The Health Insurance Portability and Accountability Act (HIPAA) defines new rights and responsibilities as they relate to patient medical records. In most cases, HIPAA complements State and Federal laws but in a few occasions, HIPAA provides conflicting information.

It is our intent to provide some basic information within this blog to assist Covered Entities and Business Associates with some of the most common conflicts.

Charging for records:

Most States allows Providers to charge for copies of the Medical Records. For example, in the State of Florida a Provider may charge:

Florida Statutes 395.3025. Records requested by someone other than the patient:

• Exclusive charge for copies may include sales tax and actual postage
• Non-paper records not to exceed $2.00 per page
• Paper records not to exceed $1.00 per page
• A fee of up to $1.00 may be charged for each year of records requested

 Rule 64B8-10.003, Florida Administrative Code.  Records requested by the patient or governmental entities:

• For the first 25 pages, the cost shall be $1.00 per page.
• For each page in excess of 25 pages, the cost shall be $0.25.
• Actual cost of reproducing non-written records such as x-rays. The phrase “actual costs” means the cost of the material and supplies used to duplicate the record, as well as the labor costs and overhead costs associated with such duplication.
• “Recognizing that patient access to medical records is important and necessary to assure continuity of patient care, the Board of Medicine urges physicians to provide their patients a copy of their medical records, upon request, without cost, especially when the patient is economically disadvantaged.”

HIPAA 45 CFR § 164.524

The Privacy Rule permits a covered entity to impose a reasonable, cost-based fee if the individual requests a copy of the PHI (or agrees to receive a summary or explanation of the information).  The fee may include only the cost of:

• labor for copying the PHI requested by the individual, whether in paper or electronic form; (2) supplies for creating the paper copy or electronic media (e.g., CD or USB drive) if the individual requests that the electronic copy be provided on portable media;
• postage, when the individual requests that the copy, or the summary or explanation, be mailed; and
• preparation of an explanation or summary of the PHI, if agreed to by the individual. 

The fee may not include costs associated with verification; documentation; searching for and retrieving the PHI; maintaining systems; recouping capital for data access, storage, or infrastructure; or other costs not listed above even if such costs are authorized by State law.

In lieu of calculating labor costs individually for each request, a covered entity can develop a schedule of costs for labor based on average labor costs to fulfill standard types of access requests. This standard rate can be calculated and charged as a per page fee only in cases where the PHI requested is maintained in paper form and the individual requests a paper copy of the PHI or asks that the paper PHI be scanned into an electronic format. Per page fees are not permitted for paper or electronic copies of PHI maintained electronically.

A covered entity may charge individuals a flat fee for all requests for electronic copies of PHI maintained electronically, provided the fee does not exceed $6.50, inclusive of all labor, supplies, and any applicable postage. 

In cases where the individual requests electronic copies from electronic files, then the covered entity must provide the individual with access to the information in the requested electronic form and format, if it is readily producible in that form and format. When the PHI is not readily producible in the electronic form and format requested, then the covered entity must provide access to an agreed upon alternative readable electronic format. See 45 CFR 164.524(c)(2)(ii). This means that, while a covered entity is not required to purchase new software or equipment in order to accommodate every possible individual request, the covered entity must have the capability to provide some form of electronic copy of PHI maintained electronically.; It is only if the individual declines to accept any of the electronic formats readily producible by the covered entity that the covered entity may satisfy the request for access by providing the individual with a readable hard copy of the PHI.”

Bottomline, if in doubt stick to a $6.50 charge unless State law disallows charging for records.