medical record releaseMedical record release is becoming a heated topic.  There are several parties involved in the discussion.  Of course, the patient and their rights to the medical record comes first.  Then, you have the providers trying to meet their obligations to supply the records.  But, there are also lawyers and medical record release of information companies and, of course, OCR involved.  Today we will try to make some sense out of the whole mess.

HIPAA For MSPs by David Sims Medical Record Release Fees
00:00:00 00:00:00

Recently, I have been in several conversations about the release of medical records.  These conversations all revolve around one of two things (or both) – Fees and Attorneys.  Since OCR says they are planning an enforcement initiative about patient rights of access this year, it appears to be a good time to review those topics.

Medical Record Release Definitions

First, let’s address the two definitions in the law.  HITECH made many of these updates that are now part of the standard HIPAA laws.  Here is what the law says about the important parts of our discussion.

§164.502   Uses and disclosures of protected health information: General rules.

(a) Standard. A covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter.

(1) Covered entities: Permitted uses and disclosures. A covered entity is permitted to use or disclose protected health information as follows:

(i) To the individual;

(ii) For treatment, payment, or health care operations, as permitted by and in compliance with §164.506;

(iii) Incident to a use or disclosure otherwise permitted or required by this subpart, provided that the covered entity has complied with the applicable requirements of §§164.502(b), 164.514(d), and 164.530(c) with respect to such otherwise permitted or required use or disclosure;

(iv) Except for uses and disclosures prohibited under §164.502(a)(5)(i), pursuant to and in compliance with a valid authorization under §164.508;

(2) Covered entities: Required disclosures. A covered entity is required to disclose protected health information:

(i) To an individual, when requested under, and required by §164.524 or §164.528; and

(ii) When required by the Secretary under subpart C of part 160 of this subchapter to investigate or determine the covered entity’s compliance with this subchapter.

As this section states, medical records may or may not be released by the CE as permitted for TPO and with authorizations.  Of course, also to the patient which is a required, not optional disclosure.  So, what about that release to individuals?

§164.524   Access of individuals to protected health information.

(a) Standard: Access to protected health information

(1) Right of access. Except as otherwise provided in paragraph (a)(2) or (a)(3) of this section, an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set, except for:

(i) Psychotherapy notes; and

(ii) Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.

(c) Implementation specifications: Provision of access. If the covered entity provides an individual with access, in whole or in part, to protected health information, the covered entity must comply with the following requirements.

(1) Providing the access requested. The covered entity must provide the access requested by individuals, including inspection or obtaining a copy, or both, of the protected health information about them in designated record sets.

(2) Form of access requested. (i) The covered entity must provide the individual with access to the protected health information in the form and format requested by the individual, if it is readily producible in such form and format; or, if not, in a readable hard copy form or such other form and format as agreed to by the covered entity and the individual.

(3) Time and manner of access. 

(i) The covered entity must provide the access as requested by the individual in a timely manner as required by paragraph (b)(2) of this section, including arranging with the individual for a convenient time and place to inspect or obtain a copy of the protected health information, or mailing the copy of the protected health information at the individual’s request. The covered entity may discuss the scope, format, and other aspects of the request for access with the individual as necessary to facilitate the timely provision of access.

(ii) If an individual’s request for access directs the covered entity to transmit the copy of protected health information directly to another person designated by the individual, the covered entity must provide the copy to the person designated by the individual. The individual’s request must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy of protected health information.

(4) Fees. If the individual requests a copy of the protected health information or agrees to a summary or explanation of such information, the covered entity may impose a reasonable, cost-based fee, provided that the fee includes only the cost of:

(i) Labor for copying the protected health information requested by the individual, whether in paper or electronic form;

(ii) Supplies for creating the paper copy or electronic media if the individual requests that the electronic copy be provided on portable media;

(iii) Postage, when the individual has requested the copy, or the summary or explanation, be mailed; and

(iv) Preparing an explanation or summary of the protected health information, if agreed to by the individual as required by paragraph (c)(2)(iii) of this section.

This section states clearly that you are supposed to give the records to the patient in any way they asked as long as it is feasible.  Also, you are required to do it in a timely manner with only minimal fees.

Finally, there is one other situation in the mix.  Personal Health Records (PHR) are addressed specifically in HITECH discussions and guidance.  These can be records like the patient portals or third-party health record systems.

The individual may grant the authority to upload information about the individual directly into the individual’s PHR.  Alternatively, a covered entity may provide this information directly to the individual for individual to enter into the PHR.

Medical Record Release Fee OCR Guidance

Way back in January 2016, OCR released some clarifications on the release of records and patient access rights.  This guidance included some specific details on how to calculate those fees for release of information mentioned §164.524(c)(4) above.  In that guidance, OCR defined three options for determining those medical records release fees.

    1. Calculate the exact costs of labor to make copies of paper charts, find and click print or copy to media for electronic medical records.
      • You can add the costs of the supplies and postage to do it.  That should be done each time.
    2. Calculate an average of what the fees in option 1 would be for labor and charge that average fee plus costs for supplies and postage.
      • This one is the middle of the road solution that lets you charge a standard fee without logging time for every request.
    3. Charge a flat, all-inclusive fee of $6.50 to provide the records to the patient.
      • This is considered the “safe harbor” option.  It is the easiest method of calculation.

If you choose option 1 or 2 above, then you must save your math in your documentation to prove how you came up with the numbers.

This guidance is all about making the patient more engaged in their care.  If patients can’t get their records without large fees or a big hassle then they won’t be engaged in their own care.  These updates should have been added to your policies and procedures already.  The original parts have been there since 2009, so it isn’t completely new.

OCR has been discussing this for some time and even did a Medscape training session on it in 2017 which you can still watch and get CME’s for it.

All of this information is what OCR’s enforcement initiative is supposed to be related to for this year.  Patients continue to file complaints about the problems they have getting records in a timely manner and being charged large sums.  As Severino stated earlier this month, we have tried outreach and training but we are not making progress on this issue that we need to see.  So, enforcement is the last resort.

$6.50 is not a required medical record release fee.

I have to repeatedly point out, though, that the $6.50 is not a requirement.  It is an option.  OCR even followed up with a clarification stating that their guidance did not specify that fee was a cap on what you could charge.  There are two other options.  Feel free to charge those.  If you don’t want to do so, then do the flat fee.

Medical Record Release Fee Conflicts

When the HITECH updates that included these specifics in the Privacy Rule came out it didn’t take long for the attorneys who request medical records to jump on board.  For years, attorneys who requested medical records in injury cases had to pay fees for them that varied but apparently considerable fees.  They wanted their fees cut according to these new rules.  They still want that.

There is also a whole industry built up around the medical records release requirements with some big money behind them.  They didn’t want to cut their fees.  This $6.50 fee would put them out of business.  The big names in the ROI industry are suing OCR about this guidance.

I hear from clients regularly about attorneys basically trying to bully them into releasing records that they want for the $6.50.  I have spent plenty of time researching exactly what the answer should be so that I can deal with these demands when my clients need advice.

The best information came first directly from OCR when they responded to a complaint filed by an attorney in September 2014 about the fees they were being charged for records request.  The Privacy and Security Blog at Davis Wright Tremaine published an article about the case after they filed a Freedom of Information Act request with OCR.  The copy of the March 2015 response letter from OCR in that case was included in the article so you can read exactly what they told the attorney about his complaint.

All of that stuff is lawyers talking to lawyers about legal opinions.  It is thrilling to read!  Here is the net of the information on this as well as I have been able to break it down.

  • If the patient requests their medical records to be given to them or a research group or a personal health record company then these are all related to treatment and fall under the required disclosure part of the law.  That is also where the fees specified by OCR in 2016 apply.
  • If a patient wants their records to go to a lawyer that is different.  OCR defines that as an authorized disclosure, not a required disclosure.  You can charge whatever your state allows for authorized disclosures.  The 2016 fees do NOT apply here.

The way that these attorney releases have always worked is they would complete an authorization form that met all the requirements of that authorized release.  They didn’t have the other method.

Now, they don’t file the authorization form, instead they file a letter from the patient that meets the new required release to get around it.  The letter looks like a simple letter from a patient if they knew to put all the legalase in it.  If they send you that, it falls under the required release.  If they send an authorization form the way they always did it before, then they do it the way it has always been done according to state law.

There is a loophole here.  When we call it a loophole it means someone is using the law in a way it is written but not necessarily intended.  There is nothing we nor the OCR can do about it until the law is updated.

We recommend just doing the cost base fees allowed under HIPAA and be done with it.  If you can show your math as to how you got to that fee, you are set under HIPAA. Most state laws will also be covered that way but you should know your state limits.

Don’t let the lawyers tell you they will only pay you $6.50 and that is all you can charge.

More than just the medical record release fees

BTW, lawyers go further than just trying to intimidate practices about the fees.  They also try to intimidate them to release records even when they aren’t authorized.  I helped a client recently that had an attorney threatening them and telling them they were breaking state law for not handing over the medical records this law firm wanted.  Here is the thing though.  They represented one side of a lawsuit about a car accident.  The other side of that lawsuit sees my client.  However, the records were not for the person in the legal mess but the request was for records of their minor child.

The only required disclosures are to the individual and to the Secretary of HHS.
Not only did this law firm claim they were allowed to see the records under GA law but they said HIPAA required the practice to let them do it.  Let me just say this clearly.  HIPAA says a provider “may” release records with reasonable assurances of authorization.  An attorney demanding their opposing parties medical records falls under that rule.

This information has been out there since the Final Rule went into place back in 2014.  The specific fee definitions came out in 2016.  OCR enforcement at this point is well past the time these changes should be addressed.  As for the others, that will continue to play itself out.  We will do our best to keep following the path it takes and explain it the best way we can.