HIPAA Regulatory Alert: Requirements on copying cost charges confusing
Requirements on copying cost charges confusing
What costs are considered reasonable?
What used to be a fairly routine occurrence for many health care providers — supplying copies of patient medical records on request — is becoming a major issue under HIPAA because of questions about how much can be charged for a copy of the record and the service under the HIPAA privacy rule and various state laws.
Copies of medical records are requested routinely by patients changing providers, providers in connection with giving treatment to patients, and attorneys for use in legal cases. Under the privacy rule, covered entities (health plans, clearinghouses, and providers that transmit health information in electronic form in connection with a HIPAA covered transaction) are to inform individuals of their right of access to inspect and obtain a copy of their protected health information in the records maintained by or for the covered entity.
Rebekah A.Z. Monson, an attorney with Pepper Hamilton’s Philadelphia office, tells HIPAA Regulatory Alert the privacy rule permits covered entities to charge "reasonable cost-based fees" for providing copies of protected health information to individuals or their personal representatives. Under the privacy rule, she says, fees for copies of medical records only can cover costs of:
1. copying, including costs for supplies and labor;
2. postage if the individual has requested that the information be mailed;
3. preparing an explanation or summary of the information, but only if agreed to by an individual who has requested such a summary or explanation rather than the complete record.
The problem, Monson says, is in the preamble to the privacy rule, the Department of Health and Human Services wrote that while fees for copying and postage costs under state law are presumed to be reasonable, per-page costs that include costs excluded under the privacy rule, such as processing, retrieving, and handling charges, are not acceptable. As a result, she says, state-mandated fees for copying charges, or a portion of those fees, may be preempted by HIPAA and the privacy rule.
"Many state-mandated copying fees are higher than the costs involved in copying the information, and therefore, these fees may be pre-empted by the lower reasonable’ cost standard," Monson says. "In connection with providing copies to individuals or their personal representatives, covered entities will need to carefully review the state-mandated fees and determine whether they meet the privacy rule reasonableness standard."
The department has not tried to give specific allowable cost figures because costs vary depending upon the size of the covered entity and the form of the copy, she adds.
Another area of confusion involves the fee charged individual patients, contrasted with the fee that can be charged for other requests or permitted disclosures, such as disclosures to a third-party pursuant to a patient authorization, which appear to fall outside of the scope of the privacy rule copy charge requirements.
"The department, in its comments on the privacy rule, intended to assure that a right of access would be available to all individuals and not only to those who can afford a copying fee," Monson says. "But there is a question of how an appropriate fee should be determined if, for example, an attorney is requesting the records as part of litigation. We’ve been hearing of some very high fees charged third parties when the copying is done in states that have limited or no controls over fees to be charged."
In general, under the privacy rule, the authority of patients’ personal representatives to act on behalf of individuals stems from the representatives’ authority to make health care decisions for the individual, such as through a health care power of attorney. That typically is not the case when attorneys are representing patients in lawsuits.
Also, the preamble to the privacy rule clarified that the department’s intent was to enable individuals to have access to their protected health information. "We do not intend to affect the fees that covered entities charge for providing protected health information to anyone other than the individual," it said.
Monson says there have been reports of some malpractice plaintiffs attorneys asking their clients to request the information and have it sent to them for future delivery to their attorney, thus hoping to keep the cost of copying at the individual level.
She says there is confusion about the scope of HIPAA’s copy charge requirements, particularly with respect to how they intersect with state law requirements, and would expect continued attention and possible litigation on these issues.
[Contact Ms. Monson at (215) 981-4031 or e-mail her at [email protected].]
What used to be a fairly routine occurrence for many health care providers supplying copies of patient medical records on request is becoming a major issue under HIPAA because of questions about how much can be charged for a copy of the record and the service under the HIPAA privacy rule and various state laws.
Subscribe Now for Access
You have reached your article limit for the month. We hope you found our articles both enjoyable and insightful. For information on new subscriptions, product trials, alternative billing arrangements or group and site discounts please call 800-688-2421. We look forward to having you as a long-term member of the Relias Media community.