Guide

Patient-supplied paper: review, summarize, incorporate deliberately

Summary

Not automatically — whether an outside record becomes part of your chart is your clinical decision, not a filing default. Scanning a stack of paper into the EHR without review isn't documentation; it's storage that can confuse later readers or misstate what you actually relied on. The deliberate version is: review what the patient brought, summarize what's clinically relevant in your own note, and attach or reference the source — a step that also supports your medical-decision-making level.

By Gale Editorial · Updated 2026-07-27. Every figure cited to a dated source. How we write.

The short answer: it's your clinical call, not a filing rule

Nothing requires you to make every page a patient hands you part of your legal medical record — you decide what's clinically relevant enough to incorporate, and that decision is itself a documented clinical act, not paperwork. A stack of old labs, a discharge summary from a hospitalization, a prior therapist's termination summary: each is worth a deliberate look, not an automatic scan-and-file.

What you can't do is the opposite extreme either — accepting the records, reading them, and then writing nothing about what they contained or how they changed your thinking. If the outside information mattered to your assessment, the fact that you reviewed it belongs in your note even when the original document doesn't.

Why scanning isn't documentation

A PDF sitting in the chart under "outside records" tells the next reader — including you in a year — nothing about whether you actually looked at it, what you found, or whether it changed the plan. Unreviewed attachments accumulate in EHRs precisely because scanning feels like the safe, complete move, when it's actually the incomplete one.

The fix costs a few sentences: what the record was, the relevant finding, and what you did with it — "prior neuropsych testing from 2024 reviewed; consistent with current presentation, no additional workup indicated" is a complete thought a scanned PDF alone never provides.

The coding upside of doing this properly

Under the current evaluation and management framework, review of notes from an external clinician or facility is an explicit data element counted toward medical decision making — it can genuinely move a visit from a lower to a higher MDM level when you document it 1Ref 1Centers for Medicare & Medicaid Services (2023).Evaluation and Management Services Guide.That review of notes from an external clinician or facility is an explicit data-review element counted toward medical decision making under the 2021+ E/M framework, and what documentation it requires.. This is one of the few places where doing the clinically right thing and doing the billing-defensible thing are the same action.

The AMA's E/M revisions specify what counts: review of the actual external note or result, not a patient's verbal summary of it, and your documentation has to reflect that you reviewed the source material itself 2Ref 2American Medical Association (2023).CPT evaluation and management (E/M) revisions.That the AMA's E/M revisions define the data-review categories, including review of external notes and results, that count toward MDM level under the current framework.. "Patient reports prior diagnosis of X" is history; "reviewed discharge summary from [facility] dated [date]" is the data-review element that supports a higher level.

Signing off on what you incorporate

Once you write a note that references or summarizes an outside record, your own signature authenticates that summary the same way it authenticates anything else in your note — Medicare's signature requirements apply to your entry, not to whether the original document was itself signed 3Ref 3Centers for Medicare & Medicaid Services (2023).Complying with Medicare Signature Requirements.That Medicare's signature requirement authenticates the clinician's own entry summarizing or referencing an outside record, not the original document's authentication.. An unsigned attachment from another practice doesn't need your attestation; a sentence you write characterizing what it says does.

If a reviewer later questions what you relied on, the note you signed — not the scanned PDF sitting beside it — is what has to hold up. Write the summary carefully enough that it would.

How long to keep the original versus your summary

Your own note summarizing the outside record follows your practice's normal retention schedule, but the original paper or scanned document a patient handed you doesn't automatically inherit a different, shorter timeline just because someone else created it — once it's part of your record, it's subject to the same retention rule as anything else in that chart. A common behavioral health retention convention, always deferring to your state's specific rule, is several years past last contact, longer for a minor patient 4Ref 4American Psychological Association (2007).Record Keeping Guidelines.APA's record-keeping guideline retention convention for behavioral health records, used here as a norm for how long an incorporated outside record is retained, always deferring to state law..

If you choose not to incorporate a document at all — you reviewed it and decided it wasn't clinically relevant — returning the original to the patient rather than holding onto an un-incorporated stack of paper indefinitely is a reasonable practice, documented with a brief note that it was reviewed and returned.

Once it's in, it's part of what the patient can request back

An outside record you incorporate into your chart becomes part of your designated record set, and a patient's later request for their complete record from you includes it — you can't treat an incorporated external document as somehow exempt from your own access obligations just because you didn't create it 5Ref 5HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.That an incorporated outside record becomes part of the designated record set a patient has a right to access from you directly.. This is one more reason review-then-decide beats scan-everything: every page you incorporate is a page you're now responsible for producing on request.

The reverse also matters for the problem list: a diagnosis appearing only in an unreviewed scanned attachment, never carried into your own problem list or note, is easy to miss on a later chart review — incorporating deliberately is what keeps the problem list actually current.

A workable intake routine for a solo practice

Handle patient-supplied paper the same day it arrives rather than letting it become the inbound pile: skim for anything urgent, decide incorporate-or-return, and if incorporating, write the summary sentence into your next note or an addendum before you move on. Records that arrive because you initiated a referral or requested them belong in the same review step as anything the referral log tracks.

A five-minute habit at intake — read, decide, summarize, file or return — prevents the more common failure mode, which isn't mishandling a record but never touching it again after the scan.

Common questions

Scan it, note in the chart that it was received but not yet reviewed, and set a concrete follow-up point — your next note or within a few days — rather than letting an unreviewed attachment sit indefinitely. An honest "received, pending review" entry is defensible; a silent, permanently unreviewed PDF is not.

Incorporate the factual content — what was tested, what was found, what was diagnosed — regardless of your opinion of the source, and note your own clinical assessment of it separately if relevant. Your job is accurate documentation of what you reviewed, not editorializing about another clinician's competence in the chart.

Generally no — once a record is part of your chart, the same open-notes and portal-access defaults that apply to anything else in the record apply to it, and there's no separate rule shielding an incorporated outside document from the patient seeing it. The portal covers how to configure what releases and when.

The patient bringing you the records and asking you to review them functions as their authorization for that use in treatment; a formal consent form isn't typically required for incorporating records the patient personally supplied for their own care. Requesting the same records directly from another provider, rather than through the patient, is a different process with its own authorization requirements.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.Centers for Medicare & Medicaid Services (2023). Evaluation and Management Services Guide. CMS Medicare Learning Network (MLN006764). link ✓That review of notes from an external clinician or facility is an explicit data-review element counted toward medical decision making under the 2021+ E/M framework, and what documentation it requires.
2.American Medical Association (2023). CPT evaluation and management (E/M) revisions. American Medical Association (AMA). link ✓That the AMA's E/M revisions define the data-review categories, including review of external notes and results, that count toward MDM level under the current framework.
3.Centers for Medicare & Medicaid Services (2023). Complying with Medicare Signature Requirements. CMS Medicare Learning Network (MLN905364). link ✓That Medicare's signature requirement authenticates the clinician's own entry summarizing or referencing an outside record, not the original document's authentication.
4.American Psychological Association (2007). Record Keeping Guidelines. American Psychological Association. link ✓APA's record-keeping guideline retention convention for behavioral health records, used here as a norm for how long an incorporated outside record is retained, always deferring to state law.
5.HHS Office for Civil Rights (2026). Individuals' Right under HIPAA to Access their Health Information. U.S. Department of Health and Human Services. linkThat an incorporated outside record becomes part of the designated record set a patient has a right to access from you directly.

https://www.gale.care/for-providers/cde-patient-supplied-records · 5 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers