The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) recently provided clarification of its policy for how much a HIPAA covered entity can charge patients for access to their medical records. Providers are allowed to charge patients a “reasonable” fee to compensate themselves for providing copies of the patient’s Personal Health Information (PHI). This fee is meant to cover labor and supply costs for providing the records. Patients must be made aware of the fee in advance.
Providers have three options for determining the fee:
- Actual costs: A provider may calculate actual labor costs to fulfill the request as long as the labor included is only for copying (and/or creating a summary or explanation if the individual chooses to receive a summary or explanation) and the labor rates used are reasonable for such activity. In addition, the covered entity may add the costs of the applicable supplies (e.g., paper, CD or USB drive) or postage costs.
- Average costs: In lieu of calculating labor costs individually for each request, a covered entity can develop a schedule of costs for labor based on average labor costs to fulfill standard types of access requests. Labor costs for copying – but not for search and retrieval – are reasonable and are the ones which HIPAA permits to be included in a fee. Covered entities may add to that amount, any applicable supply (e.g., paper, CD or USB drive) or postage costs.
- Flat fee: A covered entity may charge individuals a flat fee for all requests for electronic copies of PHI maintained electronically, provided the fee does not exceed $6.50 – inclusive of all labor, supplies and any applicable postage. Charging a flat fee not to exceed $6.50 is therefore an option for entities that do not want to go through the process of calculating actual or average allowable costs for requests for electronic copies of PHI.
Practices must compare the OCR requirements for reimbursement with their individual state requirements. HIPAA laws override state laws that allow charging different or higher fees, but state laws trump HIPAA when they provide individuals with greater rights of access to their health information than the HIPAA Privacy Rule does. For example, state laws take precedence if they: (1) prohibit fees to be charged to provide individuals with copies of their PHI; or (2) allow only lesser fees than what the Privacy Rule would allow to be charged for copies.
Finally, HIPAA requires that covered entities not charge fees for access to PHI where the financial situation of an individual requesting access would make it difficult or impossible for the individual to afford the fee.