Question:
It’s a good thing that many patients are becoming more actively involved in their care, but my practice is finding it difficult during the pandemic to keep up with requests to produce copies of patient medical records. May we charge a premium for them? We may have to pay overtime to staff or hire additional staff to handle these requests. What about establishing a schedule for responses, to help us manage our scarce staff resources?
Answer:
For many years, New York State has had laws establishing a physician’s obligation to provide patient records and how much the physician may charge for them. More recently, the Health Insurance Portability and Accountability Act (HIPAA) and the HITECH Act and regulations promulgated under each of those statutes included provisions that address the right of patients to obtain copies of their medical records and what patients may be charged to get them.
The short answer to your first question is that you may not charge a premium for providing copies of patient records. New York law and HIPAA both require that copies must be provided at “reasonable” cost-based charges, capped in New York at not more than $0.75 per page for paper copies. The short answer to your second question is that you may establish a schedule for responding, but it must comply with existing regulatory timeframes. Under the current HIPAA rules, you have 30 days from the date you receive a patient’s request to exercise their right to access their record to act on it. That 30-day period may be extended by an additional 30 days if you inform the patient why you need more time and when you expect to complete the request. The New York Public Health Law requires that you produce copies within a “reasonable” time, which the Department of Health says is between 10 and 14 days.
The federal government takes this issue very seriously. The ability of patients to access their medical records is seen as key to the coordination of their care, and delays may contribute to worse health outcomes. In early 2019, the U.S. Office of Civil Rights (OCR), which is charged with enforcing HIPAA compliance, announced its Right of Access Initiative to vigorously enforce the rights of patients to receive copies of their medical records promptly without being overcharged for them. Since September 2019, OCR has settled 14 cases with providers ranging from solo practitioners to NY Spine Medicine and Banner Health System with fines totaling over $900,000 for their failures to provide medical records. The press release on the Banner Health settlement was issued on January 12, 2021. The targets of these enforcement actions all took an inordinate amount of time to supply records to the patients, even after being informed in a few cases that complaints had been filed with OCR.
The Department of Health and Human Services (HHS) is now taking this issue to the next step. On December 10, 2020, HHS issued Notice of Proposed Rulemaking (NPRM) to modify the HIPAA Privacy Rule to shorten the 30-day period to 15 days. If more time is needed, a single 15-day extension would be available but only on very limited conditions. The NPRM proposes to mandate that providers may not charge patients to inspect their records in person, and that patients may, using their own resources, make notes about or copies, photos or videos of their records. If the records are readily available at the point of care in conjunction with a care appointment, providers may not delay patients’ rights to inspect them at that time. Patients may not be charged for using an internet-based method to view or print the records using the patients’ own access devices, and/or printers and paper. Providers may only charge reasonable cost-based fees covering labor for copying, and/or supplies for making non-electronic copies, and actual postage or shipping charges for mailing non-electronic copies. These proposed rules would override any more lenient state laws if adopted.
It is too early to say whether the modifications in the NPRM will be adopted by HHS as proposed or with changes, or what the incoming Biden administration will do on this issue. Our best advice at this time is develop policies and procedures that will allow you to timely respond to patient requests at the lowest possible cost. Implementing a patient portal that complies with the HIPAA Security Rule may be the best investment you can make to address this issue.
If you have any questions regarding the issues discussed above or if you have any other Health Care Law concerns, please contact the Underberg & Kessler attorney who regularly handles your legal matters or Helen Zamboni, the author of this piece, here or at (585) 258-2844.