In September 2015, I replied to a person asking about sending requests for records from one department to another, when they are not all on the same internal email system, that using an account number or medical record number to identify the patient, and requesting some action such as scanning the record, would not be a HIPAA violation..