Understanding HIPAA's Medical Record Transfer Rules

I recently received an inquiry from a physician who was frustrated by patients returning to his practice multiple times seeking copies of the same medical records.  He described a situation where he ("Physician A") had properly transferred a patient's medical records to a new physician ("Physician B"). The patient then left Physician B to transfer to Physician C.  Physician B was willing to transfer his own medical record for the patient to Physician C, but did not include the portion of the medical record provided by Physician A.  Physician A was then required to provide his medical record to the patient again and wondered whether this was a common issue and whether HIPAA provided any guidance.

The short answer to this question is yes, the HIPAA Privacy Rule ("Rule") does provide guidance on this topic.  It states that a provider who is a covered entity is permitted to disclose a complete medical record, including portions that were created by another provider, as long as a disclosure is for a purpose permitted by the Rule.  This would be for treatment purposes or other permissible reasons.  A proper authorization where a patient is asking to review their records or to transfer it would be an acceptable example (subject to any mental health or specific privacy rules that could apply to particular physician records).  Unfortunately, the HIPAA Rule does not appear to go into more detail about what Physician A or the patient can do when Physician B does not provide the complete record.  In this case, it is not clear whether Physician B thinks he lacks permission or simply does not want to provide the prior provider's portion of the record.   However, one can make the argument that Physician B fails to comply with the Rule by not providing the entire patient record when properly requested.

There may be several reasons why the above situation occurs.  First, just because a physician receives a transfer of a medical record from another provider does not mean that he properly integrated the transferred record into their own EHR.  As a consequence, when a patient leaves and asks for a copy of the complete record, including the transferred portion of the record, this may pose a dilemma or inconvenience for the physician if the record has not been integrated. In some cases, the practice may be backlogged in their integration efforts, or the transferred record may have been destroyed or lost, particularly if it was faxed or came in a paper format. Although these possibilities are not acceptable, they are not uncommon.  Sometimes a physician is just unhappy that a patient is leaving and can act in a surprisingly uncooperative manner by refusing to provide a complete record.  Some practices simply, as a matter of internal policy, never provide the transferred portion of the record to a departing patient.

If you are Physician A and properly transferred a medical record to a Physician B,  asked yet again to provide the same record, there are not many options.  You might consider contacting Physician B to demand they provide the record.  You can argue with the patient to try harder to have Physician B provide it.  However, the fact is that both options may be more time intensive, and create more difficulties, than simply providing another copy of the record.  Moreover, there is no limit on how many times a record can be requested from a provider, so refusing to provide another copy of the patient's record can create HIPAA (and state law) compliance issues for you. Hopefully, there will be some more helpful regulatory guidance on this issue in the future.

It is always advisable to be the professional in any situation, regardless of how inconvenient or time consuming it may be.  Transferring patient records in a timely and efficient manner is what every physician is expected to do, regardless of conduct of other providers.