Skip to content Skip to navigation

HHS Says Copies of Patients’ Medical Records Should be Free of Charge

February 26, 2016
by Heather Landi
| Reprints

The U.S. Department of Health and Human Services (HHS) issued guidance stating that healthcare providers should provide individuals who request access to their medical information with copies of their protected health information (PHI) free of charge.

“While covered entities should forgo fees for all individuals, not charging fees for access is particularly vital in cases where the financial situation of an individual requesting access would make it difficult or impossible for the individual to afford the fee,” the HHS guidance stated.

“Providing individuals with access to their health information is a necessary component of delivering and paying for health care. We will continue to monitor whether the fees that are being charged to individuals are creating barriers to this access, will take enforcement action where necessary, and will reassess as necessary the provisions in the Privacy Rule that permit these fees to be charged,” the agency wrote.

The HHS’ newly released FAQs does clarify that healthcare providers covered by the Health Insurance Portability and Accountability Act (HIPAA) can charge individuals a fee for providing a copy of their PHI, “but only within specific limits.”

The HIPAA Privacy Rule permits a covered entity to impose a reasonable, cost-based fee to provide the individual with a copy of the individual’s PHI, or to direct the copy to a designated third party. The fee may include “only the cost of certain labor, supplies, and postage,” HHS stated.

“A covered entity may include reasonable labor costs associated only with the: (1) labor for copying the PHI requested by the individual, whether in paper or electronic form; and (2) labor to prepare an explanation or summary of the PHI, if the individual in advance both chooses to receive an explanation or summary and agrees to the fee that may be charged,” the HHS guidance stated.

And, HHS also clarified that if a limited fee is charged, healthcare organizations must inform individuals in advance of the approximate fee and should post on their websites or otherwise make available to individuals an appropriate fee schedule for regular types of access requests.

The GetMyHealthData campaign, a consumer advocacy group, praised the guidance, calling it a “home run for patients and families.”

“Today’s guidance will be a big help to health care providers who need a clear interpretation of the law as health records have become digital. HHS recognizes the essential role health information plays in enabling consumers to better manage their health and care, and this guidance will help eliminate many problems patients routinely encounter when they try to access and use their information,” Christine Bechtel, campaign coordinator for GetMyHealthData said in a statement. “Patients continue to tell us that cost is a significant and unexpected barrier to getting their digital health information. They also struggle to have their records sent to consumer health apps, researchers and family caregivers. HHS is showing great leadership in addressing these issues.”

The guidance outlines that labor costs for copying includes only labor for creating and delivering the electronic or paper copy, and does not include costs associated with “reviewing the request for access or searching for and retrieving the PHI, which includes locating and reviewing the PHI in the medial or other record, and segregating or otherwise preparing the PHI that is responsive to the request for copying.”

The guidance clarifies individuals’ right under HIPAA to access their health information.

In the guidance, HHS stated, “While it has always been prohibited to pass on to an individual labor costs related to search and retrieval, our experience in administering and enforcing the HIPAA Privacy Rule has shown there is confusion about what constitutes a prohibited search and retrieval cost and this guidance further clarifies this issue.  This clarification is important to ensure that the fees charged reflect only what the Department considers “copying” for purposes of applying 45 CFR 164.524(c)(4)(i) and do not impede individuals’ ability to receive a copy of their records.”

Regarding cost for supplies, OCR clarifies that included costs are costs associated with supplies for creating the paper copy (such as paper toner) or, for electronic media (such as a CD or USB) only if the individual requests that the electronic copy be provided on portable media. “Individuals have the right to have their PHI emailed to them upon request.”

“Costs associated with updates to or maintenance of systems and data, capital for data storage and maintenance, labor associated with ensuring compliance with HIPAA (and other applicable law) in fulfilling the access request (e.g., verification, ensuring only information about the correct individual is included, etc.) and other costs not included above, even if authorized by State law, are not permitted for purposes of calculating the fees that can be charged to individuals,” HHS stated.



What price is the right price?

If the owner of data doesn’t have regular access, or doesn’t exist at all, how much should one pay to access patient records? One perspective on the issue is that the cost for care paid in the past should include the cost of the data collected from the visits. Therefore, the information should be accessible for no additional fee.

MIke Minter financial advisor in Tampa Florida prone 813 964 7100

My daughter, 18, just had to pay $30 to get a copy of her physical for track and field sports at high school. The school said they did not have the information from last fall and the clinic charged her because it was a rush, she could have had a new physical for $30! That is too much to pay for a copy of an existing record, not asking for any interpretation or MD or RN assistance.


CMS Hospital Compare Website Updated with VA Data

The Centers for Medicare & Medicaid Services (CMS) has announced the inclusion of Veterans Administration (VA) hospital performance data as part of the federal agency’s Hospital Compare website.

CMS Awards Funding to Special Innovation Projects

The Centers for Medicare & Medicaid Services (CMS) has awarded 20, two-year Special Innovation Projects (SIPs) aimed at local efforts to deliver better care at lower cost.

Center of Excellence in Genomic Science to be Established in Chicago

The National Human Genome Research Institute has awarded $10.6 million over five years for the establishment of a new research center in Chicago to advance genomic science.

EHNAC and HITRUST Combine HIPAA Security Criteria, CSF Framework

The Electronic Healthcare Network Accreditation Commission (EHNAC) and the Health Information Trust Alliance (HITRUST) announced plans to streamline their accreditation and certification programs.

Halamka on MACRA Final Rule: “CMS is Listening and I Thank Them”

Health IT notable expert John Halamka, M.D., CIO of Beth Israel Deaconess Medical Center in Boston, recently weighed in on the Medicare Access and CHIP Reauthorization Act (MACRA) final rule.

Texas Patient Care Clinic Hit with Ransomware Attack

Grand Prairie, Texas-based Rainbow Children's Clinic was the victim of a ransomware attack on its IT systems in August, affecting more than 33,000 patients, according to multiple news media reports this week.