The Right to Access to PHI

Doctor Sharing PHI with Patient
Doctor showing diagnosis

The Right to Access

Healthcare providers are frequently unsure how to handle an access to protected health information (PHI) request, that cites HITECH and the right of a patient to access a copy of their records electronically at a reasonable fee.   However, while its common to deal with authorizations to disclose copies of the designated record set, the access requests weren’t received on a regular basis until recently.

Delivering Records

When a covered entity is capable of readily producing records in an electronic format it must do so. On the other hand, if it is unable, it must deliver in a format mutually agreed upon by the parties within the 30-day deadline. In addition, if the paper records are retrieved from storage there is an exception that permits an extension.

Firstly, patients have the right to access protected health information in an electronic format, or to direct that a copy will be provided to a third party as long as the choice is clear, conspicuous and specific.  Most importantly, the access request must be in writing and signed by the patient.  It does not require an additional authorization.  Finally, a third party, at the patient’s request may send the access request on their behalf and it must comply in the same manner as if patient requests the records in person.

Permissible Fees for Sharing Patient Records

Above all, there are limits on permissible fee for records. An access request covers cost of: labor for copying the PHI requested, whether in paper or electronic form; supplies for creating the paper or electronic copy; and postage. Meanwhile organizations cannot charge state fees for access that exceed this amount .

When a third-party submits a request for sharing patient records on its own behalf with an authorization and cites HITECH fees as the highest charged, they are in error.  Most importantly, the access fee limits don’t apply.

Guidance from OCR