Pediatric Coding Alert

Although you can legally charge patients for sending their records, HHS appears to discourage it.

Practices that routinely hand patients a bill every time they request a copy of their medical records may want to rethink their policies. The Department of Health and Human Services (HHS) recently came out with its most solid statement yet discouraging practices from charging patients for access to their protected health information (PHI).

Start With the Basics

According to the HIPAA Act of 1996, HIPAA-covered entities—which includes providers—must “provide individuals, upon request, with access to the PHI about them in one or more ‘designated record sets’ maintained by or for the covered entity,” HHS says in its recently amended document, Individuals’ Right under HIPAA to Access their Health Information 45 CFR § 164.524, in which the agency lists a new FAQ on whether or not to charge patients for copies of their PHI.

This means that patients have the right to review or get a copy of the PHI (or both), and they can ask you to send a copy to another entity. This applies no matter whether you keep the records on paper, in an EHR system, offsite or in any other format.

HHS Uses ‘Free of Charge’ Verbiage

Although HHS acknowledges that you can charge patients for giving them a copy of their PHI, the agency says you should only do so “within specific limits” for the cost of labor, supplies and postage. However, it’s clear that HHS doesn’t encourage you to charge patients for any records at all, even though doing so can be done within the law.

“While the Privacy Rule permits the limited fee described above, covered entities should provide individuals who request access to their information with copies of their PHI free of charge,” the agency unequivocally says in the newly-updated document. “While covered entities should forgo fees for all individuals, not charging fees for access is particularly vital in cases where the financial situation of an individual requesting access would make it difficult or impossible for the individual to afford the fee.”

How Should You Interpret This?

Practices might be confused about HHS’s wording, considering that it acknowledges that you can charge a fee while at the same time advising you to forego the fees. Pediatric Coding Alert asked Michael D. Bossenbroek, Esq., a partner with Wachler & Associates, who has extensive HIPAA knowledge, to provide some insight into the language that the agency used.

“HHS clearly expressed its position that covered entities ‘should’ provide individuals access to their health information free of charge, particularly where an individual’s financial situation would make it difficult or impossible to afford the fee and effectively deny the individual access to his health information,” Bossenbroek said. “Foregoing the fee is not mandatory, but it is clearly the approach favored by HHS. In fact, HHS followed up this statement by essentially warning covered entities that it will be monitoring the fees they are charging, and take enforcement action if necessary and potentially reassessing the Privacy Rule’s fee provisions if necessary.”

When it comes to HHS’s advice that you should be particularly careful charging fees to patients whose financial situations are precarious, many practices are confused about how they should determine which patients should be charged and which shouldn’t. Unfortunately, the agency isn’t specific about how to do this.

“This is a gray area to be sure,” Bossenbroek says. “HHS on one hand has expressed its position that providers should provide patients copies of their PHI free of charge. It views patient access to health information as a necessary component in the delivery of health care and any impediments to patient access should be limited. On the other hand, the Privacy Rule allows a fee to be charged and providers can continue to do so until the Rule says otherwise. But HHS has given every indication it will not tolerate abusive practices where providers charge excessive fees or charge fees not permitted by the Rule.”

Because medical practices are likely to deal with multiple record requests each month, it would be hard to differentiate between those who can afford the fee and those who can’t, Bossenbroek adds.

“A provider could allow patient to claim that they have financial hardship, but it may be difficult to verify this claim on its face,” he says. “A provider could determine not to charge a fee at all, but it may not be a realistic business decision given the costs it would incur.  Alternatively, it could limit its fee to certain types of requests (e.g., paper) if it determines that the costs of copying electronic PHI are minimal.  It would make sense that a provider ensures that the fees being charged are well documented and supportable and fall within the limits HHS sketched out in this FAQ and the Privacy Rule.”

Resource: To read HHS’s complete opinion on the topic, visit www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html#newlyreleasedfaqs.