The U.S. Department of Health and Human Services (HHS) issued guidance stating that healthcare providers should provide individuals who request access to their medical information with copies of their protected health information (PHI) free of charge.
“While covered entities should forgo fees for all individuals, not charging fees for access is particularly vital in cases where the financial situation of an individual requesting access would make it difficult or impossible for the individual to afford the fee,” the HHS guidance stated.
“Providing individuals with access to their health information is a necessary component of delivering and paying for health care. We will continue to monitor whether the fees that are being charged to individuals are creating barriers to this access, will take enforcement action where necessary, and will reassess as necessary the provisions in the Privacy Rule that permit these fees to be charged,” the agency wrote.
The HHS’ newly released FAQs does clarify that healthcare providers covered by the Health Insurance Portability and Accountability Act (HIPAA) can charge individuals a fee for providing a copy of their PHI, “but only within specific limits.”
The HIPAA Privacy Rule permits a covered entity to impose a reasonable, cost-based fee to provide the individual with a copy of the individual’s PHI, or to direct the copy to a designated third party. The fee may include “only the cost of certain labor, supplies, and postage,” HHS stated.
“A covered entity may include reasonable labor costs associated only with the: (1) labor for copying the PHI requested by the individual, whether in paper or electronic form; and (2) labor to prepare an explanation or summary of the PHI, if the individual in advance both chooses to receive an explanation or summary and agrees to the fee that may be charged,” the HHS guidance stated.
And, HHS also clarified that if a limited fee is charged, healthcare organizations must inform individuals in advance of the approximate fee and should post on their websites or otherwise make available to individuals an appropriate fee schedule for regular types of access requests.
The GetMyHealthData campaign, a consumer advocacy group, praised the guidance, calling it a “home run for patients and families.”
“Today’s guidance will be a big help to health care providers who need a clear interpretation of the law as health records have become digital. HHS recognizes the essential role health information plays in enabling consumers to better manage their health and care, and this guidance will help eliminate many problems patients routinely encounter when they try to access and use their information,” Christine Bechtel, campaign coordinator for GetMyHealthData said in a statement. “Patients continue to tell us that cost is a significant and unexpected barrier to getting their digital health information. They also struggle to have their records sent to consumer health apps, researchers and family caregivers. HHS is showing great leadership in addressing these issues.”
The guidance outlines that labor costs for copying includes only labor for creating and delivering the electronic or paper copy, and does not include costs associated with “reviewing the request for access or searching for and retrieving the PHI, which includes locating and reviewing the PHI in the medial or other record, and segregating or otherwise preparing the PHI that is responsive to the request for copying.”
The guidance clarifies individuals’ right under HIPAA to access their health information.
In the guidance, HHS stated, “While it has always been prohibited to pass on to an individual labor costs related to search and retrieval, our experience in administering and enforcing the HIPAA Privacy Rule has shown there is confusion about what constitutes a prohibited search and retrieval cost and this guidance further clarifies this issue. This clarification is important to ensure that the fees charged reflect only what the Department considers “copying” for purposes of applying 45 CFR 164.524(c)(4)(i) and do not impede individuals’ ability to receive a copy of their records.”
Regarding cost for supplies, OCR clarifies that included costs are costs associated with supplies for creating the paper copy (such as paper toner) or, for electronic media (such as a CD or USB) only if the individual requests that the electronic copy be provided on portable media. “Individuals have the right to have their PHI emailed to them upon request.”
“Costs associated with updates to or maintenance of systems and data, capital for data storage and maintenance, labor associated with ensuring compliance with HIPAA (and other applicable law) in fulfilling the access request (e.g., verification, ensuring only information about the correct individual is included, etc.) and other costs not included above, even if authorized by State law, are not permitted for purposes of calculating the fees that can be charged to individuals,” HHS stated.
