OCR Eliminating Cost as a Barrier to Patient Record Access

HIPAA allows patients to request access to their medical records and federal officials recently clarified their stance that costs to receive that information cannot be a barrier.

On February 25, HHS’ Office of Civil Rights (OCR) released new guidance to physicians, hospitals, and other providers to not only reiterate patients’ rights to their own health information, but also to clarify appropriate fees for copies of that data. The guidance came in a series of FAQs on OCR’s website.

“HIPAA’s right of access is critical to enabling individuals to take ownership of their health and well-being -but this core right is rendered meaningless when individuals cannot afford to pay the fees,” said OCR Director Jocelyn Samuels in a statement. “These new FAQs clarify that individuals can be charged only a reasonable, cost-based fee for the labor and supplies associated with making the copy, whether on paper or in electronic form.”

So while the rules aren’t new, per se, it will likely mean changes in the way U.S. practices handle and process patient record requests, according to Elana Zana, an attorney with Seattle-based Ogden Murphy Wallace. Zana co-presented a session on the new rules and what it means for EHRs in litigation during this year’s Health Information and Management Systems Society (HIMSS) conference in Las Vegas.

“OCR is looking to open the doors to patient access to records,” she said.

While good for patients, this transparency could come at a cost for practices, who not only have to clarify what patients truly mean when they request their “entire patient record” (which could include paper and electronic documents) but gather the appropriate information as a part of their daily tasks.

Per OCR’s recent clarification, practices can charge a “reasonable” fee for copying either paper or electronic records as well as supplies for duplicating that data. That labor cannot include costs associated with reviewing the access request, searching for and retrieving the personal health information (PHI), or preparing it to meet the request.

To calculate those reasonable costs, OCR suggested practices consider:

• the actual costs (what it takes to fulfill the request);

• the average cost (rather than calculating labor costs per request in addition to costs for postage or media like a CD or USB drive); or

• a flat fee of $6.50 (inclusive of all labor, supplies, and any applicable postage).

But Zana noted that OCR is quite clear that physicians and their practices should provide patients co

pies of their PHI at no charge at all.

“That’s where I hear we are headed,” she said.

OCR did make it clear that at least one thing should absolutely be for free: viewing their PHI. The clarification states that fees can be charged to individuals only in case where there is request for a copy of the PHI versus the opportunity to view and inspect it. Furthermore, practices cannot charge a patient who views his PHI and also takes notes, uses a smartphone or other device to take pictures of the data, or uses other means to capture that information.

“If the individual is making the copies of PHI using her own resources, the [practice] may not charge a fee for those copies, as the copying is being done by the individual and not the entity,” OCR noted.

And one more clarification Zana felt physicians should note was that OCR said if practices have the ability to e-mail PHI, they should – even if that e-mail system (like Gmail) is unencrypted.

“Unless you have a good reason not to [send it via e-mail], you must do it,” Zana said.

She advised practices to have a waiver form to explain to the patient that they are requesting an unencrypted system be used to share their PHI and make it clear that it is being done by their wishes.

“This is about the capacity to send [records],” not provider willingness,” she said.