HHS Reinforces Limits on Fees for Patient Medical Records

Ken Terry

March 01, 2016

The Office of Civil Rights (OCR) in the Department of Health and Human Services (HHS) has released new guidance about patients' rights to obtain their medical records and how much providers can charge them for copies. The new interpretations, presented in a "frequently asked questions (FAQ)" format, may force some practices to change their policies.

OCR's guidance interprets the Privacy Rule of the Health Insurance Portability and Accountability Act (HIPAA). It is OCR's responsibility to enforce the HIPAA Privacy Rule by sanctioning or fining practices.

According to OCR, copying fees should be reasonable. They may include the cost of labor for creating and delivering electronic or paper copies; the cost of supplies, including paper and portable media such as CDs or USB drives; and the cost of postage when copies of records are mailed to patients at their request.

But OCR specifically stated, "Labor for copying does not include costs associated with reviewing the request for access; or searching for and retrieving the PHI [personal health information], which includes locating and reviewing the PHI in the medical or other record, and segregating or otherwise preparing the PHI that is responsive to the request for copying."

Although this has always been the case, OCR said, it is clarifying these points because the office has observed there is confusion about them in the field.

Physician practices and other HIPAA-covered entities can charge patients for the labor to prepare an explanation or summary of the PHI, but only if the individual has requested this in advance and has agreed to the fee to be charged, OCR said. Other copying fees must also be spelled out in advance.

The costs of updating and maintaining health information technology systems and data and the cost of data storage and maintenance cannot be factored into the fees charged for copying, the OCR guidance stated.

Labor costs for copying may include the cost of photocopying paper documents, of scanning paper documents into an electronic format, of converting electronic information into the format requested by the individual from another format, of mailing or emailing PHI, and of transferring electronic PHI from an internal system to a web-based portal, portable media, email, an app, or a personal health record.

Government-certified electronic health records (EHRs) are required to include a "view-download-transmit" function that allows patients to see a subset of their EHR data. (This is a meaningful use requirement.) These data can be manually or automatically sent to a patient portal, where a patient can view it. OCR said practices cannot charge patients extra for using this functionality, because it does not believe covered entities incur extra labor or supply costs in supplying the information.

In addition, covered entities cannot charge individuals for the administrative costs they pay when they outsource the work of providing patients' records to an outside firm.

Especially in cases where individuals cannot afford copying fees, the guidance noted, practices should provide the records to them for free. Moreover, if a covered entity charges a fee for providing a copy and then applies it against an unpaid bill, it cannot withhold the records.

The OCR guidance also discusses specific situations related to compliance with the record copying provision of the Privacy Rule. Among them are:

  • practices must tell patients upfront whether they will be charged fees and how much those will be;

  • practices must calculate the actual costs on which they base their copying fees, although they can use average costs rather than calculating the cost for each records request;

  • per page fees can be used only for paper copies or scanned copies of paper documents;

  • if a flat fee is charged for electronic copies of PHI that are maintained electronically, it cannot exceed $6.50 per request;

  • individuals have the right to receive a copy of their PHI in the form and format they request, "if it is readily reproducible that way"; and

  • the HIPAA Privacy Rule overrides state regulations on copying costs in most cases.

The OCR document also addresses a multitude of other topics, including the transmission of records to third parties, copying fee limits for business associates of covered entities, patient inspections of records without copying, the question of liability when records are sent to patients by email, and whether or not practices have to allow patients to use their own portable media or apps to view or download electronic records.

Patient Fees

There have been some reports of patients paying high fees for copies of electronic records. A contractor hired by one hospital system, for example, reportedly charged a basic fee of $23, plus "shipping and handling fees" of $16 per page for electronic copies, according to FierceEMR.

According to an article from the Stanford Graduate School of Business, practices have been known to charge $500 or more for paper copies of very long records, depending on how much their states allow. It is unclear whether how many practices charge for copies of electronic records, but the publication Medical Economics recently quoted a physician executive who said her organization should be permitted to charge patients for access to its EHR.

Asked to comment on the new OCR guidance, David Kinsman, a spokesman for the American College of Physicians (ACP), told Medscape Medical News, "Patients should have the right to request their [medical] information from every holder of information about them. Providers should be permitted a reasonable period to comply and to charge the patient a fee that is based on providing the information."

Asked whether this meant that the ACP disagrees with the OCR guidance on the costs that can be included in copying fees, the spokesman deferred to another ACP official who was unavailable for comment at press time.

The ACP also believes that EHRs "should be required to facilitate the provision of a patient's information in electronic formats," Kinsman said, and that EHRs should be interoperable. The ACP maintains that "full [patient] access to medical records and disclosure of records will not be possible" until that interoperability is achieved, he added.


Comments on Medscape are moderated and should be professional in tone and on topic. You must declare any conflicts of interest related to your comments and responses. Please see our Commenting Guide for further information. We reserve the right to remove posts at our sole discretion.