HHS Issues Guidelines to Allow Patients Easier Access to Their Medical Records

Patients have an absolute right to access their medical records under the Health Insurance Portability and Accountability Act, more commonly known as HIPAA.  Despite this, they frequently encounter obstacles when trying to exercise that right.  Hospitals and physicians may take months to respond to a request, charge an amount for copying that is cost-prohibitive to the patient, or deny the request altogether out of concern that the patient may be upset by the information.

The Department of Health and Human Services recently issued new guidelines to physicians and hospitals to address these concerns and make it easier for patients to access their medical records.  Under the guidelines, hospitals and physicians must respond within 30 days of receiving a request by a patient.  The guidelines also provide the following information clarifying the scope of the patient’s right to medical records:

General Right
Patients have a right to access protected health information that is included in their “designated record set.”  This includes medical records; billing records; insurance information; radiology studies such as X-Rays; clinical laboratory test results; and, disease and wellness management program files.  While a hospital or physician is required to produce existing records, it is not required to create new information.
Patients do not have a right to access protected health information that does not relate to information used to make decisions about the patient, such as patient safety activity records or business planning records.  Additionally, they do not have a right to access psychotherapy notes (which are maintained separate from rest of patient’s medical record) or information compiled in reasonable anticipation of a civil, criminal, or administrative action or proceeding.

Requests for Access
A hospital or physician may require patients to request access to their records in writing if they inform the patients of this requirement.  However, a hospital or physician may not impose unreasonable measures on a patient who requests access to his or her medical records.  This means a hospital or physician may not require patients to use a web portal to access records; or, physically come to the doctor’s office to request access.

The hospital or physician must take reasonable steps to verify the identity of the individual making a request for records, which may depend on how information is originally requested.

Manner of Access
A hospital or physician must provide the patient with access to his or her medical records in the form and format requested if it is readily capable of being produced in that format.  Thus, where a patient requests paper copies of his or her medical records, the hospital or physician must produce paper copies even if the records are maintained in electronic format.

Fees for Records
A hospital or physician may only charge the cost of labor for copying records, supplies for creating the paper copy or electronic media (such as a CD or USB drive) and postage.  The hospital or physician may not charge costs for verifying information, searching for records, or other costs, even if such costs are authorized by state law.

Patients should maintain a copy of their medical records so they can advocate and easily share accurate information with new providers.  The new HHS guidelines are a step in the right direction to make it easier for patients to do so.