Q: How long does a facility have to provide a resident or his representative access to medical records and copies of medical records, when requested? Does OBRA or HIPAA apply in this situation? And are the timelines different for providing the records to a current resident v. a former resident?
Virginia subscriber
A: There are three sources of regulation related to a residents access to his or her medical records: HIPAA, OBRA, and applicable state law. The HIPAA privacy rule generally applies to the use and disclosure of protected health information by covered health care providers, though HIPAA does not usurp other, more specific federal laws, nor does it preempt state laws that are more stringent.
The time frame for responding to a request for records under HIPAA is relatively lenient. Covered providers must act on a request for access (i.e., provide access or deny the request) within 30 days, or within 60 days if the records are maintained off-site. In either case, if the provider is unable to respond within these limits, it may extend the time another 30 days by providing a written explanation of the reason for the delay and the date by which it will respond.
The OBRA regulations, which apply to all nursing homes that participate in the Medicare and Medicaid programs, contain more specific requirements regarding access to resident records. With respect to the current residents of a nursing home, OBRA trumps HIPAA. Under OBRA, a nursing home must provide a resident access to his or her medical records within 24 hours of an oral or written request (excluding weekends and holidays). A resident also has the right, upon two working days advance notice, to purchase a copy of his or her records. Nursing homes must also comply with any relevant state laws regarding access to records, but state requirements are not likely to be stricter than, and thereby take precedence over, the OBRA requirements.
With respect to individuals who are no longer residents, the more general HIPAA privacy rule would apply, unless a relevant state law is more stringent. In other words, HIPAA applies unless a state law provides a greater right of access, which would include requiring a shorter response time than required under HIPAA.
Expert advice provided by attorney Richard Gardner in Atlanta.