By Kelli Fleming
The Office of Civil Rights (“OCR”), the federal entity overseeing HIPAA compliance and enforcement, continues to make patient requests to access medical records a priority. HIPAA provides patients a legal right to timely access their medical records and medical information. As patients are becoming more involved and invested in healthcare decision-making and payment, they are becoming more interested in reviewing their heath information. Thus, we are seeing a rise in the number of requests for access. OCR has made it clear that preventing patients from exercising this fundamental right to access will not be tolerated and can result in financial penalties. In fact, OCR implemented a Right to Access Initiative entirely focused on ensuring providers provide patients with timely access to medical records, and has implemented several enforcement actions for failure to comply.
Thus, now is a good time for a refresher on a patient’s right to access records and a healthcare provider’s obligations in responding to such requests.
Form of Request:
Under HIPAA, a patient has the right to access his/her medical information--with a few exceptions (e.g., psychotherapy notes). A patient wanting to exercise his/her right to access their medical records can do so in two ways: (1) the patient can request that copies of the records be sent to the patient directly (or inspected by the patient); or (2) the patient can request in writing that his/her records be sent to a designated third-party (this designation must be signed by the patient and clearly identify the designated person and where to send the records). In receiving patient requests for information, providers must not act as a barrier to exercising the right, and must be flexible in terms of how the request is received. However, providers may require that the request be in writing. Importantly, this right is separate and distinct from a patient authorization, and comes with separate legal obligations.
Timeframe For Response:
When a patient exercises his/her right to access medical information, the records must be provided to the patient without unreasonable delay, and within 30 days of the request. If the request is denied, the denial notice must be sent within the 30-day period. If the 30-day period cannot be achieved, for example if the records are in an off-site storage facility, the patient must be notified of the delay within the initial 30-day period and the provider will be allowed an additional 30 days in which to respond to the request. If the provider does not maintain the records, but knows where the records are maintained, the provider must inform the requestor where to direct the request. Only one 30-day extension is permitted. If the request is compliant with HIPAA, a response is mandatory.
Form of Response:
The patient must be provided with access in the form or format requested, if the information is readily producible in such form and format. If not, the patient must be provided the information in a readable hard copy form or other form agreed to by the parties.
If the request is for an electronic copy of the information, the patient must be provided the information in the electronic form and format requested if it is readily producible in such electronic form and format, and if not, in an electronic format agreed to by the parties. Paper copies may only be provided if the patient declines to accept any of the electronic formats readily producible.
Fees for Response:
When the patient exercises his/her right to copy medical records, the fees charged must be a reasonable, cost-based fee consistent with both state and federal law. Because the state law provisions and the HIPAA provisions differ, this is where we see many providers in Alabama fall short in terms of compliance. Many providers are complying with the state law provisions, which allow a flat search fee and a per page fee, but are failing to comply with the more stringent federal law provisions, which do not allow a search fee and only allow a per page fee under certain circumstances.
The fee that may be charged to patients for copies of medical records pursuant to the right to access may only include the following:
Labor costs for copying the records to only include the labor associated with creating and delivering the copy in the form and format requested once the information has been identified, retrieved, and compiled (calculated either by actual costs or accrued costs);
Postage if records are requested to be mailed; and
Supply costs, including costs for electronic media if the patient requests that an electronic copy be included on portable media.
Alternatively, a flat fee for an electronic copy of the records may be charged, as long as the flat fee does not exceed $6.50, including labor, supplies, and postage.
Under either scenario, the fee charged may not include costs associated with reviewing the request, verifying the information, documenting the request, searching for and retrieving the records, reviewing the records, compiling the response, maintaining systems, or recouping capital for data access/storage/or infrastructure. Importantly, unlike Alabama law, HIPAA does not allow you to charge a flat search fee. The more stringent federal law must be followed.
Verification:
Before releasing records, a provider must always verify that the person requesting the records is entitled to a copy of the records. We are seeing some instances where a third-party is attempting to utilize the right to access provisions under HIPAA, and, as a result, the cap on fees, by pretending to be the patient when making the request. However, when providers undertake the verification process, it becomes apparent that the requestor is not actually the patient and is not entitled to exercise this patient right. Confirm that e-mail address matches that in your patient records. Confirm that the mailing address matches that in your patient records. If the request is made on a form that is signed by the patient, confirm that the demographic information contained on the form matches your patient records, and that any signature is consistent with that contained in your records. If something does not match, call the patient directly using the phone number in your records to confirm that they are making the request. If the request cannot be verified, it can be denied.
Patient right to access is a fundamental right under HIPAA that must be responded to appropriately and timely. If not, penalties may ensue.
Kelli Fleming is a Partner with Burr & Forman LLP practicing within the firm’s Birmingham office. Kelli practices exclusively within the firm’s Health Care Industry Practice Group.