HIPAA copy charges for medical records

Healthcare Financial Management, Dec, 2003 by Rose T. Dunn

When patients request a copy of their medical record, how much do you charge? And how do you itemize that expense? Do you have clear-cut policies about how to charge? An often overlooked element in the HIPAA Standards for Privacy of Individually Identifiable Health Information concerns how much an entity may charge patients or their designated representative for a copy of their medical record.

The HIPAA privacy standards section 164.524 (c)(4) states the following about charging patients for copies of their medical records:

Fees: If the individual requests a copy of the protected health information or agrees to a summary or explanation of such information, the covered entity may impose a reasonable, cost-based fee provided that fee includes only the cost of:

(i) Copying, including the cost of supplies for and labor of copying, the protected health information requested by the individual;

(ii) Postage, when the individual has requested the copy, of the summary or explanation, he mailed; and

(iii) Preparing an explanation or summary....

The preamble to HIPAA privacy standards section 164.524 (c)--Provision of Access further states:

   We clarify this provision in the final rule. If the individual
   requests a copy protected health information, a covered entity may
   charge a reasonable, cost-based lee for the copying, including the
   labor and supply costs of copying. If hard copies are made, this
   would include the cost of paper. If electronic copies are made to a
   computer disk, this would include the cost of the computer disk.
   Covered entities may not charge any fees for retrieving or handling
   the information or for processing the request. If the individual
   requests the information to be mailed, the fee may include the cost
   of postage. Fees for copying and postage provided under state law,
   but not for other costs excluded under this rule, are presumed
   reasonable. If such per page costs include the cost of retrieving
   of handling the information, such costs are not acceptable under
   this rule (emphasis added).

Providers should familiarize themselves with the HIPAA mandate and establish a clear-cut policy for medical-record copy charges.

What Can and Cannot Be Charged?

In addition to paying for copies of the medical record, patients who request a summary of their record must agree in advance to pay the cost of such a summary. Therefore, many of the activities listed in the sidebar above will occur, and providers should determine which activities can be charged and which cannot. Also, a qualified individual needs to review and summarize the record.

Alternatively, the organization could consider these options:

* Establish an appointment schedule to have a health information professional, the attending physicians, and/or another healthcare professional review and explain the contents of the record to the patient

* Define the "summary" as including certain designated documents such as transcribed or typed documents in the patient record

An hourly rate could be established for the first option, shared with the patient or patient's representative, and accepted by the patient before any effort begins. For the second option, the health information management (HIM) department could determine an average charge for these types of reports in a medical record of different stay increments, such as 1-5 days, 6-10 days, 11-20 days, 21-40 days, and more than 40 days. The charge would vary by length of stay. These are just two options; the healthcare organization's privacy committee may have considered others.

HIPAA Preempts Many State Laws

Although the preamble to the HIPAA privacy standards indicates that the per-page copy fees established by the states will be "presumed" reasonable, some experts believe that this will be a point of contention with plaintiff attorneys nationwide. Many state-mandated copy fees are higher than the costs involved in the single activity of copying and, therefore, could be preempted by the HIPAA regulations. Preemption is intended to protect patients' right to privacy and to allow patients greater access to their protected health information.

Given these criteria, the state-mandated fees could be more costly than the labor needed to make copies, possibly making patients' access to their protected health information cost-prohibitive. As a result, HIPAA may open a quagmire whereby state fees are preempted by the lower "reasonable" cost to make the copies. Note that this mandate applies only to copies requested by individuals or their designated representatives. Other requesters, such as insurers and attorneys, can continue to be charged the state-mandated fee.

Some state-mandated fees consist of a relatively substantial retrieval or handling charge ($10-$20) plus a per-page copy fee ($0.25-$1.00). Every state varies. Clearly, the HIPAA privacy standards preamble bars any covered entity from charging individuals the "retrieval or handling lee."

Negotiating with a Copy Service

Healthcare organizations that use a copy service should be aware that copy services nationwide are gearing up to propose modifications to their current contracts with clients to reflect the impact of HIPAA's mandate related to charging for copies. In states where patients can be charged for copies, providers may encounter requests for copy-service contract modifications such as these: