Complying with Medical Record Requests

Executive Summary

Under HIPAA, patients have the right to request and receive copies of their medical records. However, healthcare providers need to understand the requirements that govern medical record requests, including fees they can charge, and how they can hand off those records to ensure HIPAA compliance and avoid financial penalties.

Recommended Actions 

• Ensure that your practice has a policy regarding how and when you can charge patients for producing copies of their medical records. 
• Produce this policy for patients and keep copies of it in highly visible areas of your office. 
• Ensure that all staff members understand and are trained according to the policy.

The Health Insurance Portability and Accountability Act (HIPAA) and state law impose limits on what healthcare organizations can charge for providing patients (or their personal representatives) with copies of their medical records. The medical record production fees an organization may charge depend on the state in which the organization is located, the format in which the records are stored and the form in which the patient requests the medical records to be delivered.

If a healthcare organization decides to charge patients for copies of their medical records, MagMutual recommends that the organization inform the patient in advance of the approximate fee per copy. If a patient is unable to pay the medical record production fee, MagMutual recommends that the organization provide the first copy of the medical records to the patient for free. If the requesting patient has an outstanding balance with the organization, the organization cannot withhold a copy of the records until the patient pays the outstanding balance.

Allowable Charges for Copies of Medical Records 

According to the Office of Civil Rights (OCR), a significant percentage of OCR investigations involve determining whether a healthcare organization’s medical record production fees were “reasonable.” Based on MagMutual’s experience advising policyholders on medical record fee disputes with patients, we have developed this chart with medical record production fees we believe to be reasonable and consistent with HIPAA and state law based on our review of OCR investigations and settlements. The fees listed in the chart may not be the maximum allowable fees in each state but are fees we believe will reduce the likelihood of a patient filing a complaint with OCR.

For electronic copies of records maintained in electronic format

For electronic copies of PHI maintained electronically, fees for records may not exceed $6.50, inclusive of all labor, supplies and any applicable postage, according to U.S. Department of Health and Human Services guidelines. Charging a flat fee not to exceed $6.50 is therefore an option for entities that do not want to go through the process of calculating actual or average allowable costs for requests for electronic copies of PHI maintained electronically.

For all other records, by state

States are permitted to charge reasonable, cost-based fees for all other types of records: paper records delivered electronically, electronic records delivered on paper, and paper records delivered on paper. Postage may be charged at actual cost. Guidance for individual states is as follows:

ALABAMA Ala. Code §12-21-6.1
$1.00 per page for the first 25 pages, $0.50 for each page in excess of 25, $5 search fee
 
FLORIDA Fla. Admin. Code Rule 64B8-10.003
$1.00 per page for the first 25 pages, $0.25 for each page in excess of 25
 
GEORGIA Ga. Code Ann. §31-33-3
$0.66 for each page in excess of 100
 
ILLINOIS 735 Ill. Comp. Stat. §5/8-2001
$1.30 per page for the first 25 pages, $0.87 each for pages 26-50, $0.43 for each page in excess of 50. For electronic records retrieved from a scanning, digital imaging, electronic information or other digital format in an electronic document, 50% of the per page charge listed above.      

KENTUCKY Ky. Rev. Stat. Ann. §422.317
First copy free to patient; after first copy, $1.00 per page

NORTH CAROLINA N.C. Gen. Stat. §90-411
$0.75 per page for the first 25 pages, $0.50 each for pages 26-100, $0.25 for each page in excess of 100. Healthcare provider may impose a minimum fee of $10 inclusive of copying costs.
 
SOUTH CAROLINA S.C. Code Ann. §44-115-80
$0.83 per page for the first 30 pages, $0.63 for each page in excess of 30, plus a clerical fee of $32.06. The cost of paper copies may not exceed $256.58. The cost of electronic records may not exceed $192.44.
 
TENNESSEE Tenn. Code Ann. §63-2-102
$25.00 for paper copies of medical records 5 pages or less in length; $0.50 cents for each page in excess of 5.
 
VIRGINIA Va. Code Ann. §8.01-413
When records are produced in paper or hard copy format from records maintained in paper or electronic storage, the charge is not to exceed $0.50 cents per page for up to 50 pages and $0.25 cents per page thereafter, with a fee for search and handling not to exceed $20. When records are produced in electronic format from records maintained in electronic storage, the fee is not to exceed $0.37 cents per page for the first 50 pages and $0.18 per page thereafter, with a fee for search and handling not to exceed $20. Fees shall not exceed $160 plus reasonable costs to produce an audit trail of the health records if requested.

WEST VIRGINIA Va. Code Ann. §16-29-2
Paper records: $0.40 per page, search and handling fee of $20. Electronic records: unless the person requesting the records specifically requests a paper copy, the records will be delivered in electronic or digital form and the per page fee for providing an electronic copy shall not exceed $0.20 cents per page, but shall in no event exceed $150 inclusive of all fees, including a search and handling fee. 

Lessons Learned

• Stay up to date on any changes to the laws regulating allowable fee amounts for producing medical records in your state.
• Keep HIPAA in mind when sending medical records and choose a HIPAA-compliant mailing or emailing service.
• Inform patients about how they can request records from your practice. We recommend making record requests written to document the date of the patient’s request.

Potential Damages

If a healthcare organization charges a patient too much for producing copies of their medical records or transmits the records inappropriately, the organization could be in violation of HIPAA and thus face defending an OCR investigation.