Access to Medical Records: HHS Provides New Guidance About This Critical Right

Posted Tuesday, April 19, 2016 by Pivotal Law Group

border

As lawyers, we often need to obtain medical records for our injured clients. But there are many times when people may want their own records, even when a lawsuit isn’t involved. They may be moving and need to find a new doctor. They may be seeking a second opinion. They may want to confirm their medical history is recorded completely and accurately. They may simply want a copy for their own records. Whatever the reason, access to medical records is an important right for all people.

As a result, laws have been passed to protect this right. For instance, Washington places a cap on how much health care providers can charge, though those maximum charges are quite high – a $25 clerical fee, plus $1.12 per page for the first 30 pages, and $0.84 for all other pages. WAC 246-08-400. In addition, all HIPAA-covered entities – which are most providers these days – must also follow federal law, which requires all fees to be “reasonable” and “cost-based.” 45 C.F.R. 164.524(c)(4).

Yet even with these laws on the books for years, people have faced obstacles to gaining their legal and rightful access to their records. Requests are ignored or denied. Demands are made for huge “copy” or “administrative” charges, including per-page charges for producing electronic records that were never “copied” or “printed” in the physical sense. Records are withheld pending payment of these charges, or are simply not provided in a timely manner. Your rights to access are not honored.

Earlier this year, on January 7, 2016, the U.S. Department of Health & Human Services addressed these barriers by publishing guidelines to help people understand their rights to access their medical information under 45 C.F.R. 164.524. This article provides a brief summary of those guidelines.

Broad Right of Access: People have the right to inspect and/or obtain a copy of any of their Protected Health Information (PHI) in the provider’s possession, no matter how old the records are or where/how they are being stored. This includes a broad range of materials, including medical records, billing or payment records, insurance information, test results, medical images (e.g. x-rays, MRIs, etc.), case notes, or any other information used to make decisions. People may also direct that copies be sent to any other person or entity they choose, such as another doctor or their attorney.

People do not have a right to access information that was not used to make decisions about them. This generally includes business planning, development, and management records, used to make business decisions rather than decisions about individuals. People also generally may not access psychotherapy notes analyzing the contents of a counseling session and maintained separately from the rest of the patient’s records, or information compiled in anticipation of or for use in a legal or administrative action. But these are narrow exceptions to the broad rule of access.

No Unreasonably Barriers or Delays: Providers may institute certain requirements, such as that requests be in writing or in their own supplied form. Providers must also take reasonable steps to verify the identity of the person making the request. But they may not institute requirements that create a barrier to, or unreasonably delay, access to the records. Providers may not require people to physically come into the office or use the internet to request access. Providers may not even require that requests be received by mail.

Access must be provided within 30 calendar days from receiving the request, and providers are encouraged to respond sooner if possible. Providers may request one 30-day extension to this time period. NOTE: Washington law is stricter on this time limit and requires records to be provided within 15 business days. State laws like this one, which provide people with greater rights, still apply and must be followed by the provider.

Under certain limited circumstances, providers may deny access to all or a portion of the records. Those circumstances are relatively narrow and unlikely to arise in the typical medical record request. NOTE: Waiting for pre-payment of fees is not a valid reason to delay or deny access.

Access in Form, Format, and Manner Requested: Providers must give people access to their PHI in the form and format requested, if it is readily producible in that form. So, if you ask for your records in electronic format, and your records are readily producible in that form – either because they are already stored electronically or because your paper records can readily be scanned – the provider must do so. This is beneficial for two reasons. First, in this day and age, when so many people have access to computers, electronic records are generally easier to handle for both the provider and the person. Second, the cost to produce electronic records is much cheaper – just the cost of a CD or DVD, rather than the typical per-page copy charge.

Providers must also provide access in the manner requested, for example, by pick-up, mail, or e-mail. While providers do not need to use a method that results in unacceptable risk to the security of the PHI, mail and e-mail are considered readily producible means and do not present unacceptable security risks.

Reasonable, Cost-Based Fees: Providers may charge fees for providing copies of records, but only reasonable, cost-based fees, which include only the cost of:

(1) labor for copying the PHI requested by the individual, whether in paper or electronic form;

(2) supplies for creating the paper copy or electronic media (e.g., CD or USB drive) if the individual requests that the electronic copy be provided on portable media;

(3) postage, when the individual requests that the copy, or the summary or explanation, be mailed; and

(4) preparation of an explanation or summary of the PHI, if agreed to by the individual.

The fee may not include costs associated with verification; documentation; searching for and retrieving the PHI; maintaining systems; recouping capital for data access, storage, or infrastructure; or other costs not listed above even if such costs are authorized by State law. NOTE: This means that even though Washington law permits a $25 “clerical fee,” under federal law, providers cannot charge this fee.

This also means that if the provider uses a third-party vendor to respond to record requests, they cannot charge for the overhead associated with paying for that vendor’s services, or otherwise violate the law. The provider is responsible for giving you access to your records, whether it’s through their labor or someone else’s.

The announcement for the new HHS guidelines can be found here:

• http://www.hhs.gov/blog/2016/01/07/understanding-individuals-right-under-hipaa-access-their.html

And the guidelines can be found here:

• http://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html

Hopefully, these materials not only educate people about their rights, but also inform providers about their responsibilities, and improve everyone’s access to their medical information.

Photo credit: CT Scan Images, used under the Creative Commons license.