Under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, a patient has a right to request a copy of protected health information (PHI) from a healthcare provider that qualifies as a covered entity and provides medical care to the patient. The covered entity may also provide an explanation or summary of PHI, upon agreement of the patient. The covered entity may charge the patient a fee for copying the PHI. However, the fee must be both reasonable and cost based. The fee may include costs for the following (i) staff labor for paper or electronic copying or to prepare an explanation or summary of the patient’s PHI upon request; (ii) office supplies and media devices for creating the paper or electronic copies; and (iii) postage for the delivery of copies and summaries. HIPAA does not allow a covered entity to charge a standard search or retrieval fee for the provision of paper or electronic copies of PHI to a patient, even if such fee covers actual retrieval costs. These limitations may create a conflict with state law and may trip up an unwitting provider who believes in good faith that it is charging a patient appropriately.
A covered entity must follow state law when setting copy fees. However under HIPAA’s preemption rules, if HIPAA is stricter than state law, i.e., more protective of a patient’s privacy rights, then HIPAA controls. Many states set limitations on standard fees, labor costs and reasonable per-page fees that a healthcare provider may charge a patient for providing the patient with a copy of his or her medical records. These standard fees sometimes include a provision for a search and retrieval fee, but under HIPAA a covered entity may not charge a search or retrieval fee to a patient. Thus, any such fee should be removed from an invoice or other statement provided to a patient in connection with the fulfillment of an access request and should not be collected from a patient. Similarly, the Department of Health and Human Services (HHS) utilizes state law limits to define a reasonable fee under HIPAA, but under HIPAA a covered entity must charge a fee that is also cost based, thereby limiting the total allowable charge.
HHS interprets labor costs to include time spent by skilled technical staff to create and distribute electronic PHI files through compilation, extraction, scanning and the burning of PHI to media devices. Media devices include CDs and USB flash drives. Covered entities are not required to invest in new technologies or maintain data storage infrastructure just to comply with a patient’s request. Thus, covered entities must not pass on the costs of any new technology or data storage infrastructure to their patients.
The following illustrates the application of HIPAA’s limitation on fees that may be charged to a patient in connection with the fulfillment of the patient’s access request: State A imposes a search fee of $10, a ten cent-per-page fee limitation and a labor fee up to $20 for copies of medical records.
- The covered entity should not charge the patient a search fee of $10, allowed by State A, as HIPAA prohibits a covered entity from charging a standard search or retrieval fee for the provision of a patient’s PHI.
- All page rates charged by a covered entity in State A from one to ten cents per page would be reasonable under HIPAA, and any rate over ten cents per page would be unreasonable. However, a copy fee must also be cost based. Thus, if the cost of copying PHI by a covered entity in State A is five cents per page, and yet a covered entity charges ten cents per page in accordance with the limits of the law of State A, it will run afoul of HIPAA. While both rates are reasonable, a covered entity may charge up to only five cents per page because it can recover only the actual cost of providing such copies.
- State A’s $20 limitation on the labor fee will be the ceiling for what HHS considers reasonable (i.e., if labor costs exceed the $20 limitation, only $20 may be charged). However, under HIPAA a covered entity may charge only an amount, up to the State A limit of $20, that reflects the actual labor costs to the covered entity for the copying of the medical records. Finally, the labor costs must also not take into account any time spent on searching for or the retrieval of the medical records.
If you have any questions regarding HIPAA restrictions or state law limitations on copy fees, please contact one of the authors.