Top 10 Rules For Requesting Low-Cost Medical Records Under HITECH/HIPAA

The HIPAA right of access allows individuals to inspect or obtain copies of protected health information in a designated record set. When the rule applies, healthcare providers and health plans generally must respond within 30 calendar days and may charge only certain reasonable, cost-based fees.

Attorneys should distinguish between a patient requesting records for personal access and a patient directing records to a law firm or another third party. Following the federal court decision in Ciox Health, LLC v. Azar, HIPAA’s individual-access fee limits do not automatically apply when records are sent to a third party.

These ten rules can help attorneys and their clients request the right records through the appropriate process.

1. Identify the Type of Request

Before submitting a request, determine who is requesting the records and who will receive them.

An individual requesting records for personal access generally receives the protections of 45 C.F.R. § 164.524. A legally authorized personal representative may exercise those rights within the scope of the representative’s authority.

A request directing records to an attorney or another third party may be treated differently. An attorney may instead need a HIPAA authorization, subpoena, court order, or another form of legal authority.

Using the wrong process can lead to delays, rejection, or higher fees.

2. Keep the Request Simple and Specific

An access request does not need a lengthy legal argument. It should clearly identify:

• The patient
• The provider or facility
• The requested date range
• The categories of records needed
• The requested format
• The preferred delivery method

A provider may require its own written request form if patients have been informed of that requirement.

Attorneys may help clients prepare and transmit requests. However, attorney letterhead or a patient signature does not by itself determine whether HIPAA’s individual-access fee limits apply.

3. Request the Complete Designated Record Set

HIPAA does not necessarily provide access to every document a healthcare organization possesses. It generally covers protected health information in a designated record set.

That may include:

• Medical and clinical records
• Billing records
• Laboratory reports
• Imaging
• Claims information
• Clinical notes used to make decisions about the patient

For litigation, avoid requesting only “the medical chart.” Identify the facilities, providers, dates, billing records, imaging, test results, operative reports, and other categories needed for the case.

Audit trails and system metadata are not automatically part of every designated record set. Their status can depend on how they are maintained and used.

4. Request a Useful Format

When records are maintained electronically, an individual may request an electronic copy in a specific form and format. The provider generally must use that format when it is readily producible. Otherwise, the parties should agree on another readable electronic format.

For legal review, a searchable PDF is often more useful than paper copies or unsearchable image files.

When records exist only on paper, a provider may need to scan them if an electronic copy is readily producible. However, HIPAA does not require a provider to purchase new equipment solely to fulfill a request.

5. Understand the Permitted Fees

When HIPAA’s individual-access fee limitation applies, the fee may include only specified copying expenses, such as:

• Labor used to create and deliver the copy
• Paper or electronic media requested by the individual
• Postage
• An agreed summary or explanation

The fee generally may not include the cost of searching for, retrieving, reviewing, or verifying the records. General overhead and system-maintenance costs also may not be added to an individual-access fee.

A healthcare organization may use a records vendor or business associate. The question is not who performs the work, but whether the fee includes only costs permitted under HIPAA.

6. Do Not Treat $6.50 as a Universal Maximum

The commonly cited $6.50 fee is an optional calculation method, not a universal cap.

According to HHS fee guidance, a covered entity may generally calculate the fee using:

1. The actual allowable cost of the request
2. A schedule based on average allowable costs
3. An optional flat fee of no more than $6.50 for an electronic copy of information maintained electronically

A provider using an allowable actual-cost or average-cost method may charge more than $6.50.

The $6.50 option also should not be assumed to apply when records are directed to an attorney or another third party.

7. Per-Page Charges Depend on the Record Format

Per-page fees may be used when records are maintained only on paper and the individual requests paper copies or electronic copies created by scanning those paper records.

HHS does not consider per-page fees reasonable for information maintained electronically. This remains true when electronically maintained records are printed and supplied on paper.

State fee schedules may still apply when a request falls outside HIPAA’s individual-access fee limitation. Attorneys should therefore check both federal requirements and the current law of the relevant state.

8. Verify a Personal Representative’s Authority

A legally authorized personal representative may exercise an individual’s HIPAA rights within the scope of the representation.

Depending on applicable law, a representative may include:

• A court-appointed guardian
• A healthcare agent
• A parent or guardian of a minor
• An executor or administrator
• Another person authorized by law

A family relationship alone does not always establish authority. Providers may request documents confirming the representative’s status.

HIPAA also includes limited exceptions involving abuse, neglect, or endangerment. Applicable state law should be reviewed before asserting personal-representative authority.

9. Treat Third-Party Requests Carefully

An individual may ask a provider to send records directly to an attorney, insurer, expert, or another recipient. That request is not necessarily treated the same as a request in which the individual receives the records personally.

HHS states that, following Ciox, HIPAA’s individual-access fee limitation:

• Continues to apply when individuals request their own records
• Does not apply when individuals direct records to third parties

Before submitting an attorney-directed request, determine whether it should proceed through an individual access request, HIPAA authorization, subpoena, court order, personal-representative request, or another authorized process.

The correct method may depend on the recipient, format, jurisdiction, and purpose of the request.

10. Track the Response Deadline

A covered entity generally must act on an individual’s HIPAA access request within 30 calendar days.

If it cannot respond within that period, it may take one extension of no more than 30 additional days. The provider must send a written explanation of the delay and state when the request will be completed.

State law may impose a shorter deadline.

If access is denied, the provider generally must issue a written explanation. Depending on the reason, the patient may have a right to have the denial reviewed by another licensed healthcare professional.

A patient may also file a complaint with the HHS Office for Civil Rights. Complaints generally must be filed within 180 days of when the person knew about the alleged violation, although OCR may extend that period for good cause.

Records That May Be Excluded

The HIPAA right of access is broad, but it is not unlimited.

Two important exclusions are:

• Psychotherapy notes, a specifically defined category of separately maintained mental-health counseling notes
• Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative proceeding

Other limited grounds for denying access are contained in 45 C.F.R. § 164.524. Even when part of a request may be denied, the provider generally must produce the remaining accessible information.

Obtaining the records is only the first step. In complex cases, medical record review can help attorneys evaluate chronology, causation, preexisting conditions, treatment gaps, damages, and missing documentation. Learn more about Expert Institute’s medical record review service.

This article provides general information about federal HIPAA access requirements and is not legal advice. Current federal and state requirements should be verified for each request.