|
|
HIPAA/LAW:
May 2004
"HIPAA and Medical Record Copy Charges"
By Steve Fox & Rebekah A.Z. Monson, Esqs., Pepper Hamilton
LLP
Whether and how much to charge patients, attorneys, and healthcare
providers for copies of patient medical records while complying
with HIPAA and state laws has become a hot topic. Copies of medical
records are routinely requested by patients changing providers,
by providers in connection with providing treatment to patients,
and by attorneys as part of legal disputes. The HIPAA Privacy Rule
(the "Privacy Rule") requires covered entities (i.e.,
health plans, clearinghouses, and providers who transmit health
information in electronic form in connection with a HIPAA covered
transaction) to inform individuals of their right of access to inspect
and obtain a copy of their protected health information ("PHI")
in the individual's designated record set maintained by or for a
covered entity. Generally, a designated record set consists of those
records that contain health information, including billing information,
about the individual.
The Privacy Rule permits covered entities to charge "reasonable,
cost-based fees" for providing copies of PHI to individuals
or their personal representatives. According to the Privacy Rule,
fees for copies of medical records can only include the costs for:
(1) copying, including the cost for supplies for and labor of copying;
(2) postage if the individual has requested that the information
be mailed; and (3) preparing an explanation or summary of the PHI,
only if agreed to by the individual as required if the individual
requested a summary or explanation instead of records. 45 CFR §
164.524(c)(4).
In the Preamble to the Privacy Rule issued on December 28, 2000
(the "Preamble"), the U.S. Department of Health and Human
Services ("HHS") clarified that copying fees are to be
reasonable and based upon the costs of making the copies, including
but not limited to labor and supply costs (examples included in
the Preamble are costs of paper for hard copies and the cost of
a disk for electronic copies supplied on a computer disk). Furthermore,
covered entities may not charge any fees for retrieving or handling
the information, or for processing the request for copies. The Privacy
Rule does not provide a maximum fee, including a per-page or per-record
maximum, so depending upon the length of the record, the total fees
could be quite high.
In the Preamble HHS also wrote that fees for copying and postage
costs provided under state law are presumed to be "reasonable",
however per-page costs that include costs excluded under the Privacy
Rule (e.g., processing, retrieving and handling) are not acceptable.
As a result, state-mandated fees for copying charges may be preempted
by HIPAA and the Privacy Rule. Many state-mandated copying fees
are higher than the costs involved in copying the information and
therefore these fees may be preempted by the lower "reasonable"
cost standard. In connection with providing copies to individuals
or their personal representatives, covered entities will need to
carefully review the state-mandated fees and determine whether they
meet the Privacy Rule reasonableness standard.
The aspect of the Privacy Rule requirements for medical record
copying fees that is currently drawing attention is the scope of
the fee limitations. The Privacy Rule copying fee requirements seem
to only apply to requests made by individuals or their personal
representatives and not to other requests or permissible disclosures
under HIPAA. Within the context of the access rule itself (45 CFR
§ 164.524), only individuals are addressed and by another provision
(45 CFR § 164.502(g)), references to individuals include their
personal representatives. In general, the authority of a personal
representative under the Privacy Rule to act on behalf of an individual
stems from the representative's authority to make healthcare decisions
for that individual. Furthermore, the Preamble clarified that the
intent of HHS was to enable individuals' access to their PHI: "We
do not intend to affect the fees that covered entities charge for
providing protected health information to anyone other than the
individual." 65 Fed. Reg 82462, 82557 (Dec. 28, 2000), see
also 67 Fed. Reg. 53182, 53254 (Aug. 14, 2002). As a result, requests
in the form of subpoenas or from third parties and their attorneys
appear to fall outside of the HIPAA-imposed fee limitations and
remain subject to applicable state laws.
The Privacy Rule standard has added another (federal) standard
to the patchwork of medical records copying fees regulations that
exist under various state laws governing requests by patients, subpoenas,
workers compensation, insurance and medical claims, and other agency
requests. However, the Privacy Rule fee restrictions only overlap
with certain requests for copies -- namely those by an individual
or the individual's personal representative, for the individual's
PHI. Fees for other copy requests do not appear to be affected by
the Privacy Rule. This is an area of the Privacy Rule that has generated
confusion and has been gaining attention and may well become the
subject of litigation.
Read
past HIPAA Legal articles.
Steve Fox, Esq., is a partner at the Washington, DC office of Pepper
Hamilton LLP, www.pepperlaw.com  .
This article was co-authored by Rebekah A.Z. Monson, Esq., an associate
of Pepper Hamilton LLP. They may be reached at foxsj@pepperlaw.com.
Disclaimer: This information is general in nature and should
not be relied upon as legal advice.
|
 |
 |
