Fighting a Double Standard for Access to Electronic Medical Records

In Pennsylvania, health care providers typically charge $1.39 per page for paper copies of the first 20 pages of a medical record, $1.03 for pages 21-60, and $.34 for every page thereafter.  42 Pa. C.S. 6152.1. The total bill for even a single health care provider or hospital admission adds up fast and regularly amounts to hundreds of dollars.  Our office pays the fees to obtain medical records on behalf of our clients.  The cost is eventually deducted from any recovery made on the client’s behalf.  With many medical malpractice cases involving devastating injuries and lengthy hospital admissions, the total cost of obtaining medical records in a single case is often thousands of dollars.

In 2009, Congress passed the Health Information Technology for Economic and Clinical Health Act (HITECH Act) as part of the American Recovery and Reinvestment Act.  Like the HIPAA Act before it, the HITECH Act addresses the privacy and security of individual health care information, but with an additional focus on the increasing transition to the use of electronic medical records.  Pursuant to federal regulations implementing the HITECH Act, an individual is entitled to obtain a copy of any portion of their medical record created and stored in an electronic medical record system.  Unlike the traditional fees for producing paper copies of medical records, the regulations provide that the fees charged by a health care provider for producing the electronic medical record must not exceed the cost of supplies and labor necessary to copy the record.

In reaction to the HITECH Act, many hospitals and health systems have transformed their procedures for responding to requests for medical records from individuals and their attorneys. Some facilities are now capable of producing hundreds if not thousands of pages of medical records on a single compact disc.  The transition to production of the medical record in an electronic format is creating significant cost savings for clients.  Consistent with the HITECH regulations which establish cost-based limits on fees for producing medical records, many large health care providers no longer charge the multi-tiered, “per-page” rates for producing electronic medical records. Instead, many hospitals now charge a flat, “per-page” rate for copying the electronic medical record to a CD.  The flat rate is substantially lower than the per page rates charged for producing a paper record.  And this is no surprise.  To click a mouse a few times and copy computer files to a compact disc requires minimal supplies and labor at best.  Pursuant to the HITECH Act, the cost of such labor should be small and uniform, much unlike the multi-tiered rates charged for paper copies of the medical record..

In spite of the HITECH regulations, at least one hospital, and probably others as well, still charges excessive rates for copying electronic medical records to a CD.  Our office recently requested a copy of the electronic medical record of treatment provided to a client’s deceased father at Butler Memorial Hospital in Butler, Pennsylvania.  We specified in writing that we wanted the records in an electronic format.  We also cited the regulations of the HITECH Act which limit the fees health care providers can charge for producing the electronic medical record.  After a few days we received a prepayment notice requesting $278.61 in exchange for paper copies of the 538-page electronic medical record.   Perplexed, we called the hospital to confirm the records requested were maintained electronically and therefore available on CD at a substantially lower fee.  The hospital confirmed the records were available on CD, but claimed that only the patient (deceased in this case), not the attorney,  is entitled to receive an electronic copy of the record for a reasonable, cost-based fee.    Further, we learned the hospital’s standard fee for copying the patient’s electronic record to CD was anything but reasonable or based on the cost of supplies or labor.  The hospital intended to charge our client multi-tiered fees nearly the same as those traditionally charged for production of paper records.

In a letter to the hospital dated May 24, 2012 (see link to letter and other relevant documents below), we pointed out that the regulations implementing the HITECH Act permit the “disclosure” of protected health information pursuant to and in compliance with a valid authorization.  Incidentally, we had already provided the hospital with a valid authorization signed by the patient’s next of kin.  Our letter also explained that “disclosure” is defined broadly under the HITECH Act to include “the release, transfer, provision of, access to, or divulging in any other manner of information outside the entity holding the information”.  So, since “disclosure” includes “access to” information and the hospital must permit “disclosure” of protected health information pursuant to a valid authorization, we argued that our clients had a right of access to their father’s electronic medical record pursuant to their valid authorization, irrespective of who submitted the authorization on the clients’ behalf.

Next, we reminded the hospital that the fees for “access to” a copy of the electronic medical record are well established.  Not coincidentally, the federal regulation setting the limit on what a health care provider can charge to produce the electronic medical record is titled “Access of Individuals to protected health information”. 45 C.F.R. § 164.524. Subsection (a) of the same regulation is titled Standard: Access to protected health information.  As its title implies, this regulation establishes a limit on fees for “access to” the electronic medical record, access which we argue is permitted pursuant to a valid authorization and irrespective of whether the request is submitted by the patient, their next of kin, or, as in this case, an attorney on behalf of the patient’s next of kin.  Thus, we pointed out that a patient’s right to access a copy of their electronic protected health information is (1) put in motion through the valid authorization we provided, and (2) available for a reasonable, cost-based fee pursuant to the regulation governing “access to” protected health information.

Not long after sending the letter explaining our client’s rights under the HITECH Act, we received a revised prepayment notice.  The total charge for copying 538 pages of the electronic medical record to a CD, at .07 cents per page, was $54.47.  The charges represented a savings of $224.14 from the cost of producing a copy of the paper record.  The message to the hospital was received.

A hospital that maintains patient’s medical records in an electronic medical record system must produce the record in an electronic format upon request and a valid authorization.  Moreover, and irrespective of whether the request originates from the patient, their next of kin, a representative of the patient’s estate, or an attorney on behalf of any of these individuals, the hospital can only charge a reasonable, cost-based fee related to the cost of supplies or labor necessary to respond to the request.   If the hospital charges you a multi-tiered, per-page rate for a CD containing the electronic medical record, it’s ignoring its obligations under federal law.  And, you’re paying too much money for access to your protected health information.

You may click on the link below to see our form letter requesting a copy of the electronic medical record, in an electronic format, for a fee limited to the cost of labor necessary to produce such record.  You will also find correspondence which chronicles the events described above, including the prepayment notice we received which finally reflected a reasonable, cost-based fee for production of the electronic medical record in an electronic format.

Correspondence re – request for records

All articles in this blog are the collaborative effort of attorneys Jerry Meyers, Brendan Lupetin, and Gregory Unatin.

12 thoughts on “Fighting a Double Standard for Access to Electronic Medical Records

  1. During your efforts to obtain the information you described in this article, were you able to get any sort of quantification regarding the actual time/labor involved in producing a digital copy, for either a single record or image or for the aggregate? I am trying to ascertain how a provider determines what to charge.

    1. I have not been successful in establishing the basis of the charges for furnishing copies of electronic records in electronic format. We have however been very successful at dramatically reducing the cost of obtaining medical records. We have received thousands of pages of records for less than $100 at some institutions. Nevertheless, a continuous battle is fought to obtain records. Some institutions are again resorting to farming the work out to agencies. Under the HITECH Act such agencies are business associates who operate under the same restrictions that apply to health care providers.

      We have filed formal complaints with the Dept. of Health and Human Services Office of Civil Rights. As yet none of these complaints have been acted upon though pending for many months.

      1. I work in Release of Information at a large hospital. I came across this article because I am struggling to develop a reasonable cost based rate for providing electronic copies.

        As a professional in this field I strongly object to the statement that it takes a few clicks of the mouse to copy a record to a disc. I get this statement from attorneys in my area and it is simply not true. Many medical record systems were not set up originally to provide electronic copies and very labor intensive “work arounds” have to be utilized. I have personally spent upwards of 8 hours copying one record to a disc. Due to the method that has to be used I cannot use my computer for anything else during this process and I can not leave it unattended.

        Also there is no set rate for labor or time tested estimates of how long it should take to copy a record. Attorneys are accustomed to billing an hourly fee but our customers are not willing to find out how much it costs after the fact so the many professionals in this area are struggling to establish a fair copy fee for what is for many a new process.

        Also in the previous comment the poster stated that facilities are resorting to out sourcing to get around this requirement. Outsourcing Release of Information has been the standard at most facilities for numerous years. To my knowledge I am the only full time Release of Information manager in my state at this time. I am told by the largest vendor that I am the only large facilty in my city that does not outsource. I have a staff of 5.5 FTEs and we struggle every day to get the many various types of requests completed on time. Included in that is a lot of ongoing training in the changes in Release of Information law. If we are required to reduce payments then we will be required to reduce staff as well and increase the amount of time it takes to respond to requests. Or outsource…

        Maybe you could have an intellegent conversation with one of the Health Information Professionals in your area before you assume “facts” that are not true.

        1. Your hospital undoubtedly financially benefits from its provision of “meaningful use” electronic medical records. Years ago you were forewarned that the Department of Health and Human Services preferred records to be provided in electronic format. Instead of using some of the financial rewards your hospital has received throughout the years to upgrade your software or IT personnel to facilitate provisions of requested record copy in electronic format they have apparently left the matter to you. I suggest you consult your software provider. I assure you that a module is available that would permit you to comply the law without burden. You seem to have forgotten that electronic medical records aren’t just for healthcare providers; they are records which belong uniquely to the individual recipient of health care. If it takes you hours to respond to a single request it’s important that you realize that time you are consuming is wasted and easily remedied through education and investment software. Angry remarks do not serve your patients well. They also demonstrate that you do not understand the spirit of HIPAA and the requirements of the HITECH act. If you think I am wrong, before responding further I suggest you contact your office of civil rights at the Department of Health and Human Services in your region to learn what your responsibilities are rather than finding your health system in blatant violation of compliance rules.

  2. I’am from Jackson,miss and work in the medical field. Our clinic is small but we send out medical records a lot I would like to know my options on sending out medical records since we do not at this time able to make disc. I’ve only recieved one request concerning medical records with HItech implications. please give me some ideas before Hitech is fully in place

    1. The HITECH act is up and running. The final rule as to the regulations governing enforcement has been in effect since the summer of last year. You therefore need to be concerned about compliance. There is a difference between not knowing how to do a thing on the one hand, and being unable to do a thing on the other. You should inquire of your software provider as to what you need to do in order to provide records in the requested format. You also need to remember that record copying companies are business Associates under the act. It is your responsibility to assure their compliance by seeing to it you have a contract with them that alerts them to their responsibilities under the act.

  3. “we pointed out that the regulations implementing the HITECH Act permit the “disclosure” of protected health information pursuant to and in compliance with a valid authorization. ”

    Do you have an example of the the valid authorization that you use?

  4. What are your thoughs on release of radiology imaging?

    I had a lawyer screaching at me today saying “It’s HITECH, but I’m sure you know that. You can’t charge the patient a penny – not a penny!!”

    So a-searching I did go.

    Our Release of Information department is closing in on a hospital policy governing costs, etc., but I’m sure Radiology will be left out, as it often is.

    We used to go through a contracted ROI company. The arrangement was tat we didn’t reocoup any costs (which were minimal on our end) but we also didn’t ahve to deal with 2 calls per day per patient from Records Retrieval Companies and the like, not to mention the tedium that goes along with digitizing film.

    However, after we were digital for a couple of years they dropped us. I imagine it was because we were no longer a lucrative source, but we never did get a straight answer.

    For about 3 years, while we waited on Management to make some decisionsa bout fee structures, we gave imaging away for free. Ooooh, and didn’t the law offices and record collection agencies take advantage. No charge = everything ever for all time. Car accident that fractured the patient’s wrist? Why YES we need the that Ultrasound from when their 34 year old was a fetus!

    Many of our patients have been our patients for decades, and we’ve held their imaging, despite much of it being eligible for destruction. Because it’s useful for patient care.

    Depending on the patient”Any and all” can take me several hours into days to catalog the entire image record, build accessions to attach images to in the system, and then digitize all of it. This is all before “click click burn” even happens.

    And then there are the endless Certifications where I must super-swear, under penalty of purgery, that it is a true and complete record. Certianly I’m expected to be thorough – and that takes time. If I could be slapdash about it then it wouldn’t take so long but I’m sure that’s not the goal either.

    The frustrating thing is that people keep talking about charging “per disc.”

    3 decades worth of analog digitization can fit on 1 CD, but production is extremely labor intenstive – like I said, hours into days.

    But if I made copies of the last 6 CTs a patient has had over the last two years, I can burn, review, and package in about 5 minutes per CT, but it might spread out over 6-15 discs, depending on the size of the scan.

    We charge per exam. It’s practically nothing for the new stuff, but if you want me to grub around archives for ancient studies those cost more, because they COST MORE. It’s not a money maker, trust me. We’re so worried about being in compliance we are lowballing what our actual labor investment is.

    There is more to producing an accurate copy of what a patient has *authorized* us to release (key point there.) You’ll have to trust me on this. I’m pretty sure there is more to lawyering than blabbing it up in front of a judge. I’ve never done the job but I’ll trust you on it.

    1. The Hitech Act applies to all healthcare providers who store patient information in electronic format, however briefly. If it is obtained and stored in that format you don’t avoid the consequences of law by simply making an analog copy and deleting the digital data.

      When you were contracting through an ROI company, that company under the Hitech Act would be regarded as a business associate and subject to the same restrictions which you are subject to.

      The reason your records’ retrieval company dropped you was because they are one of the companies who has recognized that the Hitech Act prevents providers or their business associates from making a profit on the production of copies of patient health information in electric format.

      If your hospital is not interested in obtaining the benefits of Medicare bonuses there is no need for your hospital or your department to digitalize anything. I should point out to you that an MRI is inherently stored in digital format and the law clearly applies to MRI’s and CT scans. You may be obtaining regular routine x-rays in a non-digital format. If they are stored that way and never were in electronic format you can charge the reasonable charge for reproducing them and are not limited to the restrictions of the Hitech Act.

      You assert that you build accessions to attach images and digitalize all of it. I strongly suspect that your images are already in a digital format and you should address the problem of access to your software provider.

      I think you would find that your physicians would be happy to examine images in digital format. In this format they could, for example, look at images from home or from any portal in the hospital assuming the proper settings are made and they have appropriate user identification and passwords.

      I suggest that you contact your HIPAA Compliance officer. I am sure he/she would be delighted to assist you in obtaining the information and direction you require in order to be compliant with existing law and to avoid the fines which otherwise can be levied against your hospital.

      The Department of Health and Human Services makes available on line a handbook to assist everyone in understanding what the law requires and what it does not. I strongly suggest that you visit their website and follow the appropriate links to the handbook and to the Hitech Act, both of which are readily available to you.

      Thank you for your comment. Hopefully my reply has been of some help.

  5. What every entity, including virtually every lawyer that comments on the medical fee issue, fails to understand is that Electronic Medical Records (EMR) systems vary greatly in their ability to extract the precise content that is being requested by patients, lawyers, insurance companies, etc. Each EMR has a different database structure and searching for specific content within the requested dates of healthcare service can be a very time consuming tasks requiring many individual searches and an “eyes on review” by medical personal of every selected medical record page to make sure it meets the criteria of the request. If the medical records have been scanned in from a paper file then the task of retrieving the specific content becomes exponentially more arduous. Should any Provider send more or less medical records than have been requested they face the risk of a HIPAA breach and significant fines. Lawyers would be first in line to sue the Provider for such a breach. I read many articles from persons outside the Healthcare industry preaching the simplicity of locating elements of patient records on Electronic Medical Record systems. They simply “don’t know what they don’t know”. Most have never tried to conduct a search for specific medical records content on an EMR system. If they did, then they would understand the significant labor cost involved.

    For any lawyer that pontificates on how easy it is to conduct an electronic search I propose that they be forced to search for those records and then comment on how easy it is to perform accurate searches based on the requirements of each highly individual request a Provider has to process. Ignorance or process is no less of an issue than ignorance of the law.

    1. Read the hi tech act. Patient has right to entire record. They have for years recommended providing patient with read only functional portal. Your software must be ten years old. If you haven’t been reported to the division of civil rights, you will be. When a pt requests a complete copy of records maintained inn electronic format give it to them. There is nothing for you to read or decide. Call your regional office of civil rights. They will confirm what I have said.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

What are you looking for?