For way too long, healthcare providers—primarily hospitals--have been profiting from the sale of medical records. This has been a racket. Upon receipt of a request for medical records, the hospitals print paper copies of the medical records and charge 75 cents per page. For voluminous records, the photocopy fees can exceed $2k.
Until January 23, 2020, patients could get all of their electronic medical records, or have them sent to their third party agent (e.g., their law firm), for the “Patient Rate” of $6.50, with limited exceptions.
However, on January 23, 2020, the U.S. District Court for the District of Columbia in Ciox v. Azar, 435 F.Supp.3d 30 vacated the extension of the individual “Patient Rate” for fees for copies of electronic medical records directed to third parties. As a result, law firms again were forced to pay for the photocopy fees imposed by healthcare providers for paper medical records.
The Death of the Ciox Decision
But there is great news! The U.S. Department of Health & Human Services—charged with implementing regulations for the HIPAA Privacy Rule and the HITECH Act of 2009--corrected course, followed the procedural rules and has now fixed the HITECH Act (www.hhs.gov/sites/default/files/hhs-ocr-hipaa-nprm.pdf). The modifications to the HIPAA Privacy Rule are set forth in 45 C.F.R. Parts 160 and 164.
The effective date of a final rule will be 60 days after publication. 45 C.F.R. section 160.105 provides that covered entities and business associates must comply with the applicable new or modified standards no later than 180 days from the effective date of any such change.
#1: Shorter Timeframe for Producing Medical Records
The required response time to produce medical records will be “as soon as practicable, but not later than 15 calendar days after receiving the request” provided that the request is clear, conspicuous and specific. 45 C.F.R. 164.524(d)(5). The previous deadline for the production of medical records was 30 calendar days.
The new timeliness requirement applies uniformly regardless of the form or format of the medical records (e.g., paper or electronic). The same timeliness requirements apply when an individual requests that an electronic copy of electronic medical records be directed to a third party (e.g., your law firm) under the proposed 45 C.F.R. 164.524(d)(5).
The new section, 45 C.F.R. 164.524(b)(2)(ii)(C), also requires covered entities (e.g., almost all hospitals and doctors are “covered entities”) to establish written policies for prioritizing urgent or other high priority access requests.
#2: Fee Limitations Apply to Third Party Requests for Electronic Medical Records
If an individual directs a covered healthcare provider to transmit an electronic copy of their medical records to a third party, the covered healthcare provider must provide a copy of the requested records to the person designated by the individual. Section 13405(c) of the HITECH Act expands the individual right of access to include the right to direct an electronic copy of the electronic medical records to a third party.
The Department proposes to limit the allowable fees for such copies to the costs of labor for making such electronic copies. 45 C.F.R. 164.524(c)(4) limits the allowable fees to the costs of (i) labor for copying; (ii) supplies for creating the paper copy or electronic media, if requested; (iii) postage; and (iv) preparing any agreed upon summary. The customary charge for electronic medical records is the “Patient Rate” of $6.50, with some exceptions.
“[W]hen an individual exercises his or her access right, including when directing an electronic or non-electronic copy of PHI to any third party, covered entities are not permitted to impose higher fees for copies of PHI that may be permitted by state law.”
78 F.R. 5566, 5636 (January 25, 2013)(Emphasis Added).
Under the proposal at 45 C.F.R. 164.524(d)(1), requests to direct copies of medical records to a third party will be limited to electronic copies of medical records.
#3: Expanding the Patient’s Right to Inspect Medical Records
45 C.F.R. section 164.524 of the HIPAA Privacy Rule requires HIPAA-covered entities (health plans and most healthcare providers) to provide individuals, upon request, with access to their Protected Health Information or “PHI”). As finalized in 2013, this right includes the right to inspect, or obtain a copy, or both, of the PHI, and to access the PHI in the form and format requested, if readily producible.
The new right at 45 C.F.R. 164.524(a) would enable an individual to take notes, videos and photographs and use other personal resources to view and capture medical records as part of the right to inspect medical records—paper or electronic—in person.
Covered entities are required to provide access without imposing a fee under the proposed 45 C.F.R. 164.524(c)(4)(ii). The covered entity may not charge a fee to an individual who exercises the right to inspect their PHI in person.
#4: Expanded Requirements for Disclosing Fees of Covered Entities
Covered entities are required to provide an individualized estimate to an individual of the approximate fees to be charged for the requested medical records, upon request. 45 C.F.R. 164.524.
Additionally, the new subsection 525 to 45 C.F.R. 164 requires covered entities to post an fee schedule online (if they have a website) and make the fee schedule available to individuals at the point of service, upon an individual’s request. The notice must include (i) all types of access available free of charge and (ii) free schedule for…(b) copies of PHI in an HER and directed to third parties designated by the individual under 45 C.F.R. 164.524(d).
How to Enforce Your Clients’ New Rights
Do not expect hospitals and doctors to comply with the modifications to the HIPAA Privacy Rule. As long as they can get away with it, hospitals and doctors will try to charge photocopy fees for paper medical records. Do not pay the fees!
When a hospital tries to charge the fees for paper copies of medical records, remind them that your clients are allowed to request electronic medical records for the “Patient Charge” of $6.50. If the hospital still balks, file a complaint with the U.S. Office of Civil Rights and your state’s Department of Health. Not only will your complaint get the attention of the hospital and doctors, they will back down immediately…and you will finally get what you are entitled to.
