[Med-privacy] HIPAA and Medical Record Copy Charges

[pmarshall]

HIPAA and Medical Record Copy Charges=20

By Steve Fox & Rebekah A.Z. Monson, Esqs., Pepper Hamilton LLP

Whether and how much to charge patients, attorneys, and healthcare provid=
ers for copies of patient medical records while complying with HIPAA and =
state laws has become a hot topic. Copies of medical records are routinel=
y requested by patients changing providers, by providers in connection wi=
th providing treatment to patients, and by attorneys as part of legal dis=
putes. The HIPAA Privacy Rule (the "Privacy Rule") requires covered entit=
ies (i.e., health plans, clearinghouses, and providers who transmit healt=
h information in electronic form in connection with a HIPAA covered trans=
action) to inform individuals of their right of access to inspect and obt=
ain a copy of their protected health information ("PHI") in the individua=
l's designated record set maintained by or for a covered entity. Generall=
y, a designated record set consists of those records that contain health =
information, including billing information, about the individual.

The Privacy Rule permits covered entities to charge "reasonable, cost-bas=
ed fees" for providing copies of PHI to individuals or their personal rep=
resentatives. According to the Privacy Rule, fees for copies of medical r=
ecords can only include the costs for: (1) copying, including the cost fo=
r supplies for and labor of copying; (2) postage if the individual has re=
quested that the information be mailed; and (3) preparing an explanation =
or summary of the PHI, only if agreed to by the individual as required if=
 the individual requested a summary or explanation instead of records. 45=
 CFR =A7 164.524(c)(4).

In the Preamble to the Privacy Rule issued on December 28, 2000 (the "Pre=
amble"), the U.S. Department of Health and Human Services ("HHS") clarifi=
ed that copying fees are to be reasonable and based upon the costs of mak=
ing the copies, including but not limited to labor and supply costs (exam=
ples included in the Preamble are costs of paper for hard copies and the =
cost of a disk for electronic copies supplied on a computer disk). Furthe=
rmore, covered entities may not charge any fees for retrieving or handlin=
g the information, or for processing the request for copies. The Privacy =
Rule does not provide a maximum fee, including a per-page or per-record m=
aximum, so depending upon the length of the record, the total fees could =
be quite high.

In the Preamble HHS also wrote that fees for copying and postage costs pr=
ovided under state law are presumed to be "reasonable", however per-page =
costs that include costs excluded under the Privacy Rule (e.g., processin=
g, retrieving and handling) are not acceptable.  As a result, state-manda=
ted fees for copying charges may be preempted by HIPAA and the Privacy Ru=
le. Many state-mandated copying fees are higher than the costs involved i=
n copying the information and therefore these fees may be preempted by th=
e lower "reasonable" cost standard. In connection with providing copies t=
o individuals or their personal representatives, covered entities will ne=
ed to carefully review the state-mandated fees and determine whether they=
 meet the Privacy Rule reasonableness standard.

The aspect of the Privacy Rule requirements for medical record copying fe=
es that is currently drawing attention is the scope of the fee limitation=
s. The Privacy Rule copying fee requirements seem to only apply to reques=
ts made by individuals or their personal representatives and not to other=
 requests or permissible disclosures under HIPAA. Within the context of t=
he access rule itself (45 CFR =A7 164.524), only individuals are addresse=
d and by another provision (45 CFR =A7 164.502(g)), references to individ=
uals include their personal representatives. In general, the authority of=
 a personal representative under the Privacy Rule to act on behalf of an =
individual stems from the representative's authority to make healthcare d=
ecisions for that individual. Furthermore, the Preamble clarified that th=
e intent of HHS was to enable individuals' access to their PHI: "We do no=
t intend to affect the fees that covered entities charge for providing pr=
otected health information to anyone other than the individual." 65 Fed. =
Reg  82462, 82557 (Dec. 28, 2000), see also 67 Fed. Reg. 53182, 53254 (Au=
g. 14, 2002). As a result, requests in the form of subpoenas or from thir=
d parties and their attorneys appear to fall outside of the HIPAA-imposed=
 fee limitations and remain subject to applicable state laws.

The Privacy Rule standard has added another (federal) standard to the pat=
chwork of medical records copying fees regulations that exist under vario=
us state laws governing requests by patients, subpoenas, workers compensa=
tion, insurance and medical claims, and other agency requests. However, t=
he Privacy Rule fee restrictions only overlap with certain requests for c=
opies -- namely those by an individual or the individual's personal repre=
sentative, for the individual's PHI. Fees for other copy requests do not =
appear to be affected by the Privacy Rule. This is an area of the Privacy=
 Rule that has generated confusion and has been gaining attention and may=
 well become the subject of litigation.

Read past HIPAA Legal Q/A articles:
http://www.hipaadvisory.com/action/LegalQA/archives.htm

------------------------------
Steve Fox, Esq., is a partner at the Washington, DC, office of Pepper Ham=
ilton LLP.  This article was co-authored by Rebekah A.Z. Monson, Esq., of=
 Pepper Hamilton LLP. Disclaimer: This information is general in nature a=
nd should not be relied upon as legal advice.