Verification may be done orally or in writing and, in many cases, the type of verification may depend on how the individual is requesting and/or receiving access – whether

For example, a doctor may not require an individual: Who wants a copy of her medical record mailed to her home address to physically come to the doctor's office to request access and provide proof of identity in person.

Unreasonable Measures While the Privacy Rule allows covered entities to require that individuals request access in writing and requires verification of the identity of the person requesting access, a covered entity may not impose unreasonable measures on an individual requesting access

by faxing or e-mailing the request

the individual from obtaining access to his PHI,

provided use of the form does not create a barrier to

Requests for Access Requiring a Written Request A covered entity may require individuals to request access in writing,