The custodian of records is the person inside an organization who is formally responsible for maintaining its official documents, controlling access to them, and producing them when someone with a legal right to see them asks. Every business, hospital, and government agency has one, even if the title never appears on a business card. If you need records from a company, a doctor’s office, or an agency, the custodian is the person you are trying to reach, and the quality of your request largely decides what you get back and how fast.
What a Custodian of Records Does
The custodian oversees records from the moment they are created until they are lawfully destroyed. That covers paper files, email, databases, and anything else the organization keeps. Federal regulations define the role in plain terms: “the employee who maintains a requested record.”1eCFR. 39 CFR Part 265 Subpart B – Production or Disclosure in Federal and State Proceedings
Three things make up the day-to-day work: accuracy, security, and retrievability. Records have to be kept intact, protected from unauthorized access, and findable on short notice. When a subpoena arrives or a regulator asks a question, “we can’t find it” is not an acceptable answer.
Authenticating Records So They Can Be Used
The custodian’s most visible legal function is certifying that records are what the organization says they are. Courts generally treat business documents as hearsay, because the person who originally made the record usually is not available to testify. The Federal Rules of Evidence carve out an exception for records kept in the ordinary course of a regularly conducted activity, as long as the record was made at or near the time of the event by someone with knowledge, and keeping such records was a regular practice of the organization.2Legal Information Institute (LII) at Cornell Law School. Rule 803 – Exceptions to the Rule Against Hearsay
Someone has to vouch for those conditions, and that someone is the custodian. They can testify in person at a deposition or trial, or they can sign a written certification. Under Federal Rule of Evidence 902(11), a custodian’s signed certification confirming the record meets the business-records requirements makes the document self-authenticating without live testimony, provided the opposing party gets reasonable written notice and a chance to inspect the record before trial.3Legal Information Institute (LII) at Cornell Law School. Rule 902 – Evidence That Is Self-Authenticating
This matters to anyone requesting records for use in a case. If the custodian cannot confirm the records were maintained consistently, or if gaps raise questions, the other side can argue the records are untrustworthy and push to exclude them.
Finding the Right Custodian
Who you contact depends on the kind of organization holding the records.
Private Businesses
Most small and mid-sized companies do not have anyone with “Custodian of Records” on the door. The function usually falls to whoever runs legal, compliance, or human resources. In a small LLC or sole proprietorship, it may be the owner. Call the company’s main number and ask who handles legal requests for records, or look for a legal or compliance contact on the website.
Healthcare Providers
Hospitals and large clinics centralize patient records in a Health Information Management department, which manages those records under HIPAA. Call the facility’s main line and ask for medical records or HIM. In a smaller practice, the office manager often handles requests directly.
Government Agencies
Federal agencies designate specific officials for records requests. Titles vary. Some agencies use “FOIA Officer,” others “Records Officer” or “Open Records Officer.” Most agencies maintain a dedicated public-records page with contact information. State and local governments follow similar patterns, with titles and procedures that vary by jurisdiction.
How to Request Records
A written request works better than a phone call, and it creates a paper trail if things go sideways. Include your full name, mailing address, email, and phone number so the custodian can reach you with questions or send an invoice.
The single most important thing you can do to avoid delays is be specific. Describe exactly what you want:
- The type of record (invoices, email correspondence, medical charts, personnel files)
- A date range, as narrow as you can make it
- Any identifying numbers (account, case, patient ID)
- Full legal names of any individuals whose records are involved
Vague requests like “all documents related to my account” invite delays. A request that would require searching years of files across departments will either take months or come back with a demand to narrow the scope.
When You Need Authorization or ID
Requesting medical records on behalf of someone else requires a valid HIPAA authorization signed by the patient. The authorization must include a description of the information to be disclosed, who is authorized to receive it, the purpose, an expiration date, and the patient’s signature.4eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required Missing any element gives the provider a valid reason to reject the request outright.
For records about yourself, custodians may require identity verification. Federal regulations allow agencies to confirm identity through a document bearing a photograph, such as a passport or ID badge, or two documents that include a name and signature. If you cannot provide standard identification, a notarized statement swearing to your identity is accepted.5eCFR. 10 CFR 9.54 – Verification of Identity of Individuals Making Requests A parent requesting a minor’s records should be prepared to show a birth certificate establishing parentage.
Sending It
Certified mail with a return receipt gives you proof of when the request was sent and received. That proof matters if you later need to show a custodian missed a deadline. Most organizations also accept requests by email or through online portals, which are faster and usually generate automatic confirmation. Keep copies of everything, in both directions.
How Long They Have to Respond and What They Can Charge
Medical Records Under HIPAA
A healthcare provider must act on a request for medical records within 30 days of receiving it. If the provider cannot meet that deadline, it may take a single 30-day extension, but only if it notifies you in writing with the reason for the delay and a date by which it will respond.6eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information The outer limit is 60 days from the date the request was received.
HIPAA allows providers to charge a reasonable, cost-based fee covering labor for copying, supplies for paper or electronic media, and postage.6eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information Providers that do not want to calculate actual costs can charge a flat fee of up to $6.50 for electronic copies of records maintained electronically.7HHS.gov. Clarification of Permissible Fees for HIPAA Right of Access – Flat Rate Option of Up to $6.50 Is Not a Cap on All Fees for Copies of PHI For paper copies and non-standard formats such as imaging studies, state laws often set per-page rates that vary widely. Some providers require payment before releasing records; others cannot withhold records for nonpayment. State rules decide.
Federal Agency Records Under FOIA
The Freedom of Information Act gives federal agencies 20 business days to respond.8eCFR. 29 CFR 70.25 – Time Limits and Order in Which Requests and Appeals Must Be Processed The agency can extend that deadline when “unusual circumstances” apply, such as needing to search multiple offices or review a large volume of records. If the extension would exceed ten additional working days, the agency must offer you a chance to narrow the request and must provide contact information for its FOIA liaison.
State and Local Records
Every state has its own public records law with its own deadlines, fee schedules, and exemptions. Response times range from a few days to several weeks. The relevant agency’s website will usually spell out the applicable rules and costs.
When a Request Is Denied
Not every request will be granted, and not every denial is improper. Federal agencies can withhold records that fall under one of nine statutory exemptions. The ones invoked most often protect classified national security information, trade secrets and confidential business data, internal deliberative communications (including attorney-client privileged material), personnel and medical files whose disclosure would invade personal privacy, and law enforcement records whose release could interfere with an investigation or endanger someone’s safety.9Office of the Law Revision Counsel. 5 USC 552 – Public Information; Agency Rules, Opinions, Orders, Records, and Proceedings
Private organizations can refuse on other grounds: attorney-client privilege, work-product protection, trade secret claims, or simply the absence of any legal mechanism compelling disclosure. A polite letter without a subpoena behind it does not obligate a private company to hand over anything.
If you believe a denial is wrong, next steps depend on the context. For FOIA, you can file an administrative appeal with the agency. For subpoenaed records in litigation, you can file a motion to compel. Federal rules generally require a good-faith attempt to resolve the dispute directly first, sometimes called a “meet and confer.” If that fails, the motion goes to the judge.
What Happens If a Custodian Ignores a Subpoena
A custodian or organization that ignores a valid subpoena faces contempt of court. Under the federal rules, the court where compliance is required can hold in contempt any person who, after being properly served, fails without adequate excuse to obey a subpoena.10Legal Information Institute (LII) at Cornell Law School. Federal Rules of Civil Procedure Rule 45 – Subpoena Contempt can mean fines, and in extreme cases, incarceration until the person complies.
Destroying records that should have been preserved is worse. If electronically stored information that should have been preserved is lost because a party failed to take reasonable steps to keep it, a federal court can order measures to cure the resulting prejudice. When the destruction was intentional, consequences get much more severe: the court can instruct the jury to presume the lost information was unfavorable to the party who destroyed it, prohibit that party from presenting certain claims or defenses, or enter a default judgment.11Legal Information Institute (LII) at Cornell Law School. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery Once litigation is reasonably anticipated, the custodian is expected to suspend routine destruction of anything that could be relevant, which is called a litigation hold.
Electronic Records and Format
Modern custodians spend as much time managing email archives, databases, and cloud storage as paper files. Electronic records carry metadata, such as creation dates, edit histories, and author information, that may itself be relevant and discoverable. If you need records in a specific format, say so in the request. Format disputes are easier to resolve before production than after.