OCR issued new HIPAA guidance yesterday that reiterates patients’ right to access health information and clarifies appropriate fees providers can charge for copies.
In its clarification, OCR emphasized its view that the right of access is necessary to put the individual “in the driver’s seat” when it comes to their care, which OCR views as a key component of both health care reform and the movement toward a patient-centered health care system.
The HIPAA Privacy Rule has always provided individuals with the right to access and receive a copy of their health information from their providers. However, this right has not always been understood by providers and patients.
In January 2016, OCR took an significant step toward removing those obstacles by issuing a comprehensive fact sheet and the first in a series of topical frequently asked questions (FAQs) addressing patients’ right to access their medical records. Those FAQs explained the requirements providers must follow in sharing medical records with patients, including that they must do so in a timely manner and in a format that works for the patient.
OCR is providing this second set of FAQs to address additional issues, including the fees individuals may be charged for copies of their health information and the right of individuals to have their health information sent directly to a third party if they so choose. The new FAQs clarify that individuals can be charged a reasonable, cost-based fee for the labor and supplies associated with making the copy, whether on paper or in electronic form.
Furthermore, the right to access includes the right to have the information sent directly to a third party, whether another health care provider, a friend or family member, researchers, or even a personal health record.
Like the Access fact sheet and FAQs released in January, this second guidance is aimed to assist providers in complying with the HIPAA Privacy Rule. The complete set of materials – the Fact Sheet and both the first and second set of FAQs — may be found on OCR’s website at: http://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html.
