Second HIPAA Guidance Issued Clarifies Fees for Medical Record Copies

October 19th, 2016

The Office of Civil Rights (OCR) has issued a fact sheet clarifying the fees patients may be charged for copies of their medical records. It also states that patients have the right to send medical records to a third party if they so choose.

According to OCR, patients can only be charged a reasonable cost-based fee for labor and supplies associated with making a copy. This includes paper and electronic copies provided on a CD or a flash drive. Labor for copying can include producing paper copies of the records and scanning them into electronic format, but cannot include reviewing the request for copies of the records, nor can it include the time in searching or retrieving the records. Labor costs may also include the time in uploading or transferring electronic protected health information (PHI) to a Web-based portal, email, smartphone app, portable media, or other method of delivery. Postage can be charged if the patient requests the records be mailed.

Many hospitals contract with third-party companies to process medical record requests. Administrative and other costs associated with outsourcing this function cannot be passed onto the patient. A flat fee can be charged for all standard requests for electronic copies of PHI maintained electronically, provided the fee does not exceed $6.50, inclusive of all labor, supplies, and any applicable postage. Retrieval fees and other costs not permitted by the Privacy Rules cannot be charged, even if authorized by state law. A facility cannot refuse to give a patient a copy of their medical records because he or she has not paid a bill. Patients cannot be charged a fee if they want to view their medical records, or if they take notes or make copies using cell phones or other devices.

The hospital or other covered entity must inform the patient of the cost of the medical records in advance, according to OCR. The fact sheet also states the hospital or other covered entity should post on its website the approximate fees for regular types of access requests.