$148 for a PDF? Patient Access to Medical Records Hit or Miss

A watchdog agency cites egregious cases as the federal government promotes interoperability of health data.

The fees patients pay for copies of their own medical records vary drastically, sometimes running afoul of the restrictions written into federal law, according to a Government Accountability Office report released this week.

The watchdog agency's report provided a list of egregious cases, including one in which a patient was charged $148 for a digital copy of her medical record. Two others were charged more than $500 apiece for a single request, the report said, citing an unnamed patient advocacy organization.

Some providers may be unaware of their duties under the Health Insurance Portability and Accountability Act (HIPAA), which requires providers and insurers to give people access to their medical records upon request, the GAO report states.

"This right of access allows patients to obtain their medical records in a timely manner while being charged a reasonable, cost-based fee," the report states.

• What's reasonable? Interpretive guidance released in 2016 by the Health and Human Services Office for Civil Rights says the fee a provider charges to give patients a copy of their records may account for only four categories of expenses: (1) labor to copy the records, (2) supplies, such as paper or electronic media, (3) postage, and (4) the preparation of a summary of the personal health information included.
   
• What's prohibited? The HHS OCR guidance says providers are not allowed to charge fees that account for expenses to verify, document, search for, or retrieve the information, maintain systems, pay for infrastructure, or other expenses not expressly permitted by HIPAA. (Even so, the GAO report mentions at least one example in which a hospital's retrieval-of-information vendor charged a patient a retrieval fee, despite HIPAA's prohibition.)
   
• Beware state laws. Some states have laws on the books that seem to allow providers to pass additional expenses along to patients. But HIPAA preempts these more-permissive state-law provisions, the HHS OCR guidance and GAO report note. (State laws that establish greater access rights are not preempted by HIPAA.)
   
• Three permissible calculations. Although the HHS OCR guidance does not prescribe a fee schedule, it does outline three permissible ways to calculate fees: (1) actual costs, counting labor, material, and postage; (2) average costs, based on a schedule developed by the provider; or (3) a flat fee capped at $6.50 for all electronic copies of information stored electronically.
   
• Interoperability rules. This GAO report comes as the Centers for Medicare & Medicaid Services pushes a planned overhaul of the "meaningful use" electronic health record incentive program, which CMS rebranded last month "promoting interoperability." The Office of the National Coordinator for Health IT, meanwhile, plans to introduce a proposed interoperability rule this fall. Both could significantly impact this medical records request process.

The GAO was directed to produce this report by June 13, pursuant to the 21^st Century Cures Act.