HIPAA and the Right to Access

 

The Right to Access

 

Healthcare providers are frequently unsure how to handle an access to protected health information (PHI) request, that cites HITECH and the right of a patient to access a copy of their records electronically at a reasonable fee.   While its common to deal with authorizations to disclose copies of the designated record set, the access requests weren’t received on a regular basis until recently.

Delivering Records

When a covered entity is capable of readily producing records in an electronic format it must do so. If it is unable, it must deliver in a format mutually agreed upon by the parties within the 30-day deadline. There is an exception that permits an extension if the paper records must be retrieved from storage.

The right of a patient to access their records in an electronic format, or to direct a that a copy is provided to a third party remains a problem area.  The access request must be in writing and signed by the patient.  It does not require an additional authorization.  A third party, at the patient request may send the access request on their behalf and it must be complied with in the same manner as if personally requested by the patient.

Permissible Fees

The permissible fee for the records produced for an access request is limited to the cost to cover: labor for copying the PHI requested, whether in paper or electronic form; supplies for creating the paper or electronic copy; and postage. State fees that exceed this amount cannot be charged for access requests.

When a third-party submits a request for records on its own behalf with an authorization and cites HITECH fees as the highest that may be charged, they are in error.  The access fee limits don’t apply.

Guidance from OCR

SaveSave

SaveSave

SaveSave

SaveSave

SaveSave

SaveSave

SaveSave

SaveSave

SaveSave