Without a system for getting medical records, your cases will sit in limbo. The hospitals and doctors can take months responding to your requests and even when they do, you rarely will get the medical records that you requested. Your clients will wonder what the hell is going on.
Here’s our 4-step system for getting medical records:
Step #1: Initial Written Request for Medical Records
The initial written request should specify that you want the medical records in electronic format only and you will not pay for paper copies of the medical records. Your letter should also specify that you require a pre-bill for any expense exceeding $25; if the medical facility provides the records with an invoice that exceeds $25, you should refuse to pay.
If the medical facility fails to comply with your instructions, you should not pay. For example, if the medical facility responds by providing paper copies of the medical records, you should contact them and remind them that you only agreed to pay for medical records in electronic format and that you will not pay their invoice.
In roughly 20% of all cases, the medical facility will advise you that they are unable to provide the medical records in electronic format. This is most common in small, rural doctor’s offices. On a case-by-case basis, you might accept paper copies, but only when the medical facility offers a decent explanation and the cost of the paper records is reasonable (i.e., $100 or lower).
Here’s our initial written request for medical records:
Our Initial Written Request for Medical Records
Tuesday, February 21, 2017
Re: Request for Medical Records in Electronic Format Only
Patient:
Date of Birth:
Dates of Service:
Dear Sir/Madam:
We represent [name of patient]. We are enclosing a HIPAA-compliant medical authorization allowing us to obtain the medical records of this patient.
We are requesting that you provide the patient’s medical records to us in an electronic format only, e.g., compact disc. We will not pay for paper copies of the patient’s medical records.
If you are unable to provide the medical records in electronic format, please notify us as soon as possible.
If your fee exceeds $25, please notify us via e-mail (cskidmore@fishermalpracticelaw.com) in advance before sending the records. If you do not receive our prior approval for an expense exceeding $25, we will not pay the amount of your invoice that exceeds $25.
Please provide us with a Compact Disc (“CD”) that contains the complete medical record/chart of the above-named patient relative to the patient’s treatment for all dates of treatment of service specified above and all materials or information, including, but not limited to,
All medical records, hospital records, physicians’ records, surgeons’ records, consultation records, operative reports, physical therapy and other therapy records, x-ray(s), CT scan, MRI, PET scan and reports and other diagnostic studies; laboratory reports; patient information and history questionnaire; physicals and history; discharge summary; progress notes; prescriptions and medication records; nurses’ notes; correspondence; consent for treatment; and any other materials (whether written or stored, created or maintained in any other form) relating or pertaining to this patient, including documents and records received from or that were created by another provider.
If you are unable to transfer the medical records onto a compact disc, we ask that you email the medical records to our paralegal, Corina Skidmore, at cskidmore@fishermalpracticelaw.com.
If you prefer to send the medical records via secure email, you can send them to our paralegal, Corina Skidmore, at cskidmore@fishermalpracticelaw.com. If the medical records cannot be sent via email, we ask that you send the records to us via the website, www.Dropbox.com.
The Law
Under the Health Information Technology for Economic and Clinical Health Act (“HITECH Act”), health care providers are required to provide every patient a copy of their electronic health records, in a format of their choice, at a reasonable cost.[1] Significantly, the HITECH Act preempts New York State law.[2]
The HITECH Act provides that the individual making the request for protected health information (“PHI”) can designate a third-party to receive the information[3] , i.e., an attorney. The enclosed HIPPA-compliant authorization designates the law firm of John H. Fisher, P.C. as the third-party who is authorized to receive the information. The HITECH Act also applies to personal representatives of the Estate of a deceased person.[4]
The individual is able to choose the method of production of PHI under the Act, [5] and the regulations state it can be in paper or electronic form.[6]
The personal health information requested by an individual must be provided in the form requested by the individual, including in a readable electronic form if the covered entity uses electronic health records. [7] This can be a .PDF, compact disc, or as commented by the Department of Health & Human Services, via email if the individual is warned of the security risk associated with unencrypted email. [8]
Reasonable Cost-Based Fees
Under the HITECH Act, any fee that the covered entity may impose for providing an individual with a copy of electronic personal information shall not be greater than the entity’s labor costs in responding to the request for the copy. [9] The fees must be reasonable and cost-based.[10] What is reasonable and cost-based should be determined on a case-by-case basis.[11]
An entity’s labor costs for providing electronic records can only include: (1) labor for copying, whether in paper or electronic form, (2) supplies for creating the paper copy or electronic media; (3) postage if the individual has requested the information be mailed, and (4) if an individual has requested or agreed to an explanation or summary, the costs associated with preparing an explanation or summary of the PHI.[12]
Deadline for Responding
Aside from some exceptions,[13] a covered entity must act on the request no later than thirty (30) days from the receipt of the request[14] by: (1) providing the requested information,[15] or (2) providing the individual with written denial of the information.[16]
If you are unable to comply with the thirty (30) day deadline for providing the requested medical records, we ask that you contact us in writing before the deadline expires. In your letter, you must provide a written statement of the reasons for the delay and the date by which you will provide the medical records.[17] Under the HITECH Act, you are only provided one such extension of time.[18]
Penalties for Non-Compliance with the Act
There are substantial monetary fines and penalties for failing to comply with the HITECH Act. The Office of Civil Rights of the Department of Health and Human Services can investigate complaints and levy fines for violation of the Act.[19] If a healthcare provider is found to have “willfully neglected” a provision or provisions of the Act, the Office of Civil Rights of the Department of Health and Human Services will impose mandatory fines of up to $250,000 and up to $1.5 million for repeat or uncorrected violations.[20]
Thank you in advance for your cooperation.
Very truly yours,
JOHN H. FISHER, P.C.
[1] C.F.R. section 164.524(a)(1)
[2] 45 C.F.R. section 160.203; 45 C.F.R. section 160.202
[3] 42 U.S.C. section 17935(e)(1)
[4] 45 C.F.R. section 164.502(g)(1), (2); 45 C.F.R. section 164.502(g)(4)
[5] 45 C.F.R. section 164.524(a)(1)
[6] 45 C.F.R. section 164.524(c)(4)(i-iv)
[7] 45 C.F.R. section 164.524(c)(2)(i); 42 U.S.C. section 17935(e)(1),(2)
[8] 78 Fed. Reg. 5636, at page 5634 (January 25, 2013)
[9] 42 U.S.C. section 17935(e)(2)
[10] 45 C.F.R. section 164.524(c)(4)
[11] 78 Fed. Reg. 5636 (January 25, 2013)
[12] 45 C.F.R. section 164.524(c)(4)(i-iv)
[13] 45 C.F.R. section 164.524(a)(2)(i-iv)
[14] 45 C.F.R. section 164.524(b)(2)(Ii)
[15] 45 C.F.R. section 164.524(b)(2)(i)(A)
[16] 45 C.F.R. section 164.524(b)(2)(i)(B)
[17] 45 C.F.R. section 164.524(b)(2)(ii); 42 U.S.C. section 17935(e)(1),(2)
[18] 45 C.F.R. section 164.524(b)(2)(ii); 42 U.S.C. section 17935(e)(1),(2)
[19] 42 U.S.C. section 1320d-5
[20] 42 U.S.C. section 1320d-5
Step #2: Written Reminders of Non-Compliance with Initial Request for Medical Records
The written reminders of non-compliance are sent to the hospital/doctor’s office at intervals of 30, 45 and 60 days after the initial request. The warnings in each reminder letter get progressively stronger.
The final two reminders warn the medical facility that you will notify the Department of Health if they do not comply. Notice that the New York State Department of Health is carbon copied on the third reminder letter—this usually gets results.
Here are the reminder notices that we use following the initial request for medical records:
2ND NOTICE for Medical Records
Tuesday, March 24, 2017
Re: Request for Medical Records in Electronic Format Only
Patient:
Date of Birth:
Dates of Service:
Dear Sir/Madam:
On February 20, 2017, we requested the medical records of our client, [name of client], in electronic format only and provided you with a HIPAA-compliant medical release authorizing the release of the records.
It has been more than thirty (30) days since our request and you have not provided the electronic medical records or responded to our request.
Pursuant to the HITECH Act of 2009, a covered entity must act on a request no later than thirty (30) days from its receipt of the request by (1) providing the requested information1, or (2) providing the individual with written denial of the information2.
If you unable to provide the medical records within thirty (30) days, you must provide a written statement of the reasons for the delay and the date by which you will provide the medical records.3 Under the HITECH Act, you are only provided with one such extension of time.
There are substantial monetary fines and penalties for failing to comply with the HITECH Act. The Office of Civil Rights of the Department of Health and Human Services can investigate complaints and levy fines for violation of the Act.
Please provide the medical records in electronic format only at your first opportunity. If you are unable to provide the medical records in electronic format, please contact our paralegal, Corina Skidmore, at cskidmore@fishermalpracticelaw.com.
Thank you in advance for your cooperation.
Very truly yours,
JOHN H. FISHER, P.C.
3rd NOTICE for Medical Records
The third “notice” is sent 45 days following the initial written request and is identical to the 2nd notice with one exception. In the final paragraph of the letter, you add a paragraph warning the medical facility that you will contact the Department of Health if they fail to comply.
Here is the warning paragraph in our 3rd Notice:
If you do not respond within sixty days of our initial request, we will be forced to notify the New York State Department of Health regarding your non-compliance with section 18 of New York’s Public Health Law and the HITECH Act of 2009.
4th NOTICE for Medical Records
The fourth “notice” is sent 60 days following the initial written request and again is identical to the 2nd reminder notice with one exception. The final paragraph of the letter contains a warning and most importantly, your letter carbon copies the Department of Health. This will get results.
Here is the warning paragraph in our 4th Notice:
We will notify the New York State Department of Health—Office of Professional Medical Conduct concerning your failure to comply with section 18 of New York’s Public Health Law and the HITECH Act of 2009.
Thank you in advance for your cooperation.
Very truly yours,
JOHN H. FISHER, P.C.
cc: New York State Department of Health—Office of Professional Medical Conduct, 150 Broadway, Suite 355, Albany, New York 12204-2719
Step #3: Reviewing the Medical Records
Hospitals and doctors’ offices will rarely send the medical records that you asked for. Your paralegal/secretary should review the medical records to make sure they are complete and provide all of the records that you requested. Your system will fail unless someone in your office is reviewing the medical records to ensure that you received exactly what you requested.
Be as precise as possible when you request medical records. Send an email to your paralegal stating: “I need the operative note, nurses’ progress notes, and discharge summary from the admission at Albany Medical Center from January 3, 2017 to January 5, 2017.” This is much more precise than asking for a “complete” set of the hospital records, and your paralegal/secretary will know precisely what you need.
Upon receiving and reviewing the medical records, your paralegal, should send you an email that specifies the records that the hospital/doctor provided. For example, your paralegal’s email should read:
“Today, we received the operative note and discharge summary from the hospital admission on January 3-5, 2017, but the hospital did not provide the nurses’ progress notes. I will send another request to Albany Medical Center to get the nurses’ progress notes.”
If your paralegal confirms that the hospital provided the correct records, she should send an email confirming each part of the medical record was received and that you possess all of the records that were requested. For example, your paralegal’s email should read, “Today, we received the operative notes, nurses’ progress notes and discharge summary for the admission from January 3-5, 2017. We possess all of the medical records that were requested.”
Step #4: Refusing to Pay for Paper Copies of the Medical Records
When the medical facility fails to comply with your initial written request, you have to hold them accountable. Refuse to pay for paper copies of the medical records and an invoice that you did not authorize that exceeds $25.
Here’s our letter refusing to pay for the paper copies of the medical records:
Our Written Refusal to Pay for Paper Copies of Medical Records
Wednesday, April 26, 2017
Re: Request for Medical Records in Electronic Format Only
Patient:
Date of Birth:
Dates of Service:
Dear Sir/Madam:
On April 26, 2017, we received a paper copy of the medical records of [name of client] from you. As you will notice from our initial written request (a copy of which is enclosed), we requested the medical records in electronic format only and specifically stated that we will not pay for paper copies of the medical records.
Under the HITECH Act of 2009, we have the right to the individual is able to choose the method of production of PHI under the Act, 1and the regulations state it can be in paper or electronic form.2
The personal health information requested by an individual must be provided in the form requested by the individual, including in a readable electronic form if the covered entity uses electronic health records. 3This can be a .PDF, compact disc, or as commented by the Department of Health & Human Services, via email if the individual is warned of the security risk associated with unencrypted email. 4
For these reasons, we will not pay for the paper copies that we did not request.
Very truly yours,
JOHN H. FISHER, P.C.
1 45 C.F.R. section 164.524(b)(2)(ii)
2 45 C.F.R. section 164.524(b)(2)(i)(B)
3 45 C.F.R. section 164.524(b)(2)(ii); 42 U.S.C. section 17935(e)(1),(2)
1 45 C.F.R. section 164.524(a)(1)
2 45 C.F.R. section 164.524(c)(4)(i-iv)
3 45 C.F.R. section 164.524(c)(2)(i); 42 U.S.C. section 17935(e)(1),(2)
4 78 Fed. Reg. 5636, at page 5634 (January 25, 2013)
photo credit: bobbigmac CDs DVDs on White Background via photopin (license)
