Health Information Compliance Alert

Question: A patient has requested electronic copies of his health records, some of which our office maintains only on paper. Does the HIPAA Privacy Rule require our office to scan paper records to create an electronic copy of the protected health information (PHI) for the patient?

Answer: If you can readily produce an electronic copy of the PHI by scanning the records, you must do so, according to a recently released guidance document from the HHS Office for Civil Rights (OCR). But HIPAA does not require you to purchase a scanner to create electronic copies. (For more on the recently released documents, see “Are You Complying With The 6 Key Aspects Of HIPAA’s Access Rights?” on page 4.)

If an individual requests an electronic copy of PHI in a specific format and your office maintains that PHI only on paper, you must provide the individual the electronic copy, in the format requested, “if the copy is readily producible electronically and readily producible in the electronic format requested,” the OCR says. If the copy is not “readily producible” in the specific format that the individual requested, you may offer the individual the copy in an alternative readable electronic format.

Further, if you cannot readily produce the copy in electronic form, or the individual declines to accept the electronic format(s) that you’re able to readily produce, you may provide the individual with a readable hard copy of the PHI to satisfy the access request, OCR explains.