What are the procedures a health care facility must follow when mailing medical records to a former patient?

My sister was discharged from a health care facility after being a patient there for four and a half months. She requested copies of her medical records which she paid for. After not receiving them for a long period of time, she called the facility. They told her that they had put them in the mail one day after she left and they must have been lost in the mail. They were not mailed Certified or Registered. They offered no additional help. Weren't they required to better safeguard her records? She paid for a service which she didn't receive.