Health Information Compliance Alert

Question: The HIPAA Right of Access rules seem to say that we cannot charge more than a flat fee of $6.50 for providing a patient with a copy of his PHI. Is this true? What if it costs us more than $6.50 to provide the copies — can we charge more?

Answer: The guidance from the HHS Office for Civil Rights (OCR) on complying with the HIPAA Right of Access rules can be a little confusing, particularly regarding the “flat fee” option for charging individuals who request a copy of their protected health information (PHI).

On May 24, the OCR issued an FAQ clarification on this issue. The OCR states that charging a flat fee not to exceed $6.50 per request is merely an option available to covered entities (CEs) or business associates (BAs) “that do not want to go through the process of calculating actual or average allowable costs for requests for electronic copies of PHI maintained electronically.”

When calculating allowable fees for providing individuals with copies of their PHI, you have three choices:

1. Calculate the actual allowable costs to fulfill each request; OR
2. Use a schedule of costs based on average allowable labor costs to fulfill standard requests; OR
3. For an electronic copy of PHI maintained electronically, charge a flat fee not to exceed $6.50 (inclusive of all labor, supplies, and postage).

If you choose to generally use the average cost method or a flat fee, you may encounter situations where you have an unusual or uncommon type of request that you hadn’t considered when setting up your fee structure. In these cases, you may want to calculate actual costs to provide the requested copy, and you can do this “so long as the costs are reasonable and only of the type permitted by the Privacy Rule,” the OCR instructs.

“An entity that chooses to calculate actual costs in these circumstances still must — as in other cases — inform the individual in advance of the approximate fee that may be charged for providing the copy requested,” OCR says.

The new FAQ on the flat rate option is available at www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html#maximumflatfee. To read more on the HIPAA Right of Access guidance, go to www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html.