By Michael D.I. Siget, JD, MPA, PAMED’s Legislative & Regulatory Counsel
HHS Office of Civil Rights determines that attorneys are not automatically considered personal representatives for the HIPAA rate applicable to patients' requests for records
There has been debate recently regarding fees that health care providers may charge attorneys who request copies of their clients' protected health information (PHI), particularly medical records. The Health Information Technology for Economic Clinical Health (HITECH) Act, which was enacted as part of the American Recovery and Reinvestment Act of 2009, was created to promote the adoption and meaningful use of health information technology.
Specifically, regulations included at Subparts C and E of the HITECH Act (45 CFR Part 164, Subparts C and E) set forth both security standards for the protection of electronic health information and for the privacy of individually identifiable health information.
In the typical situation, attorneys request their clients' medical records from a health care provider for purposes of some type of legal action or claim against a party. In order to thoroughly and adequately represent their clients, attorneys will often need to review medical records in the possession of health care providers.
Normally, an attorney will send a written request to the health care provider and attach a HIPAA-compliant authorization form signed by the client/patient or the client/patient's personal representative. In addition, attorneys may cite to the fee limitation requirements set forth in 45 CFR § 164.524(c)(4), which limits a provider to imposing a "reasonable, cost-based fee." This fee may only include the cost of:
- labor for copying the protected health information (PHI) requested by the individual, whether in paper or electronic form;
- supplies for creating the paper copy or electronic media if the individual requests that the electronic copy be provided on portable media;
- postage, when the individual has requested the copy, or the summary or explanation, be mailed;
- and preparing an explanation or summary of the PHI, if agreed to by the individual. The attorney may also cite to 45 CFR § 164.524(c)(3)(ii), which authorizes an individual to designate another person to receive the requested documents, i.e. the attorney.
Under the above scenario, the question arises as to what fees a health care provider may charge an attorney who has the proper authorization from his client to obtain the requested medical records.
One argument is that attorneys acting on behalf of their clients take the place of their clients, so they are entitled to the fee limitations that providers can charge. A counter argument is that attorneys, while acting on behalf of their clients, are not the subject of the medical records, so only the subject of the medical records is entitled to the fee limitations that providers can charge.
This issue was brought before the HHS Office of Civil Rights (OCR) Region III in 2015 (1). Region III covers Delaware, Maryland, Pennsylvania, Virginia, West Virginia, and the District of Columbia.
In this case, an attorney had filed a complaint against a hospital regarding fees that the hospital could charge for a request for records. OCR noted that it was responsible for "enforcing the Privacy Rule as it applies to covered entities. Covered entities include health care clearinghouses, health plans and health care providers that transmit health information in electronic form in connection with a transaction for which the Department of Health and Human Services has adopted standards (See 45 CFR Part 162)."
Based upon its review of the case, the OCR determined that there is a distinction between an individual requesting his or her own records and an attorney requesting records on behalf of that individual through a signed authorization from that patient.
The OCR stated that the individual access provisions under the Privacy Rule only apply to individuals or their personal representatives. The OCR determined that attorneys who submit requests for medical records accompanied by a signed authorization are not considered personal representatives under the Privacy Rule. As such, the fee limitations and time limits under the Privacy Rule do not apply.
The OCR instead determined that a provider's release of information to an attorney through a signed authorization form is considered a "permissible disclosure" under a valid authorization per 45 CFR § 164.502(a)(1)(iv). In those cases, the Privacy Rule imposes no restrictions on the fees that a covered entity or its business associate may charge in connection with a request for records. The OCR did caution that while the Privacy Rule may not limit the fees that may be charged to an attorney as a permissible disclosure, state law restrictions may apply (2).
Fee provisions under the Privacy Rule would still apply when individuals request that medical records be directed to third parties, which include attorneys. So if the individual makes a valid first-party request, but directs that the medical records be sent to his or her attorney, the fee limitations under the Privacy Rule would still apply.
Note that even if the Privacy Rule does not apply, this does not mean that a provider cannot voluntarily apply those often-lesser fees on an attorney (or other eligible third party) or otherwise waive the fees entirely, in addition to responding to a request for records within the 30-day timeframe as required by the Privacy Rule (even if the timeframe requirement does not apply in a particular situation).
A copy of the OCR response can be accessed here. (3)
PAMED has numerous resources regarding medical records that can be accessed here.
- (1) It should be noted that the hospital ultimately waived the fees and provided a full copy of the medical records. However, the OCR still discussed the merits of the complaint filed against the hospital.
- (2) The Pennsylvania Judicial Code contains fee limitations for medical records in certain cases. PAMED has several resources on this issue in the link provided with this article.
- (3) A copy of this OCR response was obtained through a Freedom of Information Act request by the law firm of Davis Wright & Tremaine LLP and was posted on their website through an article regarding medical records.