Year after year, the individual right of access to protected health information (PHI) continues to be in the top five complaints investigated by the Office for Civil Rights (OCR) with corrective action implemented. To combat this perceived non-compliance, last month OCR issued a fact sheet and a series of Frequently Asked Questions (FAQs) more fully explaining the right to access, including the fees that providers may charge for individuals exercising their right to receive copies of PHI. For the first time, OCR explicitly states that a per-page fee for producing electronic copies of PHI is prohibited.
WHAT IS A REASONABLE, COST-BASED FEE?
The guidance and FAQs reveal that OCR continues to misunderstand the time and expense associated with producing copies of PHI, and in particular, electronic copies, to individuals. A provider may charge a reasonable, cost-based fee to provide an individual (or his/her representative) with a copy of the individual’s PHI in a paper or electronic format.
A provider may charge the labor for copying the PHI requested, whether in paper or electronic form, and delivering the PHI in the form and format requested. Labor for copying includes only the labor for creating and delivering the paper or electronic copy, such as:
- Scanning paper PHI into electronic format;
- Converting electronic information in one format to the format requested by or agreed to by the individual;
- Transferring electronic PHI to a web-based portal, portable media, email, app, personal health record, or other manner of delivery; and
- Creating and executing a mailing or email with the PHI.
Labor costs do not include any steps taken to identify the PHI that is responsive to the individual’s request. This means that costs associated with reviewing the request for access, searching for and retrieving the responsive PHI (including locating and reviewing the PHI in the medical record), and segregating or otherwise preparing the PHI for copying cannot be included as labor costs.
A provider also may charge for the supplies used to create the paper (e.g., paper, toner) or electronic (e.g., CD or USB) copies. A provider, however, cannot require an individual to purchase the electronic media if the individual requests delivery of the PHI via another method (e.g., email or mail).
Summary of PHI
A provider may charge the labor for preparing an explanation or summary of PHI if the individual in advance chooses to receive the summary and agrees to the fee.
A provider may charge the individual for postage when he/she requests that the copy or summary be mailed.
HOW TO CALCULATE THE REASONABLE, COST-BASED FEE?
OCR provides three methods for calculating the fees: (1) actual costs; (2) average costs; or (3) a flat fee for electronic copies.
The actual costs method includes only the labor costs for fulfilling the request, applicable supplies, and postage costs. For example, an actual labor costs calculation will include the time it takes for the workforce member to make and send the copy of PHI in the form and format and manner requested (subject to the labor cost restrictions mentioned above) multiplied by the reasonable hourly rate of the person copying and sending the PHI. The calculation of the reasonable hourly rate will depend on the level of skill needed to create and send the PHI. OCR acknowledges in the guidance that it may require more technical skill to convert and send PHI in an electronic format than in paper format.
The average costs method allows for a provider to develop a schedule of costs for average labor costs to fulfil standard types of access requests, as long as the types of labor costs are permitted by the Privacy Rule and are reasonable. OCR clarifies that a per-page fee can only be used where the PHI requested is maintained in paper form and requested in paper form or that paper be scanned into an electronic format. A per-page fee is not permitted for paper or electronic copies maintained electronically. A provider may also charge for the applicable supplies and postage costs.
The flat fee method is only for standard requests for electronic copies of PHI maintained electronically, provided the fee does not exceed $6.50, inclusive of all labor, supplies, and any applicable postage.
OCR also states that providers should consider providing copies free of charge. In addition, OCR advises that a provider must inform the individual in advance of the approximate fee that may be charged for a copy and the failure to provide such advance notice is considered to be an unreasonable measure that may serve as a barrier to the right of access.
DO THESE FEE LIMITATIONS APPLY TO THIRD PARTY DISCLOSURES?
It depends. An individual may exercise his/her right to access by requesting the provider send the PHI directly to a third party (e.g., family member, friend). To request that a copy be sent to a third party, the individual must make the request for access in writing, clearly identify the third party and where to send the PHI, and sign the request. These minimal elements are different than a written authorization for disclosure. If the individual requests access, then the fee limitations apply even if the PHI is send to a third party. However, if the third party contacts the provider directly and submits a written authorization for disclosure of PHI, then the fee limitations do not apply. OCR cautions that providers cannot avoid the fee limitations by requiring all individual requests for access be completed via a written authorization.
The full text of the guidance can be found at http://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html