Patient Access to Electronic Medical Records Under Federal Law
The Patient Access Right to Directly Request and Obtain
their Medical Records in Electronic Format
Under Federal Law
and the Subsequent Responsibilities of Healthcare Providers
in Responding to Such Requests
Introduction
You will often hear references such as “under HIPAA” or “under HITECH.” However, both HIPAA and HITECH work in conjunction with each other when it comes to accessing electronic medical records so hereafter they will be referred to collectively as “the Law.” Following are the citations.
Health Insurance Portability and Accountability Act of 1996 (HIPAA) (PL 104-191 ((45 (CFR 164.524)
Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH) (42 USC § 17935(e)
Interpretations of the above forth by the US Department of Health and Human Services (https://www.hhs.gov/hipaa/for professionals/privacy/guidance/access/index.html)
The Basic Right
The basic right is the right for a patient to obtain in electronic format any of their medical records that are maintained in electronic format by any of their healthcare providers. The definition of healthcare provider is very broad. It includes pharmacies, physical therapists, home healthcare providers, chiropractors, psychologists, psychiatrists and dentists as well as doctors and hospitals.
The Request
Request for the Electronic Medical Records Must Be Directly From the Patient
It must be from the Patient not the Patient’s Attorney. Some healthcare providers have been known to strictly interpret this, so the following guidelines are suggested.
No part of the request should be on the attorney’s letterhead
No part of the request should be signed by the attorney
If mailed, the envelope return address should be that of the patient not the attorney
The request should not be faxed from the attorney’s office
What Must Be in the Request?
The Law doesn’t say exactly what must be in the request. The regular request information applies though (i.e. full name, address, phone, date of birth, social security number, dates for which records are sought, type(s) of records sought and a signature. See sample letter in my other blog entry.
Can the Patient Request that the Electronic Medical Records and Any Invoices for the Electronic Medical Records be Sent Directly to their Attorney?
Yes. The Law says though that the request must be “clear, conspicuous and specific.” All of the Attorney’s contact information should be included including fax number and e-mail.
Can the Healthcare Provider Make the Patient Use Their Own Form that They Developed?
Yes. However, if a request is made without the form the healthcare provider must fax or e-mail the form to the attorney so as not to significantly delay the patient’s access to their records.
Can a Healthcare Provider Require that the Patient Include a Signed HIPAA Authorization/Release with the Request?
No. The Law actually says that the healthcare provider cannot require it. This is seen as a barrier to patient access. However, because the idea of it being mandatory to have a signed HIPAA Authorization/Release is so ingrained among healthcare providers it would probably assist in facilitating the processing to include one as part of the request. In addition, if there is a mandatory form from the healthcare provider it usually includes or is a HIPAA Authorization/Release.
Can Patient Requests for Their Electronic Medical Records be Submitted to Healthcare Providers through E-mail, Fax or Web Portal?
Yes. The healthcare provider can offer these options, but it is not mandatory they offer them.
Are Copies of Signatures and Electronic Signatures Valid for a Request?
Yes.
The Response
How Much Time Does the Healthcare Provider Have to Respond with the Electronic Records?
They have 30 days maximum from the time they received it. They can request an additional 30 days for good cause but still must notify the patient in writing.
In What Form and Format Can They Provide the Electronic Medical Records?
The healthcare provider can provide them via download from a secure web portal, e-mail or on a CD or USB drive. PDF for the most part has become the default format.
What if the Healthcare Provider Says They Have No Electronic Records or Just Automatically Send Me Hard Copies?
The healthcare provider still must provide an electronic version of the records if they have a scanner to convert them into electronic form. This is the “Readily Producible Rule.” Likewise, if the patient’s attorney has the ability to electronically capture faxes, the healthcare provider would be required to fax the records. See sample form letter in next blog entry.
Fees/Charging
Can Healthcare Providers Require Pre-Payment for the Records?
No. This is seen as a barrier to access.
How Much Can Healthcare Providers Charge?
Healthcare Providers can choose one of three ways to charge. These include a Flat Fee, an Actual Cost Fee or an Average Cost Fee.
How Does the Flat Fee Work?
It is a flat fee of $6.50 for each request inclusive of all labor, supplies and actual postage. This is the option for healthcare providers who do not want to go through the process of calculating actual or average allowable costs.
How Does the Actual Cost Fee Work?
A healthcare provider can calculate and charge actual labor costs. Actual labor costs only include copying how much time it takes the individual to make and send the copy in the form and format required. The labor rate used must be reasonable for such activity. Paper, CD and USB drives can be considered into this actual cost Search and retrieval time cannot be considered in the calculation. The healthcare provider must keep the calculations must be on file for review upon request.
How does the Average Fee Work?
Its basically a variant of the Actual Cost Fee option where you may have varying labor costs for any given request. The healthcare provider must keep the calculations on file for review upon request.
Can Healthcare Providers Include in the Fees Any Costs for Outsourcing Any Part of the Function to Outside Entities?
No.
What About Pennsylvania Law 46 Pa.B.7598 and Other State Laws for Charging?
If the law increases barriers to access, such as charging or permitting a higher fee such as the Pennsylvania Law, it is replaced by the federal law and does not apply. If the law increased access, such as requiring the records to be free once a year, it would apply.
Psychotherapy Notes Exception
Psychotherapy Notes are exempt from The Law. Psychotherapy Notes include notes recorded in any medium by a healthcare provider who is a mental health professional documenting or analyzing the contents of conversations during a private counseling session or a group, joint or family counseling session and that are separated from the rest of the individual’s medical records.
Psychotherapy Notes do not include medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnoses, functional status, the treatment plan, symptoms, prognosis, and progress to date.
