Following our recent article on the HITECH Act, we have received lots of questions about the federal HITECH Act and how it applies in Washington State for healthcare providers responding to patient requests for electronic records.
Since the HITECH Act was implemented in 2010, there has been widespread public uncertainty about how to implement it. The U.S. Department for Health and Human Services (DHHS) has worked several times to clear up key pieces of the law, but unfortunately this has sometimes to lead to more confusion, not less.[1] Our article last month may have raised further questions. We are here to clarify.
We understand and share the frustration felt by many healthcare professionals and their administrators regarding the rule changes in responding to records requests directly from a patient. Please understand that we did not create the law and are only delivering the message. In other words, “Don’t shoot the messenger!”
First, here are a few key principles:
- HITECH only applies to records requests from a patient, when the request comes from the patient directly and is in writing;
- HITECH does apply when the patient requests that their medical records be sent to a designated representative, including the patient’s attorney;
- HITECH does not apply when an attorney requests the patient’s medical records;
- When the request is in writing from the patient, the healthcare professional must comply with HITECH and its rules
- When the request is from any other source, HITECH does not apply, and the healthcare professional can charge under state law and its rules, including the previously standard handling fee and per-page charge.
Here are the questions we have received and our responses:
- I have a request from a patient asking for a copy of their records in electronic format. Can I charge the patient a handling fee and per-page copy fee?
No. The HITECH Act is a federal law, and federal law preempts state law. The HITECH Act states that you can charge a flat fee of $6.50. Alternatively, a provider can charge a “reasonable, cost-based fee” for producing electronic records when it is requested directly from the patient. That means the labor cost to you of producing records, which would be your labor cost to put the records onto a CD, plus postage.
In our answer to the question below, we give an example of what the costs look like, and why many providers are using the $6.50 flat fee charge and not working with the alternative.
- The patient requested electronic records, so I scanned the paper records and put them on a CD. What can I charge for this?
Whether you have to scan paper records into an electronic version, or drag and drop already-electronic records onto a disc, you may only charge the patient a flat fee of $6.50. HITECH does give you a second option, which is to charge a “reasonable, cost-based fee” instead of the $6.50, for the actual labor cost to produce the electronic records. This would involve the labor-related cost to your business in scanning the paper record, uploading the record to a cloud-based system, or time spent creating and sending out a CD. For example, if you pay someone on your staff $20.00 an hour to process records requests and they spend 10 minutes on the request, the labor cost to you is $3.33. Then, you can add on the cost of the CD, which is about .20 cents,[2] and postage.
However, if you intend to charge something other than the flat fee, you must disclose those charges to the patient before sending the records. That is why most providers are choosing to charge the flat $6.50 fee for all requests, as it is simpler and more cost-effective to have one unified procedure for all requests. [3]
- The patient letter also asked for a verification that I have produced all the records. Can I charge the State administrative fee for preparing that?
No. The HITECH Act does not allow a provider to charge for the verification of the patient’s electronic record. DHHS has expressly stated that a provider cannot charge and administrative fee to verify the patient record.
- I don’t keep my records in electronic form, so I can charge the old state per-page and handling fees, right?
Here is another answer you will not like: no. The HITECH Act requires you to comply with a request for records in electronic format if it is readily producible electronically. That means you must scan the paper records (typically into .pdf form) and transfer them onto a CD or flash drive.
If you have absolutely no ability to produce the records in any kind of electronic format, then (and only then) can you provide the patient with a hard copy of the record. Even in that case, you still must comply with HITECH in how you charge the patient. You cannot charge the handling and per-page fee allowed under state law. You may only charge for your actual labor costs and the cost of supplies.
- I have seen this patient for quite some time and have both paper records and electronic records. Can I charge the patient a handling fee and per-page copy fee for copying the paper records?
No. Under the HITECH Act, the patient has a broad right to all records maintained by the provider, and the provider must scan any paper records into electronic format at the patient’s request. You cannot charge a per page fee to scan your paper records. Nor can you make copies of the paper records if you are able to scan those records as a .pdf.
- I got a letter from the patient asking for their records in electronic format, but what do I do about x-ray films? I can’t scan those.
In this situation, it would be acceptable to charge the client the cost to you of reproducing the films and putting them onto a CD because the Act states that the records be “readily producible” in the manner requested.
Our “best practices” recommendation is to get a quote for this cost from a vendor and then advise the patient of the cost and get their approval before you proceed.
- The patient (and not the patient’s attorney) sent me a letter asking for their records in electronic format, but there is no HIPAA form. Do I have to comply?
Yes. When you receive a letter signed by the patient asking for records, the patient’s signature serves as the authorization. No HIPAA release is required.
- I outsource all of my records requests so I don’t have to deal with this issue. I can charge the patient for the cost to me for the third party vendor to copy the records, right?
No. HITECH does not allow you to pass the costs of a third party vendor to copy/scan records on to your patient.
- I received a letter signed by the patient asking that I send the electronic record to his/her attorney. Is this legal?
This is indeed legal. A provider must send the records to wherever the patient designates, even your patient’s attorney. However, the patient’s request must be in writing and signed by the patient.
- My patient wants me to email her electronic records directly to her attorney, but I am worried this is not secure. What if the data is breached or hacked? Am I responsible?
You are not responsible for disclosure of information while in transmission to the person or entity requested by the patient. You are also not responsible for safeguarding the information once it is delivered. However, you are responsible if you type in the wrong email address when transmitting the information.
- What is the deadline to respond to a request for electronic records?
You have 30 days to comply with the request. If you cannot comply within this time period, you have another 30 days, but must notify the patient of the reason for the delay within the initial 30 days.
All health care providers should anticipate that attorneys and their clients will be requesting electronic records per the HITECH ACT.
If the information in this article does not answer your questions, then email us at [email protected]. We welcome other questions and will continue to share our information with the health care community.
[1] DHHS has added and modified their FAQ page several times this year, most recently in May of this year. See: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html
[2] You can get a 100 pack of CDs on Amazon for less than $20.00 or .20 cents per CD.
[3] Beware, as an ominous opinion from DHHS is that as technology advances, the labor costs to the provider for complying with a request should dwindle down to nothing.
