Shift in Patient’s Right to Access Medical Records

By: Kelli C. Fleming, Burr & Forman

The Office of Civil Rights (“OCR”), the government agency tasked with HIPAA compliance and enforcement, recently announced a change impacting a patient’s right to access his/her medical records—a change which is, given OCR’s history, surprisingly favorable to providers. 

One of the long-standing premises of HIPAA has been a patient’s right to access his/her medical records. For years, the HIPAA regulations have limited the fees that providers can charge patients when they request a copy of their medical records to a reasonable, cost-based fee (regardless of the permitted state law fees). HITECH expanded this right a few years ago by allowing patients to exercise their right to access medical records, but designate a third-party to whom the records should be sent (e.g., the patient’s attorney). These requests from patients to send their records to a designated third-party are oftentimes referred to in the industry as “HITECH” requests. 

Subsequent OCR guidance stated that the historical limitation on fees that applied when a patient exercised his/her right to access medical records would also apply to the situation where a patient requested that his/her records be sent to a designated third-party pursuant to a “HITECH” request. As a result, providers were limited in what they could charge third-parties, such as attorneys, seeking access to medical records by way of a “HITECH” request from a patient, as opposed to by way of a HIPAA authorization. 

However, based on a recent court order, such limitation on fees no longer applies to “HITECH” requests. As a result of the recent court decision, OCR has clarified that “the fee limitation set forth at 45 C.F.R. § 164.524(c)(4) will apply only to an individual’s request for access to their own records, and does not apply to an individual’s request to transmit records to a third party.” Thus, as a result of this recent court decision, providers, and their business associates, are no longer bound by the HIPAA-imposed limitation on fees when a patient requests that a copy of his/her medical records be sent to a designated third party (e.g., attorney). For these “HITECH” requests, providers can now charge fees acceptable under state law, without applying the HIPAA fee limitations. These state law fees are oftentimes higher than the HIPAA fees. Further, the court decision clarified that such “HITECH” requests are limited to requests for an electronic health record with respect to PHI maintained in an electronic format.

OCR has been clear that the  HIPAA limitation on fees, however, will continue to apply to patient requests to access their own medical records when the records are delivered directly to the patient. Nonetheless, this shift in guidance is favorable to providers and much welcomed by the healthcare industry.

Kelli Fleming is a Partner at Burr & Forman LLP practicing exclusively in the firm’s healthcare industry group.