Health Information Management (Program Statement 6090.04)

By Elizabeth Franklin-Best, Esq., and Christopher Zoukis, JD, MBA

Field	Value
Program Statement	6090.04
Subject	Health Information Management
Effective / current edition	03-02-2015
Change notices	None. BOP’s published policy list carries 6090.04 with no change notice.
Supersedes	P6090.03, Health Information Management (7/31/12), rescinded — PS 6090.04 at p. 1
Governing statute	The Privacy Act of 1974, 5 U.S.C. § 552a (cited in the Program Statement at p. 3), and the Freedom of Information Act, 5 U.S.C. § 552
28 C.F.R. anchor	§ 513.42 (Inmate access to medical records) and § 513.44 (Fees for copies of Inmate Central File and Medical Records) — part 513 “Access to Records,” subpart D “Release of Information,” section group §§ 513.40–513.44 “Inmate Requests to Institution for Information.” Privacy Act exemption at 28 C.F.R. § 16.97.
Related BP forms	BP-A0148 Inmate Request to Staff (“cop-out”) · BP-A0621 Authorization for Release of Medical Information · Form DOJ-361 Certification of Identity
Official PDF	bop.gov/policy/progstat/6090_004.pdf

Checked against the BOP policy set · 2026-09-06.

Program Statement 6090.04 is the Bureau of Prisons’ instruction to its own staff on how federal prison medical records are built, kept, corrected, released and destroyed — including the exact route a person in custody uses to see or copy their own chart, what staff screen out before handing it over, what it costs, and how a family member or lawyer gets a copy from outside. It is the document-handling manual behind every request for a federal prisoner’s medical file.

Get this right early, because the medical record is the evidence. In a compassionate release motion under 18 U.S.C. § 3582(c)(1)(A), in an administrative remedy about untreated care, in a sentencing or resentencing presentation — the chart is what a court reads, and the chart takes weeks or months to assemble. The related information page on this site is What Rights Do Prisoners Have?, which covers the broader question of what the Constitution and BOP policy give a person in custody; this page covers one narrow, mechanical piece of it: how the record actually moves.

The rule itself: medical records

Everything in this section is transcribed from the Bureau’s own text at bop.gov/policy/progstat/6090_004.pdf, with the page anchor for each passage.

The request procedure: who asks, on what form, and to whom

From Section 3.a, PS 6090.04 at p. 5 (transcribed verbatim):

a. Incarcerated Inmate Review of Health Record. The following procedures apply to the release of health records to an inmate who is currently incarcerated in a Bureau institution.

An inmate seeking review and/or copies of his/her health records must complete an Inmate Request to Staff (BP-A0148) in order to review or receive copies of the record. The BP-A0148 will be addressed to the HSA or his/her designee.

Prior to review of records by an inmate (or copies given to an inmate), Health Services staff will review the records to determine if a legitimate security concern exists (i.e., whether there is any information which, if disclosed to the inmate, might reasonably be expected to harm the inmate or another person). The reviewer may have to consult the institution physician in evaluating records for release.

“HSA” is the Health Services Administrator, the non-clinical manager who runs the medical department. The BP-A0148 is the Inmate Request to Staff, universally called a “cop-out.” Our page on that form is Request to Staff.

The time frame — and there is only one

This is the single most important thing to understand about this policy: it contains no deadline. The Program Statement gives one temporal instruction on production, PS 6090.04 at p. 6:

The HSA/Designee will make the copies in a reasonable amount of time and give them to the inmate.

The regulation says the same thing and no more. 28 C.F.R. § 513.44 provides: “Within a reasonable time after a request, Bureau staff are to provide an inmate personal copies of requested disclosable documents maintained in the Inmate Central File and Medical Record.” Neither the policy nor the rule sets a number of days.

That matters practically. If you need a record by a date — a filing deadline, a hearing, a specialist appointment — nothing in this Program Statement obliges the institution to meet it, and the enforceable clocks live elsewhere: the twenty-working-day FOIA determination deadline in 5 U.S.C. § 552(a)(6)(A)(i), and the ten-working-day Privacy Act acknowledgment in 5 U.S.C. § 552a(d)(2)(A). See What actually binds, below, for why only the first of those two is usually available.

What the institution documents when it releases — or withholds

PS 6090.04 at p. 6:

An administrative note in the EHR or paper chart will be made with the following information:

– Date of release. – Number of copies. – Items released (as an example, this can be accomplished by notations such as “SF-600 dates inclusive of 01-01-93 thru 03-06-94”). – Items withheld. – Signature.

The original BP-A0148 will be filed in section 6 of the paper health record or EHR document manager.

If information is withheld from the inmate, he/she will be provided a copy of the administrative note denying the release and advised that he/she may send a Freedom Of Information Act (FOIA) request for the withheld records to:

Central Office, Office of General Counsel Freedom of Information (FOI) Section 320 First Street, NW Washington, DC 20534

The same page describes what happens next: “If the inmate makes a FOIA request, a copy of the records withheld and the administrative note will be forwarded to the Regional Office. The Regional Counsel’s Office will conduct a review of the document(s) that the institution has indicated on the administrative note were not released,” and “Under all circumstances, the Regional Counsel’s office will make any direct release of records to the inmate and/or inform the inmate of the denial(s) and his/her appeal rights” (p. 6).

The administrative note is the whole ballgame on a withholding dispute. It is the only contemporaneous document that says what was held back and by whom. Ask for it by name.

The institution also keeps a release log. PS 6090.04 at p. 7: “A system will be maintained for tracking requests for releasing medical information, including:

• Patient name and number.
• Requester name.
• Date requests received.
• Disposition of requests (date).
• Number of pages copied.
• Number of pages withheld.
• Fee, if any.”

The fees, exactly as the Program Statement states them

This is the passage people come looking for. PS 6090.04 at p. 8, transcribed verbatim:

c. Fees. Under 28 CFR 16.11, an inmate may be charged $.10 per page for duplication. An inmate may never be charged for a review of his/her records. A charge for fees may not be levied if the total to be collected is $14.00 or less.

The first 100 pages are free with no subsequent charge until a fee in excess of $14.00 is reached:

Pages 1-240 = No charge. Pages 241 and above = charged $.10 per page for each page after the first 100.

Example: 241 pages = 241-100 = 141 pages x $.10 = $14.10 335 pages = 335-100 = 235 pages x $.10 = $23.50

Inmates will be informed of estimated fees. Fees will not be collected until copies have been made. Copies will not be provided to the inmate until associated fees are paid.

Consult the institution’s Trust Fund Manager regarding processing of fees.

Read that against the current regulation before you rely on the numbers. The fee citation in the Program Statement is stale. 28 C.F.R. § 16.11 is now titled “Other rights and services” and contains no fee schedule at all; the Justice Department moved its FOIA fee provisions to § 16.10 effective 14 February 2017. The Bureau’s own fee rule, 28 C.F.R. § 513.44, directs that “Fees for the copies are to be calculated in accordance with 28 CFR 16.10.” And § 16.10 provides:

What § 16.10 provides	Verbatim text
Per-page duplication rate	“Where photocopies are supplied, the component shall provide one copy per request at a cost of five cents per page.”
Free allowance	“Except for requesters seeking records for a commercial use, components shall provide without charge: (i) The first 100 pages of duplication (or the cost equivalent for other media); and (ii) The first two hours of search.”
Threshold below which nothing is charged	“When, after first deducting the 100 free pages (or its cost equivalent) and the first two hours of search, a total fee calculated under paragraph (c) of this section is $25.00 or less for any request, no fee will be charged.”

Ten cents versus five cents, and a $14.00 floor versus a $25.00 floor. The Program Statement’s worked examples were computed on the pre-2017 schedule. Two things in the Program Statement are unaffected and still worth quoting to staff: an inmate may never be charged for a review of the record, and fees are not collected until the copies have actually been made. If an institution quotes you a price, ask in writing which schedule it applied. See also the Inmate Copayment Program, which is a different charge entirely — a fee for a health-services visit, not for paper.

Third-party requests — the family member, the lawyer, the outside doctor

PS 6090.04 at p. 8, verbatim:

d. “Third Party” Requests. The first party is the patient-inmate, the second party is the custodial agency holding the health records and providing care. All third party requests for medical information will be processed under direction of OGC’s FOIA/Privacy Act Section in the Central Office. A dated authorization form that has been notarized or signed under penalty of perjury must accompany any request. The authorization is valid for three months from the date of patient’s signature. Requests from the Social Security Administration (SSA) will not be forwarded to the OGC’s FOIA section. SSA requests will be processed at the institution level.

Three months. That is the number that quietly kills more third-party requests than anything else in this policy. An authorization signed in January is spent by April. If a request is returned for a curable defect and the fix takes six weeks, the authorization can expire in the meantime. Get the signature dated as close as possible to the day the request goes out, and get a second signed original at the same time.

The Program Statement also limits how much gets copied. PS 6090.04 at p. 8: “e. Copying of Health Records. The Bureau monitors the copying of health records because it is time-consuming for HIM staff and may not be relevant to the recipient. When a copy of a voluminous health record is requested, the requestor will be contacted to ask which specific portion of the health record is required.” Practical translation: an open-ended “send everything” request invites a phone call and a delay. Name date ranges and document types.

If the person has been released, or is in a halfway house

Different route entirely. PS 6090.04 at p. 7, verbatim:

b. Inmates Released from Federal Custody or in Residential Reentry Centers (RRCs). The following procedures apply to the release of health records to an inmate who has been released from Federal custody or is currently housed in a RRC.

If an inmate seeking copies of his/her health records sends his/her request directly to the institution, the request will be returned to the inmate with instructions to make a written request to the address in Section 3.a. The inmate will be further instructed that he/she must provide a signature that is notarized or signed under penalty of perjury to establish his/her identity along with the written request for records.

From there, per pp. 7–8: the Office of General Counsel’s FOIA/Privacy Act Section logs the request, determines where the person was last designated, and forwards it to the Regional Office, which contacts that institution and coordinates the release. “The HSA/Designee will make the copies and forward them to the Regional Office. The Regional Office will release the records directly to the inmate” (p. 8).

That is a four-office relay — institution, Regional Office, Central Office, and back — for a person who has already gone home. Build the calendar accordingly. The Justice Department’s identity-certification form for this purpose is Form DOJ-361, which carries the Privacy Act statement under 28 C.F.R. § 16.41(d).

HIV-related records — the one category with its own rule

Transcribed from PS 6090.04 at p. 6:

Currently incarcerated inmates may review their records, including laboratory results or other HIV-related information, but may not receive a copy. HIV-related health records may be forwarded to a third party of the inmate’s choosing outside the institution, provided that the inmate authorizes the disclosure in writing.

And from p. 8, for people who have left the institution:

A copy of laboratory results showing HIV status may be released to an inmate released from Federal custody. However, a copy of laboratory results or other health records showing HIV status will not be given to an inmate housed in a RRC; he/she will be orally advised of, and may review, the results while still housed in a Federal institution.

The regulation states the same restriction more cleanly, and it is the regulation that binds. 28 C.F.R. § 513.42(b): “Lab results of HIV testing may be reviewed by the inmate. However, an inmate may not retain a copy of his or her test results while the inmate is confined in a Bureau facility or a Community Corrections Center. A copy of an inmate’s HIV test results may be forwarded to a third party outside the institution and chosen by the inmate, provided that the inmate gives written authorization for the disclosure.”

So: review, yes. Retain a copy while inside or in a halfway house, no. Send a copy to your lawyer or your own doctor on the outside with a written authorization, yes.

Imaging films

PS 6090.04 at p. 7: “The Bureau has limited facilities to reproduce copies of x-ray, xerography, and ultrasonography films. Therefore, when copies are requested, the HSA/designee will estimate the current costs for reproduction from a community source. The requesting inmate will be financially responsible for these costs and will provide a mailing address for a physician he/she chooses to receive the films.” And: “Due to security and property restrictions, the films will not be allowed in inmate housing units.”

Films go to a named outside physician, at the requester’s expense. They do not come back to the cell.

Retention — how long the record survives release

PS 6090.04 at p. 11, verbatim:

(1) Paper Records. Paper health records are retained in original form after the inmate is released from the Bureau. HIM staff will ensure health records of released inmates are transferred to the Correctional Systems (CS) Department. The CS Department will maintain consolidated inactive records until they are sent to the regional Federal Records Center. Refer to the Program Statement Correctional Systems Manual for a schedule of retention.

(2) Electronic Records. Electronic health records are maintained by Central Office Information Systems until they are archived in accordance with the Bureau’s policy.

PS 6090.04 does not itself state a retention period. It routes the schedule to the Correctional Systems Manual — our page on that is Correctional Systems Manual (PS 5800.15) — and, per the References block at p. 15, to the “Records and Information Disposition Schedule (RIDS) on Sallyport,” an internal system that is not published. If a retention period is load-bearing in your matter, do not take a number from a secondary source; request the applicable RIDS item directly.

Two dividing lines are worth knowing. The electronic record is the operative record for care delivered on or after 1 January 2009: “Effective January 1, 2009, all available processes within the electronic health record (EHR) are required for use when documenting patient care, treatment, and services. Records prior to January 1, 2009, may be documented on paper and filed in a yellow, six-part BOP health record folder” (p. 3). And the medical record is not the Inmate Central File — the two are separate systems with separate access rules. See Inmate Central File, Privacy Folder, and Parole Mini-Files (PS 5800.17).

What actually binds

This distinction decides what you can enforce, so it goes near the front rather than buried.

A Program Statement is the Bureau’s internal instruction to its own staff. It is not a regulation. The Supreme Court said so directly in Reno v. Koray, 515 U.S. 50 (1995), describing a Program Statement as “an internal agency guideline” that is “akin to an ‘interpretive rule’ that ‘do[es] not require notice and comment,'” though “still entitled to some deference” where it is a permissible construction of the statute. When this page says the policy “directs staff” to do something, that is precise language, not hedging.

What binds is short and worth reading in the original.

28 C.F.R. § 513.42, “Inmate access to medical records.” The whole of the access right sits here:

• (a) “Except for the limitations of paragraphs (c) and (d) of this section, an inmate may review records from his or her medical file (including dental records) by submitting a request to a staff member designated by the Warden.”
• (b) “Laboratory reports which contain only scientific testing results and which contain no staff evaluation or opinion (such as Standard Form 514A, Urinalysis) are ordinarily disclosable.”
• (c) “Medical records containing subjective evaluations and opinions of medical staff relating to the inmate’s care and treatment will be provided to the inmate only after the staff review required by paragraph (d) of this section. These records include, but are not limited to, outpatient notes, consultation reports, narrative summaries or reports by a specialist, operative reports by the physician, summaries by specialists as the result of laboratory analysis, or in-patient progress reports.”
• (d) “Prior to release to the inmate, records described in paragraph (c) of this section shall be reviewed by staff to determine if the release of this information would present a harm to either the inmate or other individuals. Any records determined not to present a harm will be released to the inmate at the conclusion of the review by staff.” And: “If any records are determined by staff not to be releasable based upon the presence of harm, the inmate will be so advised in writing and provided the address of the agency component to which the inmate may address a formal request for the withheld records.”

Two things follow. First, the harm review in § 513.42(d) is a document-by-document review of subjective material, not a license to withhold the chart. Objective results — labs, imaging reports without narrative opinion — are “ordinarily disclosable” under (b) without any of that. Second, the denial notice must be in writing and must carry the address for a formal request. That is a regulatory obligation, not a courtesy.

28 C.F.R. § 16.97, the Privacy Act exemption — and why FOIA, not the Privacy Act, is the working route. The Bureau’s medical records live in a system of records called the Inmate Physical and Mental Health Record System, JUSTICE/BOP-007. Section 16.97(a) provides that a list of BOP systems, including “(5) Inmate Physical and Mental Health Record System (JUSTICE/BOP-007),” “are exempt from 5 U.S.C. 552a (c) (3) and (4), (d), (e) (2) and (3), (e)(4) (H), (e)(8), (f) and (g).”

Subsection (d) is the Privacy Act’s access and amendment provision. The rule explains why: exemption from it “is essential to protect internal processes by which Bureau personnel are able to formulate decisions and policies with regard to federal prisoners, to prevent disclosure of information to federal inmates that would jeopardize legitimate correctional interests of security, custody, or rehabilitation…”

So the Privacy Act’s own machinery — 5 U.S.C. § 552a(d)(1), which otherwise directs an agency to “permit him… to review the record and have a copy made of all or any portion thereof in a form comprehensible to him,” and § 552a(d)(2), which sets a ten-working-day acknowledgment deadline on an amendment request — is exempted as to this system. That is the reason the Program Statement routes withheld records to FOIA rather than to a Privacy Act appeal (p. 6).

Section 16.97 does not leave the door shut. It records that “Consistent with the legislative purpose of the Privacy Act of 1974 (Pub. L. 93-579) the BOP has initiated a procedure whereby federal inmates in custody may gain access and review their individual prison files maintained at the institution of incarceration,” limited “only to the extent that the disclosure of records to the inmate would jeopardize internal decision-making or policy determinations essential to the effective operation of the Bureau of Prisons; to the extent that disclosure of the records to the inmate would jeopardize privacy rights of others, or a legitimate correctional interest of security, custody, or rehabilitation; and to the extent information is furnished with a legitimate expectation of confidentiality.” It also confirms that “inmates in federal institutions may file administrative complaints on any subject under the control of the Bureau. This would include complaints pertaining to information contained in these systems of records” — and that the Bureau may waive an exemption “either partially or totally” where compliance “would not appear to interfere with or adversely affect the law enforcement process.”

FOIA, 5 U.S.C. § 552. Because the Privacy Act access route is exempted, FOIA carries the enforceable clock. Section 552(a)(3)(A) directs that an agency, on a request that “reasonably describes such records” and follows the agency’s published rules, “shall make the records promptly available to any person.” Section 552(a)(6)(A)(i) directs the agency to “determine within 20 days (excepting Saturdays, Sundays, and legal public holidays) after the receipt of any such request whether to comply,” and to notify the requester of the determination, the reasons, the right to seek help from the agency’s FOIA Public Liaison, and — for an adverse determination — the right to appeal “within a period determined by the head of the agency that is not less than 90 days.” Appeals get their own twenty-working-day clock under § 552(a)(6)(A)(ii). “Unusual circumstances” allow a written extension of no more than ten working days under § 552(a)(6)(B)(i). Our page on the Bureau’s implementing policy is FOIA and Privacy Act Requests (PS 1351.05).

Applied Insight — Christopher Zoukis, JD, MBA, Managing Director: Run the two tracks in parallel, not in sequence. The BP-A0148 to the Health Services Administrator is fast, free, and gets you the bulk of the chart; the FOIA request preserves a statutory deadline and an appeal right and is the only route to whatever the harm review pulled out. People routinely file the cop-out, wait three months, get a partial production, and only then start FOIA — and lose a quarter of a year on a compassionate-release timeline. File both in the same week. Then ask, specifically, for the administrative note required at p. 6, because that note is the only document that lists what was withheld.

HIPAA — handled precisely, because this is the most misstated point on the subject

Section 4 of the Program Statement, PS 6090.04 at pp. 9–10, transcribed verbatim:

4. HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA)

While the Bureau is not a HIPAA covered entity, most community-based healthcare providers with which the bureau contracts are HIPAA covered entities. However, 45 CFR § 164.512, Uses and disclosures for which an authorization or opportunity to agree or object is not required, permits those contracted providers to disclose protected health information without the written authorization of the inmate when the disclosure is for a specialized government function. Section 164.512(k)(5) specifically provides:

> A covered entity may disclose to a correctional institution or a law enforcement official having lawful custody of an inmate or other individual protected health information about such inmate or individual, if the correctional institution or such law enforcement official represents that such protected health information is necessary for > > (A) The provision of health care to such individuals.

Therefore, an inmate does not need to sign a release of information form or otherwise give consent in order for Bureau health services staff to obtain copies of his/her medical records.

Three points of precision.

First, the Bureau’s statement that it “is not a HIPAA covered entity” is the agency’s own characterization, not a holding and not a regulation. Whether an entity is covered turns on a factual test, not a label. 45 C.F.R. § 160.103 defines “[c]overed entity” as “(1) A health plan. (2) A health care clearinghouse. (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter,” and defines “[h]ealth care provider” as “a provider of services…, a provider of medical or health services…, and any other person or organization who furnishes, bills, or is paid for health care in the normal course of business.” The third prong is an electronic-transaction test — it asks what the provider transmits, not what kind of institution it is. The HIPAA rules themselves plainly contemplate that a correctional institution can be covered: both of the inmate provisions below open with the words “A covered entity that is a correctional institution.” We report BOP’s position as BOP’s position and flag it for review; we have not located a judicial holding resolving it, and this page does not assert the Bureau’s characterization as settled law.

Second, the quotation in the Program Statement is truncated. 45 C.F.R. § 164.512(k)(5)(i) lists six permitted purposes, not one. Verbatim, a covered entity may disclose if the correctional institution or law enforcement official represents that the protected health information is necessary for:

	Purpose, verbatim from § 164.512(k)(5)(i)
(A)	“The provision of health care to such individuals”
(B)	“The health and safety of such individual or other inmates”
(C)	“The health and safety of the officers or employees of or others at the correctional institution”
(D)	“The health and safety of such individuals and officers or other persons responsible for the transporting of inmates or their transfer from one institution, facility, or setting to another”
(E)	“Law enforcement on the premises of the correctional institution”
(F)	“The administration and maintenance of the safety, security, and good order of the correctional institution”

Two further provisions travel with that list. Under § 164.512(k)(5)(ii), “A covered entity that is a correctional institution may use protected health information of individuals who are inmates for any purpose for which such protected health information may be disclosed.” And under § 164.512(k)(5)(iii) — the sentence that matters most to families — “No application after release. For the purposes of this provision, an individual is no longer an inmate when released on parole, probation, supervised release, or otherwise is no longer in lawful custody.” The correctional-disclosure exception ends at the prison gate.

Third, HIPAA’s access right has its own inmate carve-out, and it is narrower than people assume. 45 C.F.R. § 164.524(a)(1) gives an individual “a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set,” excepting psychotherapy notes and material “compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.” The inmate provision at § 164.524(a)(2)(ii) reads, verbatim:

A covered entity that is a correctional institution or a covered health care provider acting under the direction of the correctional institution may deny, in whole or in part, an inmate’s request to obtain a copy of protected health information, if obtaining such copy would jeopardize the health, safety, security, custody, or rehabilitation of the individual or of other inmates, or the safety of any officer, employee, or other person at the correctional institution or responsible for the transporting of the inmate.

Note what it says and what it does not. It permits denial of a request to obtain a copy — not a request to inspect. It is listed among the unreviewable grounds for denial, which means no internal HIPAA review of that denial. It requires a jeopardy finding, not a preference. And where it applies at all, § 164.524(b)(2)(i) still directs the covered entity to “act on a request for access no later than 30 days after receipt of the request,” with a single extension of “no more than 30 days” on written notice of the reasons and a completion date under § 164.524(b)(2)(ii).

The practical upshot is that HIPAA is rarely the lever inside a federal prison. When a client is treated at an outside hospital or by a contract specialist, HIPAA and its thirty-day clock govern that provider’s own copy of the chart — and a request sent directly to the hospital, with a signed authorization, is often the fastest way to get records that BOP is still assembling.

What health records policy means for you

If you are the person inside: two forms, in this order

Two forms, in this order. Write a BP-A0148 Inmate Request to Staff addressed to the Health Services Administrator, ask to review your health record and to receive copies, and name what you want: date range, and document types (SF-600 clinical encounters, laboratory reports, imaging reports, consultation reports, medication administration records). A specific request produces a smaller, faster, cheaper production than “my medical records.” Then, separately, ask your unit team for the FOIA route so a statutory clock starts.

You may never be charged for a review (p. 8). If you are told there is a fee for copies, ask which fee schedule was applied — the Program Statement’s ten cents or the current regulation’s five cents — and ask for the estimate in writing before the copies are made, because “[f]ees will not be collected until copies have been made” (p. 8).

If something is held back, you are owed a copy of the administrative note denying release and the FOIA address (p. 6), and 28 C.F.R. § 513.42(d) directs that you “be so advised in writing.” Do not accept a verbal “medical says no.” Ask for the note.

If you are the family member: why you cannot get the records

You cannot get these records on your own. Every third-party request runs through the Office of General Counsel’s FOIA/Privacy Act Section in Central Office and must carry a dated authorization from your loved one that is “notarized or signed under penalty of perjury” and is “valid for three months from the date of patient’s signature” (p. 8). Three months is short. Send the authorization form in, get it back signed and dated, and file immediately — and consider having two signed originals executed at once so a returned request does not restart the whole cycle.

If your loved one is in a medical crisis, records are the slow lane and the phone is the fast one. The Health Services Administrator and the Clinical Director are the two people who can act; the Patient Care page explains who does what in a federal prison medical department, and Medical Designations and Care Levels explains why a person with a serious condition may be at the wrong facility for it. For a general orientation to what medical care in the Bureau actually looks like, see Medical and Dental Care in Prison, Dental Care in Prison, and Medical Care Levels in Federal Prison.

If you are counsel: medical records

Treat the medical record as a production project with a critical path, because it is one. Four practical points.

The authorization expires in three months (p. 8). Diary it. A stale authorization is the most common reason a third-party request comes back unfilled.

The harm review is document-specific. 28 C.F.R. § 513.42(b) makes objective lab results “ordinarily disclosable” with no review at all; only “subjective evaluations and opinions” under (c) go through the (d) screen. If a whole chart comes back withheld, the categorical withholding is itself the argument.

The administrative note and the tracking log (pp. 6–7) are the paper trail. The note lists items withheld; the log records dates received, disposition, pages copied, pages withheld and fee. Both are records about the client and both are requestable.

Do not build a compassionate-release timeline on this Program Statement’s silence. There is no production deadline in the policy or in § 513.44. If a filing depends on the chart, file the FOIA request the same week you file the request to the warden under 18 U.S.C. § 3582(c)(1)(A) — see Compassionate Release Request to Warden: BOP Administrative Exhaustion — and pull the outside hospital’s copy directly under HIPAA in parallel. For the substantive standards, see Federal Compassionate Release Attorney, Compassionate Release for Terminal Illness and Serious Medical Conditions, and Elderly and Aging Inmates. The record-gathering discipline is the same one described in Getting Your Transcripts, PSR, and Your Lawyer’s File.

What changed from PS 6090.03 to 6090.04

PS 6090.04, dated 3/2/2015, rescinded P6090.03, Health Information Management (7/31/12) — PS 6090.04 at p. 1. The reissuance stated its own changes, and they are worth reading because several are still the operative rule. Transcribed from pp. 1–2:

This reissuance incorporates the following modifications:

– Signature log no longer required. – Medical Referral Centers will have a credentialed health information professional on staff or contract those services (see Section 2.a.). – Each facility will have a copy of the most recent version of the International Classification of Diseases, Clinical Modification (see Section 2.b.). – Description of the Bureau’s system of records is referenced in Section 2.c. – Applicability of the Health Insurance Portability and Accountability Act (HIPAA) is described in Section 4. – Copies of applicable inmate health records (in lieu of originals) will be taken on escorted medical trips (see Section 5.b.). – Institutions will have an Institution Supplement regarding interruptions to information processes (see Section 6.). – Facilities will use only approved abbreviations in Appendix C. – Health record entries will be timely (see Section 7.d.). – Procedure for correction of electronic health records is described in Section 7.e.2. – Definition of co-signature and review is provided in Section 7.f.1 and 2. – All staff-generated forms filed in the record will be in English (see Section 8.a.).

The 2015 edition is where the HIPAA discussion first appears, and where the “copies, not originals, travel on escorted medical trips” rule comes from — a change that matters if a client’s chart went missing after an outside hospital run (p. 10, and the lost-record search procedure at pp. 10–11).

What has moved since 2015, and the Program Statement has not caught up.

The fee regulation moved. The Justice Department revised its FOIA regulations effective 14 February 2017; 28 C.F.R. § 16.10 is now the fee section, at five cents a page with a $25.00 floor, and § 16.11 — the section the Program Statement cites — is now “Other rights and services.” The Bureau’s own rule, § 513.44, points to § 16.10.

Two of the Program Statement’s own references have been superseded. The References block at p. 15 cites “5800.14 Correctional Systems Manual (1/1/2009)” — now PS 5800.15, our page is Correctional Systems Manual — and “6031.04 Patient Care (6/3/2014)” — now PS 6031.06, our page is Patient Care. The third reference, “1351.05 Release of Information (9/19/2002),” remains the current edition; see Release of Information (PS 1351.05).

The Program Statement also carries an internal inconsistency about its own system-of-records notice. At p. 5 it gives “67 FR 11712 (5/14/02)”; at p. 15 it gives “‘Inmate Physical and Mental Health Record System, JUSTICE/BOP – 007,’ 67 Federal Register 51 (15 March 2002), pp. 11712 – 11714.” Same pages, two different dates. And at p. 3 it cites “28 CFR part 16 §51336,” which is not a valid citation. None of these is load-bearing for a records request, but all three are the kind of thing that gets quoted back at you in a filing, so we note them rather than repeat them.

Finally, the vocabulary has moved. The Program Statement’s abbreviation list at Appendix C still expands “INS” as “Immigration and Naturalization Service,” an agency dissolved in 2003, and the body uses “Community Corrections Center” where the Bureau’s own current regulations use “Residential Reentry Center” — compare 28 C.F.R. § 0.96(u), which refers to “the Residential Reentry Center (RRC) contract.”

Where people get stuck requesting medical records

Four problems recur. Each has a route, and the route matters more than the complaint.

“I asked for my records and nothing happened.” There is no deadline in this policy, so a silent institution is not violating a time limit — which is exactly why the FOIA track exists. Send a follow-up BP-A0148 to the Health Services Administrator that (a) restates the original request date, (b) narrows the request to specific dates and document types, and (c) asks for the status entry from the tracking system described at p. 7. If that produces nothing, the formal ladder is the Administrative Remedy Program: BP-9 to the Warden, BP-10 to the Regional Director, BP-11 to the Office of National Inmate Appeals, under 28 C.F.R. part 542, subpart B. The deadline is short — 28 C.F.R. § 542.14(a) sets “20 calendar days following the date on which the basis for the Request occurred,” subject to an extension “[w]here the inmate demonstrates a valid reason for delay.” BOP publishes the BP-A0148 but does not publish the BP-9, BP-10 or BP-11 forms; you get those from your unit team. See Administrative Remedy Program and Prison Grievances.

“They gave me part of it and would not say what was missing.” This is the strongest grievance in the set, because the obligation is regulatory rather than policy. 28 C.F.R. § 513.42(d) directs that where records are withheld for harm, “the inmate will be so advised in writing and provided the address of the agency component to which the inmate may address a formal request for the withheld records,” and PS 6090.04 at p. 6 directs that the person receive “a copy of the administrative note denying the release.” Cite the section number, ask for the note, and send the FOIA request. Regional Counsel — not the institution — makes the release-or-deny call on the withheld material and must “inform the inmate of the denial(s) and his/her appeal rights” (p. 6).

“My record is wrong and I cannot get it fixed.” This is the hardest problem on the page and the one with the least policy behind it. PS 6090.04 § 7.e (pp. 12–13) describes only staff-initiated correction — a line through an error in a paper chart, or the electronic amendment process — and does not create a patient-initiated amendment procedure. The Privacy Act route that would ordinarily supply one, 5 U.S.C. § 552a(d)(2), is exempted for this system of records by 28 C.F.R. § 16.97. What is left is the administrative remedy — § 16.97 expressly notes that inmates “may file administrative complaints on any subject under the control of the Bureau,” including “complaints pertaining to information contained in these systems of records” — and, in a clinical dispute, a written request to the Clinical Director asking for a corrective note. Where the erroneous entry is driving a care decision or a custody classification, that is a consult, not a grievance.

“The records I need are from an outside hospital.” Then BOP is not the fastest source. The community provider is very likely a HIPAA covered entity in its own right, and 45 C.F.R. § 164.524(b)(2) puts a thirty-day clock on it with one thirty-day extension. Send a signed authorization directly to the hospital’s health information department. BOP’s own copy of that material comes in through the process at PS 6090.04 at p. 9 (“Obtaining Records From Outside Sources”) and travels on its own schedule.

Where the underlying problem is the care itself rather than the paperwork — a denied specialty referral, a medication stopped, a designation to a facility that cannot treat the condition — the administrative remedy path is necessary but rarely sufficient. Those belong in a consult; see Federal Prison Consulting Services or contact us. If the injury is already done and you are thinking about money damages rather than records, that is a different track entirely: property and personal-injury claims go under the Federal Tort Claims Act on an SF-95 / BP-A0943, not through a BP-9. See Federal Tort Claims Act. And exhaustion matters if court is ever a possibility: under the Prison Litigation Reform Act, 42 U.S.C. § 1997e(a), no action may be brought about prison conditions until available administrative remedies are exhausted. “Exhaustion” means completing every level of the internal grievance ladder, on time, before filing.

Related BOP policy on health information

The paired information page is What Rights Do Prisoners Have?, which sets this narrow records question inside the broader picture of what a person in federal custody can actually insist on. This page owns the mechanics; that page owns the framework.

Records and access: FOIA and Privacy Act Requests (PS 1351.05) is the companion policy and the route for anything withheld — read it alongside this one. Release of Information (PS 1351.05) is the older explainer of the same statement. Inmate Central File, Privacy Folder, and Parole Mini-Files (PS 5800.17) covers the other file — the central file is a separate system from the medical record, with its own access rule at 28 C.F.R. § 513.40. Request to Staff (PS 5511.08) covers the BP-A0148 itself.

Medical policy: Patient Care (PS 6031.06) is the clinical-services manual behind the record. Inmate Copayment Program (PS 6032.01) covers the fee for a health-services visit — a different charge from the copying fee here. Medical Designations and Care Levels (PS 6270.02) explains care-level designation. Treatment and Care of Inmates With Mental Illness (PS 5310.16) covers the psychology side, which is filed in its own divider of the health record. Management of Aging Offenders (PS 5241.01) is where chronic-care documentation most often becomes decisive.

Where the record is going: Compassionate Release / Reduction in Sentence (PS 5050.51) is the Bureau-side policy; Federal Compassionate Release Attorney, Compassionate Release for Terminal Illness and Serious Medical Conditions, and Compassionate Release Request to Warden are the court-side pages. Administrative Remedy Program (PS 1330.18) and Federal Tort Claims Act (PS 1320.07) are the two dispute routes.

Frequently Asked Questions About Medical Records Access

Reviewed for legal accuracy by Elizabeth Franklin-Best, Esq., Principal Attorney·September 2026