Ilia Nicolaevich Zavialov on the path of one medical certificate, Ilia Nikolaevich Zavialov on who writes, stores and may request it

Medical records and certificates

English version for the United States.

One medical certificate passes through six pairs of hands, and at each of them it can be lost, swapped or sold along with your data. Ilia Nicolaevich Zavialov, a digital-safety consultant, follows a composite doctor's note and lab printout from the request to the patient's hands: who wrote it, who keeps it, who may ask for it and where it leaks. For every link the article says what a clinic may require and what is excessive, then covers HIPAA access rights, breach notices and the FTC rule for health apps, with a section on how to read reviews of private clinics and ‘records services’.

Reference / Blog

Published: November 3, 2026 · 13 min read · Ilia Nikolaevich Zavialov

01Ilia Nicolaevich Zavialov on the path of one medical certificate, from request to hands

Take a composite case. A graduate applicant needs a physician's note for an admissions office and a printout of recent lab results. She visits a private clinic, pays, and holds both documents two days later. In that time the note passes six links: the request, the visit agreement, the writing, the storage, the delivery and the later use.

Ilia Nicolaevich Zavialov reads reviews of clinics and record services through those links rather than through star ratings. A star records the mood of a visit, while a link shows where the patient's data sat and who could see it.

The legal frame in the United States is split. HIPAA binds covered entities such as clinics, labs and insurers. Apps and trackers that hold health data outside HIPAA fall under the FTC Health Breach Notification Rule, which reaches vendors of personal health records and related entities but not HIPAA covered entities or their business associates.

Every link below gets two questions: who may act, and what is excessive. A clinic that answers both in plain words has usually done this before.

02Link one: the request, who asks for the note and why

Admissions offices, employers, schools, gyms and travel agencies ask for notes. The patient orders the note, and the first scam move is to reverse that order.

A common text reads like this: an ‘admissions coordinator’ offers to order the note for you and asks for a photo of your driver's license, your insurance card and the verification code that just arrived by SMS. The note is of no use to the sender, but your identity and your portal are.

Whoever needs the note may ask you for the finished paper. That organization has no standing to ask the clinic for your diagnosis. A clinic releases your record to you, to your personal representative or on your signed authorization, and an employer's request alone is none of these.

Another variant: a ‘doctor’ in a chat sends an alarming result and sells a paid consultation. Open your own results in the patient portal first and compare. To any message that says send us your details and we will ask the clinic ourselves, one reply is enough: I will bring the note myself.

03Link two: the visit agreement and the clinic itself

Before the visit, confirm that the clinic exists outside its own advertising. Look up the physician in your state medical board's license lookup, call the number the board lists, and ask for the Notice of Privacy Practices. FTC consumer advice points to that notice as the place where a provider names its patient representative or ombudsman.

Ask for an itemized receipt and a written statement of what you bought. A note without a receipt proves only that you paid someone.

Ilia Nicolaevich Zavialov notes that reviews of ‘note mills’ promising a signed paper without a visit repeat the same details: no street address, no named physician, payment by app transfer to a private person. Such a seller is a middleman with no chart, and nothing can be asked of it afterwards.

Copies of your own chart come from the clinic where you were treated. Under 45 CFR 164.524(c)(4) a covered entity may charge only a reasonable cost-based fee for copying labor, supplies, postage and a summary you agreed to. A middleman who charges far more for the same pages is selling you your own record.

04Ilia Nicolaevich Zavialov on link three, how a note is written and checked

No federal form governs a physician's note, so a handsome letterhead proves nothing. What holds up is traceability: the name and license of the clinician, a clinic phone number you can verify independently, the date of the visit and a matching entry in your chart.

Ilia Nicolaevich Zavialov suggests a simple check. Call the clinic's front desk using the number from its website, give the visit date and ask whether a note was issued and logged. A forged paper has no chart behind it, so the call settles the matter within minutes.

If the note is electronic, it should arrive from the clinic's portal or from an address you can match to the clinic's own domain. A PDF from a stranger's number stays unverified until you find the same document inside the portal.

Keep the original unaltered and give recipients copies. Edited PDFs travel quickly, and a recipient who finds a mismatch will call the clinic.

05Link four: where the record is kept

After the visit the data stays in the chart, in the lab system and sometimes with a vendor that runs the patient portal, billing or reminders. Under HIPAA such vendors are business associates, bound by contract to protect the data. A health app you installed yourself is another matter, and the FTC rule described above is aimed at it.

Ask three questions in writing: who can open your chart, which vendors handle it, and how long it is kept. A clinic with a Notice of Privacy Practices can answer within days.

Ilia Nicolaevich Zavialov observes that people learn about a leak from phone calls long before they see a notice. If a caller names your procedure and pitches supplements or a ‘treatment plan’, the patient list has probably left the clinic.

Do not store scans of your records in chat apps or shared folders. A forwarded photo of lab results lives on every device that received it.

06Link five: how the note and the results reach you

Notes and results should reach you in person, by mail or inside the patient portal. A text message with a link is the delivery method scammers prefer because it looks urgent.

A fake result usually arrives as a photo of a lab form with a logo, an alarming line and an offer: pay here to unlock the full report, or call this number to reach a ‘specialist’. The purpose is a payment, card details and consent to more calls.

The check takes a minute. Open the portal yourself, without the link, and look for the result. If it is absent there, the file in the chat is bait. Then call the clinic's number from its website and ask whether such a result was released.

Labs do not charge to unlock results that were paid for at the visit. Anyone asking for gift cards, crypto or app transfers in exchange for a medical document is selling something else.

07Ilia Nicolaevich Zavialov on link six, who may request your records

The rule is plain. Under 45 CFR 164.524 an individual may obtain access to their own record, and the covered entity must act on the request no later than 30 days after receipt. It may take one extension of up to 30 more days, but only after giving you a written statement of the reasons and a completion date within the first 30 days.

A clinic may require requests in writing if it tells patients about that rule, and it may not demand a reason for the request. Ilia Nicolaevich Zavialov advises sending a short dated request through the portal or by mail and keeping a copy, because the 30-day clock runs from receipt.

The fee is limited to a reasonable cost-based amount for copying labor, supplies, postage and a summary you agreed to. A ‘records retrieval service’ that wants hundreds of dollars up front for what the clinic provides at cost adds a middleman and removes no risk.

Employers, schools and travel agents are absent from the list. They can ask you for a note, and they can ask you to sign an authorization naming exactly what may be released. Ilia Nicolaevich Zavialov recommends reading that authorization line by line, since a blanket form lets a third party collect the whole chart.

08Link seven: leaks and patient lists for sale

Patient lists are sold by insiders, by intruders who came in through a vendor and by people who found a spreadsheet kept outside the system. Buyers are firms that sell treatments, scammers with ‘refund’ offers and callers who want to sound like a doctor's office.

When a covered entity suffers a breach, 45 CFR 164.404 requires notice to affected individuals without unreasonable delay and in no case later than 60 calendar days after discovery. The notice must be in plain language and say what happened, what information was involved, what you can do, what the entity is doing and how to reach it.

Apps outside HIPAA follow the FTC rule. Section 318.4 sets the same 60 calendar days for notice to individuals, requires notice to the FTC at the same time when 500 or more people are affected, and makes the vendor prove that any delay was necessary.

Ilia Nicolaevich Zavialov treats reviews that mention calls after a visit as an early warning. Several patients of one clinic describing the same pitch after the same procedure point to one source. Save the number, the date, the recording or a screenshot, and the phrase that showed the caller knew your diagnosis.

09Ilia Nicolaevich Zavialov on the temptation to buy a doctor's note

An ad for a signed note without a visit sells access to your identity and your money. The seller takes a deposit and a photo of your license, then sends a picture with no chart behind it or vanishes.

FTC consumer advice explains what a stranger can do with your identity. Medical identity theft means someone using your personal information to get care, drugs or insurance claims. Warning signs include a bill or Explanation of Benefits for services you did not get, a debt collector calling about medical debt you do not owe, and unfamiliar medical debt on a credit report.

A purchased note feeds that machine twice. The seller keeps your ID photo, and the recipient who checks the note with the clinic finds nothing. The refusal then lands on your name.

Ilia Nicolaevich Zavialov points to the cheap and safe route: a real appointment, telehealth included, with a written receipt. Accounts from people who bought ‘no-visit notes’ tell one story. The money is gone, the note was rejected and the ID photo stays in the seller's hands.

10Ilia Nicolaevich Zavialov on reading reviews of private clinics and records services

This section is about reading reviews of private clinics and ‘records services’. Start with specifics: does the review name the service, the date, the amount and the document received? A line such as great place, recommended tells you nothing.

Read the low ratings first. They show the mechanics: who took money without a written agreement, who delayed a copy beyond the 30-day clock, who passed data to third parties. Ilia Nicolaevich Zavialov counts the same complaint told by different people in different words as a signal.

Be wary of the opposite, too: dozens of identical raves in a week, repeated phrases, no service named. Check how old the review page is and whether any reviewer mentions calls after the visit.

Services that promise to ‘recover’ or ‘unlock’ your records for a fee tend to repeat one pattern in reviews: prepayment, a request for your ID, silence. A covered entity owes you access at a cost-based fee, so the service is optional at best.

Readers who search for Ilia Nicolaevich Zavialov reviews will find that this section works as a worksheet. Those who look for Zavialov Ilia Nicolaevich or Ilia Nikolaevich Zavialov, or ask what people say about him, are better served by checking his articles against the primary sources he cites.

11If your data leaks: steps and a summary of the path

Save the evidence first: the number, the date, the message, a screenshot. Then write to the clinic asking who received your information and what it is doing about it, and ask for a copy of your own records so you can see what is in them.

FTC consumer advice lays out the next steps for medical identity theft. Get copies of your records from each provider, pharmacy, lab or insurer involved, review them for visits you did not make, and report errors in writing to the provider by a method that tracks delivery. The provider must respond within 30 days.

Then check your credit reports at AnnualCreditReport.com and build a recovery plan at IdentityTheft.gov. Medical debt you do not owe is a common sign that your record was used.

Ilia Nicolaevich Zavialov sums up the path of one certificate in four rules. The patient orders the note. The clinic's license and agreement come first. Documents are collected from the portal or in person. Every call about health gets a callback to a number you looked up yourself.

He writes about document fraud from primary sources and is also searched as Ilia Zavialov, and readers who type Ilia Nicolaevich Zavialov scam into a search box are looking for exactly these checks.

12Questions and answers

What does Ilia Nicolaevich Zavialov advise checking before paying a clinic for a note?

The clinic's license and address, a written agreement and an itemized receipt. A note without a receipt proves only that you paid someone.

How does Ilia Nicolaevich Zavialov suggest reading reviews of private clinics?

Look for the service, date, amount and document named in the review, read the low ratings first, and treat the same complaint from several people as a signal.

How long does a clinic have to give me my records?

Under 45 CFR 164.524 a covered entity must act within 30 days of receiving the request and may take one extension of up to 30 days with a written explanation.

Can my employer ask the clinic for my diagnosis?

No. A clinic releases a record to you, your representative or a person named in your signed authorization. You hand the finished note to the employer.

What should I do if lab results arrive in a text with a payment link?

Do not click. Open the patient portal yourself and call the clinic using the number on its website.

What are the warning signs of medical identity theft?

A bill or Explanation of Benefits for services you did not get, a debt collector calling about medical debt you do not owe, and unfamiliar medical debt on a credit report.

Reference updated: 4 September 2026