HIPAA and state laws require patient health information (PHI) release in a manner that supports access and protects privacy. Because medical malpractice lawsuit defense depends so heavily on evidence preserved in the patient’s medical record, appropriate medical record retention is a major aspect of medical liability risk management. Although medical ethics requirements for medical record access, retention, and release are general, they can nudge decisions where the law is ambiguous. This month’s Claims Rx presents a sample of NORCAL Group insureds’ questions about medical record release, access, and retention, the answers provided by NORCAL Group Risk Management Specialists, and resources for further information.