Here are the questions we have received and our responses:
No. The HITECH Act is a federal law, and federal law preempts state law. The HITECH Act states that you can charge a flat fee of $6.50. Alternatively, a provider can charge a “reasonable, cost-based fee” for producing electronic records when it is requested directly from the patient. That means the labor cost to you of producing records, which would be your labor cost to put the records onto a CD, plus postage.
In our answer to the question below, we give an example of what the costs look like, and why many providers are using the $6.50 flat fee charge and not working with the alternative.
Whether you have to scan paper records into an electronic version, or drag and drop already-electronic records onto a disc, you may only charge the patient a flat fee of $6.50. HITECH does give you a second option, which is to charge a “reasonable, cost-based fee” instead of the $6.50, for the actual labor cost to produce the electronic records. This would involve the labor-related cost to your business in scanning the paper record, uploading the record to a cloud-based system, or time spent creating and sending out a CD. For example, if you pay someone on your staff $20.00 an hour to process records requests and they spend 10 minutes on the request, the labor cost to you is $3.33. Then, you can add on the cost of the CD, which is about .20 cents,[2] and postage.
However, if you intend to charge something other than the flat fee, you must disclose those charges to the patient before sending the records. That is why most providers are choosing to charge the flat $6.50 fee for all requests, as it is simpler and more cost-effective to have one unified procedure for all requests. [3]
No. The HITECH Act does not allow a provider to charge for the verification of the patient’s electronic record. DHHS has expressly stated that a provider cannot charge and administrative fee to verify the patient record.
Here is another answer you will not like: no. The HITECH Act requires you to comply with a request for records in electronic format if it is readily producible electronically. That means you must scan the paper records (typically into .pdf form) and transfer them onto a CD or flash drive.
If you have absolutely no ability to produce the records in any kind of electronic format, then (and only then) can you provide the patient with a hard copy of the record. Even in that case, you still must comply with HITECH in how you charge the patient. You cannot charge the handling and per-page fee allowed under state law. You may only charge for your actual labor costs and the cost of supplies.
No. Under the HITECH Act, the patient has a broad right to all records maintained by the provider, and the provider must scan any paper records into electronic format at the patient’s request. You cannot charge a per page fee to scan your paper records. Nor can you make copies of the paper records if you are able to scan those records as a .pdf.
In this situation, it would be acceptable to charge the client the cost to you of reproducing the films and putting them onto a CD because the Act states that the records be “readily producible” in the manner requested.
Our “best practices” recommendation is to get a quote for this cost from a vendor and then advise the patient of the cost and get their approval before you proceed.
Yes. When you receive a letter signed by the patient asking for records, the patient’s signature serves as the authorization. No HIPAA release is required.
No. HITECH does not allow you to pass the costs of a third party vendor to copy/scan records on to your patient.
This is indeed legal. A provider must send the records to wherever the patient designates, even your patient’s attorney. However, the patient’s request must be in writing and signed by the patient.
You are not responsible for disclosure of information while in transmission to the person or entity requested by the patient. You are also not responsible for safeguarding the information once it is delivered. However, you are responsible if you type in the wrong email address when transmitting the information.
You have 30 days to comply with the request. If you cannot comply within this time period, you have another 30 days, but must notify the patient of the reason for the delay within the initial 30 days.
All health care providers should anticipate that attorneys and their clients will be requesting electronic records per the HITECH ACT.
If the information in this article does not answer your questions, then email us at [email protected] . We welcome other questions and will continue to share our information with the health care community.
[1] DHHS has added and modified their FAQ page several times this year, most recently in May of this year. See: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html
[2] You can get a 100 pack of CDs on Amazon for less than $20.00 or .20 cents per CD.
[3] Beware, as an ominous opinion from DHHS is that as technology advances, the labor costs to the provider for complying with a request should dwindle down to nothing.