
Match the message to the right record
Two people can share a name, and a family can share an email address, so attach each message to the right patient before replying.
A review of 3,232 patient safety reports and 67 root cause analyses from the US Veterans Health Administration, October 2016 to September 2018, found the most common characteristic in the analyses was that two identifiers were not used, in 39%, and that policy and process issues made up 42% of root causes.4 The review covered inpatient and outpatient care, and the same two-identifier rule applies at the message desk.
Use full name with date of birth, confirmed against the contact details already held. Add a postcode when names collide.
What to check, channel by channel
The table below sets the check for each situation, so the approver knows what to confirm before a reply goes out.
Build the check into approval
wai keeps each patient's email, web, WhatsApp and phone messages in one thread on their record and drafts the reply inside that thread.5 The person approving sees who wrote, from which channel and against which record, and confirms the match before anything personal is sent.
Staff access is role-based and least-privilege, enforced in the database, and every draft and approval is written to an event log the clinic can export.6 When a patient asks who saw their result and when, the clinic has the answer. The approval model is set out in human approval before a clinic message sends.
Where to start
Write down the two identifiers your clinic uses for every disclosure, and the stronger check for new channels and third parties. Put the table on the front desk and into staff induction.
Then audit a week of messages. Count the disclosures, how many had two identifiers confirmed and how many came from a channel not on the record. Repeat monthly until every disclosure in the log shows a confirmed match. With every channel in one inbox per patient, the audit is a single search.
Bring your current identity checks and a week of messages. We show you each one matched to its record, with the approval logged.
Frequently asked questions
Can a clinic ask for ID before answering a subject access request?
Yes, where it needs to be satisfied of the requester's identity. The ICO says the request for ID should be reasonable and proportionate, and the one-month deadline starts once the identity information arrives.1
Is a WhatsApp message from the patient's own number enough?
It is a good start, and two identifiers confirmed against the record make it a sound check for routine requests. A request for the full record, or to send results somewhere new, gets a stronger check.
What should the desk do when a parent asks about an adult child?
Check whether the patient has recorded consent for that person to receive information. If there is none, take a message and ask the patient directly. HIPAA requires verification of both identity and authority where they are not already known.2
How long does a clinic have to respond to a request for records?
Who decides whether someone is entitled to information?
What is the single most useful rule to adopt first?
Two identifiers, every time, matched against the record before anything personal is shared. It is the step most often missing when misidentification is investigated.4
Sources
- 1Information Commissioner's OfficeA guide to subject accessRead 14 October 2026Read source
- 2Electronic Code of Federal Regulations, US Government, 202645 CFR 164.514, Other requirements relating to uses and disclosures of protected health information, paragraph (h) Verification requirementsRead 14 October 2026Read source
- 3Electronic Code of Federal Regulations, US Government, 202645 CFR 164.524, Access of individuals to protected health informationRead 14 October 2026Read source
- 4Journal of Patient Safety, Kulju and colleagues, 2022Patient Misidentification Events in the Veterans Health Administration, A Comprehensive Review in the Context of High-Reliability Health Care (PubMed abstract)Read 14 October 2026Read source
- 5wai, 2026wai Admin, the front desk and back officeRead 14 October 2026Read source
- 6wai, 2026Security at waiRead 14 October 2026Read source
Every patient answered in minutes, and every record with the right person.
Fifteen minutes with a clinician who uses wai daily, on your own messages and checks. We reply within one working day.
Partner with us
See it on your own patients, then build it with us
Thirty minutes on your own patients, doctors and rules, in your market. We reply within one working day, and the clinics that partner with us early shape what we build next.
See what wai does between the visits