Recently, a federal district court heard a lawsuit where patients argued that healthcare providers and healthcare recordkeepers were charging fees for patients to access their medical records. Under HIPAA, healthcare providers are required to provide an individual a copy of their medical records upon request. They have the right to inspect, transmit copies, or get a copy of the records. The Department of Health and Human Services (“HHS”) has issued guidance on this regulation that includes fee limitations.

In the case at hand, attorneys requested patient records and included in their request a copy of a HIPAA-compliant authorization signed by the patient. This type of HIPAA authorization is common in injury cases where medical records are used as proof of the extent and cost of plaintiff injuries. The healthcare providers, or the recordkeepers, asked for a fee to produce copies of the records that was in excess of HHS permissible fees.

When the recordkeeper, who is often a business associate of the healthcare provider and thus also considered subject to HIPAA, charged these excessive fees, patients sued under state consumer protection laws as there is no private right of action under HIPAA. The healthcare providers, of course, asked the court to dismiss the claim, which the court rejected.

First, the court noted that individuals have the right to request a copy of their records and have the right to request those records be submitted to a third party. Those record requests submitted to a third party, according to HHS guidance, follow the same fee schedule as simple individual requests. Further, the court noted that the same fee schedule applies regardless of whether the individual submits the record requests and asks for it to go to the third party or whether the individual authorizes the third party to request a copy of their records.

Bocage v. Acton Corp.

Another recent case on point, which the federal district court in Rios made a point to differentiate from, has attorneys submitting requests for patient records without a written signed request. In this circumstance, the court found, the HHS fee schedule would not apply.

While the Rios case is still in an early phase and patients still must prove their claim under the state’s consumer protection law, it provides important guidance on fee schedules for healthcare providers, recordkeepers, and those looking to request patient records from HIPAA-covered entities.