By couching its position in an individual's right to access protected health information (PHI), beginning on January 7, 2016, the U.S. Department of Health & Human Services' Office for Civil Rights (OCR) issued guidance to covered entities clarifying access to PHI set forth in the Health Insurance Portability and Accountability Act of 1996 (HIPAA). §45 C.F.R. 164.524.
Specifically, HIPAA allows covered entities to charge an individual only a "reasonable, cost-based fee" to obtain a copy of his or her medical records. This fee can include only the cost of:
- Labor for copying the PHI, whether in paper or electronic form;
- Supplies for creating the paper copy or electronic media (e.g., CD-ROM or flash drive);
- Postage; and
- Preparing an explanation or summary of the PHI, if agreed to by the individual.
The fee may not include costs associated with the following:
- Verification;
- Documentation;
- Searching for and retrieving the PHI;
- Maintaining systems; and
- Recouping capital for data access, storage or infrastructure, even if these charges would be appropriate under state law.
OCR addressed each component of a reasonable, cost-based fee one by one:
- Labor for copying PHI may include only labor for creating and delivering the PHI in the form or format requested or agreed upon by the individual, once the responsive PHI has already been identified/retrieved/collected/compiled and/or collated, and is ready to be copied;
- Supply costs include the costs for paper, toner or electronic media charges, if the individual requests that the electronic copy be provided on portable media. The covered entity may not require a patient to purchase portable media;
- Covered entities may charge for labor to prepare an explanation or summary of the PHI if the individual, in advance, both chooses to receive an explanation or summary and agrees to the fee that may be charged; and
- Postage may be charged only when the individual requests that a copy or summary or explanation be mailed.
Even though OCR clarified the reasonable cost-based fee components so that covered entities may charge appropriate fees, OCR emphasizes that covered entities should provide copies of PHI free of charge, especially when the financial situation of the individual requesting access would make it difficult or impossible for the individual to afford the fee.
OCR's guidance further provides the following:
- Covered entities cannot charge individuals a fee if the covered entities are using the View, Download and Transmit PHI functions of their certified electronic health records systems to send the requested PHI;
- Administrative costs for outsourcing individual access right requests may not be passed on to the individual;
- Individuals must be informed of costs for their PHI in advance of the fee and covered entities should be able to provide an itemized breakdown of the charges.
OCR delineates three methods to calculate a reasonable, cost-based fee:
- Actual Costs: Calculate actual labor costs to fulfill the requests. This means the labor only for copying the individual's specific record (and/or creating a summary if agreed upon previously) and the labor rates are reasonable, as well as any applicable supply or postage costs. The covered entity must still be able to inform the individual in advance of the approximate fee for the individual's PHI.
- Average Costs: Develop a schedule of costs based on average
labor costs to fulfill standard types of access requests.
- This can be per page only in cases where the PHI requested is maintained in paper form and the individual requests a paper copy or that the paper copy be scanned into an electronic format.
- Flat fee for electronic copies of PHI maintained electronically: A flat fee for electronic copies may not exceed $6.50 (including labor for copy, supplies and postage). As clarified in a second FAQ by OCR on May 23, 2016, this does not mean that the ceiling for all requests for access is $6.50.
Reasonable Cost-Based Fees for Personal Representatives or Third Parties
The fee limits for copies of an individual's PHI apply only in the following three circumstances:
- The individual or individual's personal representative directs the covered entity to send PHI to a third party, and does so through a written signed request clearly identifying the third-party recipient;
- The individual requests that the PHI be sent to herself; and
- A third party submits the request on behalf of the individual to the covered entity for the PHI to be sent to a third party.
The reasonable cost-based fee does not apply when third parties directly request PHI from a covered entity and submit a written HIPAA authorization form for the disclosure.
If a covered entity is confused as to the original source of the request for PHI for the purposes of applying the reasonable cost-based fee, the covered entity may seek further clarification from the requesting party.
The new guidance does clarify open questions for covered entities in how to charge for copies of PHI requested by patients and members, regardless of state laws. The new guidance should not affect the charges associated with copies of records for litigation or other legal purposes, so long as the individual who is the subject of the PHI or the Personal Representative, is not directing the request. If a request comes with a business records affidavit or proof of reasonable necessity, these provisions should not apply.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
