How much can you charge patients for their health information?

The Office for Civil Rights (OCR) within the U.S. Department of Health and Human Services recently addressed patients’ rights to access their protected health information (PHI) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Much of the guidance focuses on the fees that a covered entity, such as your practice, may charge patients requesting copies of their own PHI.

According to OCR, you can charge patients for:

1.    labor costs (including preparation of an explanation or summary when agreed to by the individual)
2.    supply costs related to the creation of either the electronic or paper copy (e.g., paper, toner, CD, or USB drive)
3.    postage costs when the individual requests the information be mailed

The OCR guidance indicates that permissible labor costs may include only the labor “for creating and delivering the electronic or paper copy in the form and format requested or agreed upon by the individual, once the PHI that is responsive to the request has been identified, retrieved, or collected, compiled and/or collated, and is ready to be copied.” (Emphasis added) That means you cannot charge for reviewing the request or searching for and retrieving the information.

The OCR also emphasizes that you may not charge individuals for system maintenance, data storage and maintenance, or the administrative costs associated with outsourcing your office’s response to requests for PHI. OCR further notes that if you use systems that allow individuals to access their PHI through electronic health record technology, you may not charge labor or supply costs.

The OCR guidance says that when calculating the fees you charge, they may reflect your actual costs, your average costs, or a flat fee. If using actual costs, they must be reasonable and calculated upon each request. OCR says that you can charge average costs as a standard rate (e.g., a per-page fee if you maintain the requested PHI in paper form and the individual requests a paper copy). The OCR adds that “per page fees are not permitted for paper or electronic copies of PHI maintained electronically.” Finally, you can charge a flat fee but only for electronic copies of electronically maintained PHI, and the flat fee cannot exceed $6.50.

Regardless of the fee method used, you must notify individuals in advance of any fees that could be charged for their requests for PHI at the time the details of the request are being arranged. Failure to provide such notice could potentially be a HIPAA violation.

If a patient requests that you send their PHI to a third party, you must treat that request the same under HIPAA as if the patient were requesting it be sent to them directly. However, if a third party initiates the request for PHI, the limitations on copying fees do not apply. So, you should ask whether the request was a direction from the patient or a request from a third party.

Finally, the OCR guidance discusses the relationship between HIPAA and state law. Specifically, when it comes to an individual's right to access his or her own PHI, HIPAA trumps state law if HIPAA provides individuals with greater access to their PHI. That means if your state law allows you to charge higher fees or to limit an individual’s access, HIPAA will preempt that state law.

Needless to say, now may be a good time to review your policies and procedures for granting access to individuals’ PHI, including whether and how you charge for copies of that information.

– Kent Moore, Senior Strategist for Physician Payment for the American Academy of Family Physicians