PDF for healthcare practices
Patients have a federal right to their records, and the clock starts when the request arrives.
What the rules actually say
Right of access (45 CFR 164.524): a practice must act on a patient's request for their records no later than 30 days after receiving it. One extension of up to 30 more days is allowed, and only if the patient is told in writing, within the first 30, why and by when. If the patient asks for an electronic copy and the record can readily be produced that way, it must be provided in the electronic form and format they asked for — for most offices, a PDF.
A records set is usually assembled from scans, lab reports and letters of different sizes, and then has to fit where it is going: a patient portal, an email, a payer's upload page. Each has its own limit, and the one shown by the system you are uploading to always wins.
Sharing for research or with a third party often calls for de-identification. Under the Safe Harbor method (45 CFR 164.514(b)(2)), 18 kinds of identifiers have to be removed — names, every part of a date except the year, record and account numbers, contact details, full-face photographs and more — and the practice must have no actual knowledge that what remains could identify the patient.
Covering text with a black box does not remove it. A redaction that can be copied back out of the file is a disclosure.
The tools for it
- Merge PDFCombine several PDFs into one, in the order you want.
- OCR PDFMake a scanned PDF searchable.
- Redact PDFActually remove sensitive parts — not just draw a box over them.
- Check a redactionFind out whether the words you blacked out can still be pulled out of the file.
- Remove PDF metadataStrip the author, software and timestamps a file carries without showing them.
- Compress PDFMake a heavy file small enough to email, without wrecking it.
- Split by sizeBreak one PDF into parts that each stay under a size you pick.
- Protect PDFSet a password so only the right people can open it.
- Add Page NumbersStamp page numbers wherever you want them.
What this does not do
We do not sign business associate agreements. The tools on this page do not upload the file, but signature requests and share links store the document with us so another person can open it — do not use them for protected health information.
We do not de-identify a record for you. Redaction removes what you mark, and Verify redaction confirms that the words you type are really gone; neither can tell you what you did not mark. Finding every identifier on every page is still your job.
We do not connect to an EHR, send faxes or submit to payer portals, and we do not certify HIPAA compliance — no software can, because compliance depends on how a practice works.
In every case above, the document is processed without ever being transmitted. Nothing is uploaded, which for confidential filings, student records, unpublished manuscripts and salary data is not a convenience but the point.
Set it up for the whole team
One Team plan covers everyone: $7 per seat, per month · 2 seats minimum. Every tool with no daily limit, shared seats and roles, and up to 100 signature requests a month with an audit trail. Your team's first yearly plan comes with a 30-day refund.
Tell us how your work flows and a person replies within one business day with a setup that fits.