HHS Says Copies of Patients’ Medical Records Should be Free of Charge | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

HHS Says Copies of Patients’ Medical Records Should be Free of Charge

February 26, 2016
by Heather Landi
| Reprints

The U.S. Department of Health and Human Services (HHS) issued guidance stating that healthcare providers should provide individuals who request access to their medical information with copies of their protected health information (PHI) free of charge.

“While covered entities should forgo fees for all individuals, not charging fees for access is particularly vital in cases where the financial situation of an individual requesting access would make it difficult or impossible for the individual to afford the fee,” the HHS guidance stated.

“Providing individuals with access to their health information is a necessary component of delivering and paying for health care. We will continue to monitor whether the fees that are being charged to individuals are creating barriers to this access, will take enforcement action where necessary, and will reassess as necessary the provisions in the Privacy Rule that permit these fees to be charged,” the agency wrote.

The HHS’ newly released FAQs does clarify that healthcare providers covered by the Health Insurance Portability and Accountability Act (HIPAA) can charge individuals a fee for providing a copy of their PHI, “but only within specific limits.”

The HIPAA Privacy Rule permits a covered entity to impose a reasonable, cost-based fee to provide the individual with a copy of the individual’s PHI, or to direct the copy to a designated third party. The fee may include “only the cost of certain labor, supplies, and postage,” HHS stated.

“A covered entity may include reasonable labor costs associated only with the: (1) labor for copying the PHI requested by the individual, whether in paper or electronic form; and (2) labor to prepare an explanation or summary of the PHI, if the individual in advance both chooses to receive an explanation or summary and agrees to the fee that may be charged,” the HHS guidance stated.

And, HHS also clarified that if a limited fee is charged, healthcare organizations must inform individuals in advance of the approximate fee and should post on their websites or otherwise make available to individuals an appropriate fee schedule for regular types of access requests.

The GetMyHealthData campaign, a consumer advocacy group, praised the guidance, calling it a “home run for patients and families.”

“Today’s guidance will be a big help to health care providers who need a clear interpretation of the law as health records have become digital. HHS recognizes the essential role health information plays in enabling consumers to better manage their health and care, and this guidance will help eliminate many problems patients routinely encounter when they try to access and use their information,” Christine Bechtel, campaign coordinator for GetMyHealthData said in a statement. “Patients continue to tell us that cost is a significant and unexpected barrier to getting their digital health information. They also struggle to have their records sent to consumer health apps, researchers and family caregivers. HHS is showing great leadership in addressing these issues.”

The guidance outlines that labor costs for copying includes only labor for creating and delivering the electronic or paper copy, and does not include costs associated with “reviewing the request for access or searching for and retrieving the PHI, which includes locating and reviewing the PHI in the medial or other record, and segregating or otherwise preparing the PHI that is responsive to the request for copying.”

The guidance clarifies individuals’ right under HIPAA to access their health information.

In the guidance, HHS stated, “While it has always been prohibited to pass on to an individual labor costs related to search and retrieval, our experience in administering and enforcing the HIPAA Privacy Rule has shown there is confusion about what constitutes a prohibited search and retrieval cost and this guidance further clarifies this issue.  This clarification is important to ensure that the fees charged reflect only what the Department considers “copying” for purposes of applying 45 CFR 164.524(c)(4)(i) and do not impede individuals’ ability to receive a copy of their records.”

Regarding cost for supplies, OCR clarifies that included costs are costs associated with supplies for creating the paper copy (such as paper toner) or, for electronic media (such as a CD or USB) only if the individual requests that the electronic copy be provided on portable media. “Individuals have the right to have their PHI emailed to them upon request.”

“Costs associated with updates to or maintenance of systems and data, capital for data storage and maintenance, labor associated with ensuring compliance with HIPAA (and other applicable law) in fulfilling the access request (e.g., verification, ensuring only information about the correct individual is included, etc.) and other costs not included above, even if authorized by State law, are not permitted for purposes of calculating the fees that can be charged to individuals,” HHS stated.

Get the latest information on Health IT and attend other valuable sessions at this two-day Summit providing healthcare leaders with educational content, insightful debate and dialogue on the future of healthcare and technology.

Learn More



What price is the right price?

If the owner of data doesn’t have regular access, or doesn’t exist at all, how much should one pay to access patient records? One perspective on the issue is that the cost for care paid in the past should include the cost of the data collected from the visits. Therefore, the information should be accessible for no additional fee.

MIke Minter financial advisor in Tampa Florida prone 813 964 7100

My daughter, 18, just had to pay $30 to get a copy of her physical for track and field sports at high school. The school said they did not have the information from last fall and the clinic charged her because it was a rush, she could have had a new physical for $30! That is too much to pay for a copy of an existing record, not asking for any interpretation or MD or RN assistance.


Duke Health First to Achieve HIMSS Stage 7 Rating in Analytics

North Carolina-based Duke Health has become the first U.S. healthcare institution to be awarded the highest honor for analytic capabilities by HIMSS Analytics.

NIH Releases First Dataset from Adolescent Brain Development Study

The National Institutes of Health (NIH) announced the release of the first dataset from the Adolescent Brain Cognitive Development (ABCD) study, which will enable scientists to conduct research on the many factors that influence brain, cognitive, social, and emotional development.

Boston Children's Accelerates Data-Driven Approach to Clinical Research

In an effort to bring a more data-driven approach to clinical research, Boston Children’s Hospital has joined the TriNetX global health research network.

Paper Records, Films Most Common Type of Healthcare Data Breach, Study Finds

Despite the high level of hospital adoption of electronic health records and federal incentives to do so, paper and films were the most frequent location of breached data in hospitals, according to a recent study.

AHA Appoints Senior Advisor for Cybersecurity and Risk

The American Hospital Association (AHA) has announced that John Riggi has joined the association as senior advisor for cybersecurity and risk.

Report: Healthcare Accounted for 45% of All Ransomware Attacks in 2017

Healthcare fell victim to more ransomware attacks than any other industry in 2017, according to a new report from global cybersecurity insurance company Beazley.