Download PDF

Charging for Medical Records: Understanding Implications of Recent Federal Court Decision

Background:

HIPAA Right to Access

Individuals have the right to access Protected Health Information (PHI) Designated record sets include medical records, billing records, payment and claims records, health plan enrollment records, case management records, as well as other records used, in whole or in part, by or for a covered entity to make decisions about individuals. (HHS.gov)

* Individuals do not have a right to access PHI about them that is not part of a designated record set because this information is not used to make decisions about individuals. This may include certain quality assessment or improvement records, patient safety activity records, or business planning, development and management records that are used for business decisions more generally rather than to make decisions about individuals. (HHS.gov)

Due to a recent court case, the rate a third party can charge a covered entity for direct access to a patient’s electronic* medical records has changed.

* Fee limits apply when an individual directs a covered entity to send the PHI to the third party.

Overview of Permissible Costs for Copies of Medical Records Both Paper and Electronic based on Ciox Decision

Paper Records Requested by Patient Paper Records Requested by 3 rd Party Electronic Records Requested by Patient Electronic Records Requested by 3 rd Party (NEW)

Allowed Charge Actual or average labor costs or Patient Access rate of $6.50 Actual or average labor costs or Patient Access rate of $6.50 Actual labor costs or Patient Access rate of $6.50 May exceed Patient Rate of $6.50

OCR Settles First Right of Access Case:

Bayfront Health St. Petersburg (Bayfront) has paid $85,000 to the Office for Civil Rights at the U.S. Department of Health and Human Services and has adopted a corrective action plan to settle a potential violation of the right of access provision of the Health Insurance Portability and Accountability Act (HIPAA) Rules after Bayfront failed to provide a mother timely access to records about her unborn child. (%20has%20paid%20%2485%2C000,Rules%20after%20Bayfront%20failed%20to) HHS.gov%20has%20paid%20%2485%2C000,Rules%20after%20Bayfront%20failed%20to) )%20has%20paid%20%2485%2C000,Rules%20after%20Bayfront%20failed%20to)

Recent Ciox Court Decision

* A court ruled against HHS in a case involving charging for more medical records ( Ciox Health,LLC v. Azar, et al. ) * In a 55-page opinion stemming from a lawsuit filed against HHS by a “specialized medical records provider” that serves as an intermediary between HIPAA covered entities, the court sided with the vendor. Specifically, this vendor contracts with providers and serves to facilitate the provision of medical records to third parties (i.e., lawyers, life insurance companies) when directed by patients.

* Under a policy established by HHS in 2016, the department said that only a flat fee of up to $6.50 was permitted, though entities could charge more under the actual or average methodologies. However, since publication of that guidance, entities began allowing no more than $6.50 be charged to third parties working on behalf of a patient.

The court decision leaves untouched the HHS policy that enables patients* to directly access either paper or electronic copies of their medical record directly and be charged actual or average labor costs or the flat rate of $6.50 known as the Patient Rate. The vendor contested the flat fee only when it involves them obtaining the medical records, not when the patient does so on their own. The vendor called into question HHS’ authority to mandate this flat fee without going through proper notice and comment.

Implications of Interoperability, Information Blocking Rule & Patient Access Rules

* Proposed Rules issued on March 4, 2019 (pursuant to 21st Century Cures Act)

* Geared toward promoting patient access and consumer-directed sharing of data to spur digital health innovation

* 4 sets of actors must comply with data blocking requirements

Information Blocking Rules

* CHIME Public Policy 4 Part Webinar Series on Information Blocking Sponsored by First Health Advisory

* ONC and CMS High-Level Overview of Final Interoperability Rules

* Improve certified EHRs including greater transparency around product capabilities and contracting (i.e., prohibitions on gag clauses, real-world testing)

* To speed interoperability ONC is focusing on two use cases involving exporting “EHI.” This would replace the Consolidated Clinical Document Architecture (CCDA) data export certification criteria with a “standards agnostic” approach. 1. Patient access to data: Enable the export of EHI for a single patient upon a valid request from that patient or a user on the patient’s behalf

1. Providers switching vendors: When a healthcare provider chooses to transition or migrate information to another health IT system