The below excerpt is copied from: Drew Voytal, Associate Director MGMA Goverment Affairs, GovChat
Following a federal court ruling, the Office for Civil Rights (OCR), the federal agency tasked with enforcing the HIPAA privacy and security rules, issued a notice modifying the agency’s policy regarding the fees practices and others are permitted to charge when a patient requests that their medical record be sent to a third party (such as a law firm). The court vacated the “third-party directive” within the individual right of access “insofar as it expands the HITECH Act’s third-party directive beyond requests for a copy of an electronic health record with respect to [protected health information] of an individual . . . in an electronic format.”
In light of this ruling and policy change, practices are no longer prohibited from setting their own fee for sending a patient’s medical record to a third party. Despite this change in policy, practices are still limited in what they can charge patients when they request a copy of their medical record for themselves and OCR has emphasized that they plan to “vigorously enforce” the patient right to access their information. To better understand practice rights and responsibilities in this area, GovChat participants are encouraged to download the updated MGMA member-benefit resource: The Patient Right to their Medical Record: Format, Fees and other Requirements.
Please feel free to reach out with any questions or comments.
——————————
Drew Voytal
Associate Director
MGMA Government Affairs
Washington, DC
——————————
The
following is an excerpt from The Patient Right to their
Medical Record: Format, Fees and other Requirements.
Charging patients fees for copies of PHI
Practices are permitted to impose a “reasonable, cost-based fee” for the PHI, including:
1. Labor for the actual copying of the PHI, whether in paper or electronic form (i.e., labor to scan records, prepare an e-mail, transferring PHI from one format to another, and other activities).
2. Labor to prepare an explanation or summary of the PHI, if the patient in advance both chooses to receive an explanation or summary and agrees to the fee that may be charged.
3. Supplies for creating the paper copy (e.g., paper, toner) or electronic media (e.g., CD or USB drive) if the patient requests that the electronic copy be provided on portable media
4. Postage, when the patient requests that the copy, or the summary or explanation, be mailed.
The practice must inform the patient in advance of the approximate fee that may be charged for the copy.
NOTE: Labor for copying cannot include costs associated with reviewing the request for access or searching for and retrieving the PHI.
There are three ways a practice can calculate this reasonable, cost-based fee for the PHI maintained electronically:
• Actual costs;
• Average costs; or
• Flat fee
NOTE: Flat fees cannot exceed $6.50, inclusive of all labor, supplies, and any applicable postage.
A practice may not:
• Withhold a patient’s PHI (even if the patient has an outstanding account balance);
• Withhold the PHI and apply the fee charged to the outstanding account balance;
• Charge patients a fee to view or inspect their PHI; or
• Charge a patient who takes notes or pictures to capture PHI.
TIP: While the Privacy Rule does permit practices to charge patients a cost-based fee for a copy of their medical record, practices should consider implementing a policy of providing a no-cost option for the first request
Sending PHI to third parties:
• A practice must transmit the PHI directly to another person or entity designated by the patient.
• The request from the patient must be in writing, signed by the patient, and clearly identify the designated person/entity and where to send the PHI. Practices must take action within 30 days.
• Practices may rely on the information provided in writing by the patient about the identity of the designated person and where to send the PHI for purposes of verification of the designated third party as an authorized recipient. However, practices must implement “reasonable safeguards” to carry out the request, such as taking reasonable steps to verify the identity of the patient making the access request and to enter the correct information into the practice’s system.
• Practices must safeguard the PHI in transit and may be liable for impermissible disclosures that occur in transit. The only exception, as noted above, arises when a patient has requested that the PHI be sent to the third party in an unsecure manner. If the patient was warned of and accepted the security risks, the practice is not responsible or liable for disclosures that occur in transit.
UPDATE AS OF JAN. 2020: Following a court ruling, the Office for Civil Rights has revised its policy regarding the fees practices can charge for patient records that are sent to third-parties. There is no longer a prohibition on practices setting their own fees for transmitting patient data to a third party. However, the fee limitations outlined in this document still apply when patients request their data for their own use.
Intersection of HIPAA with State Law
- Practices must comply with any additional requirements under state laws or regulations if they are more stringent than those outlined under the federal standards.
- For example, practices must comply with state law should it require that the patient is to be provided one free copy of their PHI. HIPAA does not override those State laws that provide individuals with greater rights of access to their PHI.
NOTE: Search and retrieval costs or other costs not permitted by the Privacy Rule may not be charged to patients, even if authorized by state law. Example: If state law limits costs to 25 cents a page and the actual cost is only four cents per page, then the practice may charge only four cents. If the cost is 30 cents per page and state law allows for 25 cents, then the practice may charge no more than 25 cents.