Complying with Medical Record Requests

Executive Summary

Under HIPAA, patients have the right to request and receive copies of their medical records. However, healthcare providers need to understand the requirements that govern medical record requests, including fees they can charge, and how they can hand off those records to ensure HIPAA compliance and avoid financial penalties.

Recommended Actions 

• Ensure that your practice has a policy regarding how and when you can charge patients for producing copies of their medical records. 
• Produce this policy for patients and keep copies of it in highly visible areas of your office. 
• Ensure that all staff members understand and are trained according to the policy.

The Health Insurance Portability and Accountability Act (HIPAA) and state law impose limits on what healthcare organizations can charge for providing patients (or their personal representatives) with copies of their medical records. The medical record production fees an organization may charge depend on the state in which the organization is located, the format in which the records are stored and the form in which the patient requests the medical records to be delivered.

If a healthcare organization decides to charge patients for copies of their medical records, MagMutual recommends that the organization inform the patient in advance of the approximate fee per copy. If a patient is unable to pay the medical record production fee, MagMutual recommends that the organization provide the first copy of the medical records to the patient for free. If the requesting patient has an outstanding balance with the organization, the organization cannot withhold a copy of the records until the patient pays the outstanding balance.

Allowable Charges for Copies of Medical Records 

According to the Office of Civil Rights (OCR), a significant percentage of OCR investigations involve determining whether a healthcare organization’s medical record production fees were “reasonable.” Based on MagMutual’s experience advising policyholders on medical record fee disputes with patients, we have developed this chart with medical record production fees we believe to be reasonable and consistent with HIPAA and state law based on our review of OCR investigations and settlements. The fees listed in the chart may not be the maximum allowable fees in each state but are fees we believe will reduce the likelihood of a patient filing a complaint with OCR.
 
ALABAMA Ala. Code § 12-21-6.1
For electronically maintained records delivered in electronic or paper format:
flat rate of $6.50 (which includes all labor, supplies, and postage)
For paper records delivered in paper or electronic format:
$0.50 per page + actual cost of postage
 
FLORIDA Fla. Admin. Code Rule 64B8-10.003
For electronically maintained records delivered in electronic or paper format:
flat rate of $6.50 (which includes all labor, supplies, and postage)
For paper records delivered in paper or electronic format:
$0.25 per page + actual cost of postage
 
GEORGIA Ga. Code Ann. § 31-33-3
For electronically maintained records delivered in electronic or paper format:
flat rate of $6.50 (which includes all labor, supplies, and postage)
For paper records delivered in paper or electronic format:
$0.66 per page + actual cost of postage
 
ILLINOIS 735 Ill. Comp. Stat. § 5/8-2001
For electronically maintained records delivered in electronic or paper format:
flat rate of $6.50 (which includes all labor, supplies, and postage)
For paper records delivered in paper or electronic format:
$0.25 per page + actual cost of postage          
 
KENTUCKY Ky. Rev. Stat. Ann. § 422.317
For electronically maintained records delivered in electronic or paper format:
first copy free to patient; after first copy, flat rate of $6.50 (which includes all labor, supplies, and postage)
For paper records delivered in paper or electronic format:
first copy free to patient; after first copy, $1.00 per page + actual cost of postage   
 
NORTH CAROLINA N.C. Gen. Stat. § 90-411
For electronically maintained records delivered in electronic or paper format:
flat rate of $6.50 (which includes all labor, supplies, and postage)
For paper records delivered in paper or electronic format:
$0.25 per page + actual cost of postage          
 
SOUTH CAROLINA S.C. Code Ann. § 44-115-80
For electronically maintained records delivered in electronic or paper format:
flat rate of $6.50 (which includes all labor, supplies, and postage)
For paper records delivered in paper or electronic format:
$0.50 per page + actual cost of postage (total may not exceed $150.00)
 
TENNESSEE Tenn. Code Ann. § 63-2-102
For electronically maintained records delivered in electronic or paper format:
flat rate of $6.50 (which includes all labor, supplies, and postage)
For paper records delivered in paper or electronic format:
$0.50 per page + actual cost of postage 
 
VIRGINIA Va. Code Ann. § 8.01-413
For electronically maintained records delivered in electronic or paper format:
flat rate of $6.50 (which includes all labor, supplies, and postage)
For paper records delivered in paper or electronic format:
$0.25 per page + actual cost of postage (total may not exceed $150.00)
 
WEST VIRGINIA W. Va. Code Ann. § 16-29-2
For electronically maintained records delivered in electronic or paper format:
flat rate of $6.50 (which includes all labor, supplies, and postage)
For paper records delivered in paper or electronic format:
$0.20 per page + actual cost of postage (total may not exceed $150.00)

Lessons Learned

• Stay up to date on any changes to the laws regulating allowable fee amounts for producing medical records in your state.
• Keep HIPAA in mind when sending medical records and choose a HIPAA-compliant mailing or emailing service.
• Inform patients about how they can request records from your practice. We recommend making record requests written to document the date of the patient’s request.

Potential Damages

If a healthcare organization charges a patient too much for producing copies of their medical records or transmits the records inappropriately, the organization could be in violation of HIPAA and thus face defending an OCR investigation.