Background Medical Record Requests Patients may request copies of their medical records, or request that  copies of their records be sent to a designated person or entity of their  choice. In a patient request, a patient or former patient requests access to or  copies of some or all of her medical records, in either paper or  electronic format. For example, a patient might want to keep copies  for her own personal use or to bring with her when moving or  changing providers. In a patient-directed request, a patient or former patient requests  that a provider or other covered entity send a copy of the patient’s  medical records directly to another person or entity, such as another  provider. For example, a patient might request that her medical  records be forwarded to another provider because the patient is  moving or wants to seek a second opinion. In a third-party request, a third party, such as an attorney, obtains  permission from a patient (via a HIPAA authorization form that is  signed by the patient) to access the patient’s medical records. For  example, with permission from the patient, a lawyer might request  copies of a patient’s medical records to pursue a malpractice case. HIPAA’s Privacy Rule—the regulations that implement HIPAA’s privacy  protections—requires that upon request, HIPAA-covered entities, such as  health care providers and health plans, provide individuals with access to  their medical records. Under HIPAA’s implementing regulations,  providers and other covered entities must respond to a patient or patient- directed request for medical records within 30 days. The Privacy Rule  also establishes an individual’s right to inspect or obtain a copy of his or  her medical records which, as amended in 2013, includes the right to  direct a covered entity to transmit a copy of the medical records to a  designated person or entity of the individual’s choice. Individuals have  the right to access their medical records for as long as the information is  maintained by a covered entity or by a business associate on behalf of a  covered entity, regardless of when the information was created; whether  the information is maintained in paper or electronic systems onsite,  remotely, or is archived; or where the information originated. Finally, the  HIPAA Privacy Rule also describes the circumstances under which  protected health information in medical records may be released to  patients and third parties. In February 2016, OCR issued guidance to explain its 2013 regulations.  Among other things, this guidance states that as part of a patient’s right of  access, patients have the right to obtain copies of their medical records  and the right to have their records forwarded to a person or entity of their choice; in these circumstances, patients are only to be charged a  “reasonable, cost-based fee.” The guidance further notes that state laws  that provide individuals with greater rights of access to their medical  records are not preempted by HIPAA and still apply. With respect to fees,  patients may not be charged more than allowed under the Privacy Rule,  even if state law provides for higher or different fees. Fulfilling Medical Record  Requests To respond to medical record requests, providers either use staff within  their organization or may contract with ROI vendors to conduct this work.  In general, both providers’ staff and ROI vendors follow the same process  when fulfilling requests for medical records for both individual patients  and third parties. (See fig. 1.) Available Information  Suggests That Fees  for Accessing Patient  Medical Records Vary  by Type of Request  and State Available information suggests that the allowable fees for accessing  medical records vary by type of request—that is, whether a patient or  third party is making the request—and by state. Federal laws establish  limits on the fees that may be charged for two of the three types of  requests for medical records: (1) patient requests, when patients request  access to their medical records, and (2) patient-directed requests, when  patients request that their records be sent to another person or entity,  such as another provider. HIPAA does not establish limits on fees for  third-party requests. For patient and patient-directed requests, providers may charge a  “reasonable, cost-based fee” under HIPAA’s implementing regulations.  OCR’s 2016 guidance gives examples of options providers (or a ROI  vendor responding to requests for medical records on behalf of a  provider) may use in determining a “reasonable cost-based fee.” (See  table 1.) In addition to the HIPAA requirements, some states have established  their own fee schedules, formulas, or limits on the allowable fees for  patient and patient-directed requests. State laws that allow for higher fees  than permitted under HIPAA are preempted by the federal law, but those  providing for lower fees are not preempted. Representatives from ROI  vendors, provider representatives, and other stakeholders we interviewed  told us that not all states have established their own requirements  governing the fees for medical record requests and, among the states  that have, the laws can vary. For example, states can vary as to whether  they set a maximum fee that may be charged or whether they establish a  fee schedule that is applicable to paper records, electronic records, or  both. While states may establish per-page amounts that can be charged  for a copy of a patient’s medical records, these per-page amounts can  vary. In contrast with patient and patient-directed requests, the fees for third- party requests are not limited by HIPAA’s reasonable, cost-based  standard for access requests and are instead governed by state laws,  regulations, or other requirements. For third-party requests, providers and  vendors working on their behalf may charge whatever is allowed under  these state requirements. According to ROI vendors and other  stakeholders we interviewed, such fees are typically higher than the  reasonable, cost-based fees permitted under HIPAA for patient and  patient-directed requests and may be established by formulas that vary  by state. For example, states can vary as to whether they establish per- page copy fees, allow providers to charge a flat fee, or charge different  fees based on the type of media requested (e.g., electronic copies, X- rays, microfilm, paper, etc.). Additionally, state laws of general  applicability (for example, the commercial code) may govern the  permissible fees applicable to ROI release of records. Representatives of  ROI vendors we interviewed stated that there is significant variation in the  state laws that govern the fees for third-party requests, and companies  employ staff to track the different frameworks. Across the four selected states, we found examples of the kinds of  variation stakeholders have described in the allowable fees for patient  and third-party requests for medical records. (See table 2.) Three of the states— Ohio, Rhode Island, and Wisconsin—have  established per-page fee amounts. The amounts charged are based  on the number of pages requested and vary across the three states.  These three states have also established specific fee rates for  requesting media such as X-ray or magnetic resonance imaging scan  images. One state—Ohio—has established a different per-page fee amount  for third-party requests. The other three states have not established  different fees for different types of requests (i.e., between patient and  third-party requests). One state—Rhode Island—specifies a maximum allowable fee if the  provider uses an electronic health records (EHR) system for patient  and patient-directed requests. One state—Kentucky—entitles individuals to one free copy of their  medical record under state law. The statute allows a charge of up to  $1 per page for additional copies of a patient’s medical records. In some cases, questions have been raised about the fee structure that  should be applied to certain types of requests. Representatives from ROI  vendors we interviewed told us that they have seen an increase in third  parties (primarily law firms) submitting requests for medical records and  indicating that the requests are patient-directed and therefore subject to  HIPAA’s reasonable, cost-based fee standard. According to these  representatives, it is sometimes difficult for them to determine whether it  is an attorney making a third-party request or an attorney submitting a  patient-directed request because, for example, patient-directed requests  are submitted by a patient’s attorney and appear similar to traditional  third-party requests (e.g., they appear on legal letterhead). As a result,  the representatives said that they are often unsure about which fee  structure to apply to the request: a reasonable, cost-based fee or a fee for  a third-party request, which ROI vendors told us is typically higher. When asked about the reported distinction between fees for patient- directed and third-party requests, OCR officials told us that they are in the  process of considering whether any clarification is needed to their 2016  guidance. This guidance describes the requirements of HIPAA and the  Health Information Technology for Economic and Clinical Health  (HITECH) Act, as well as their implementing regulations. HIPAA provides  patients with a legally enforceable right of access to their medical records.  OCR officials explained that the HITECH Act amended HIPAA and specifies that a patient’s right of access includes the right to direct a  provider to transmit the records directly to an entity or individual  designated by the individual. According to OCR officials, the same  requirements for providing a medical record to an individual, such as the  limits on allowable fees and the format and timeliness requirements,  apply to patient-directed requests. OCR officials told us that they are  considering whether—and if so, how—they could clarify the 2016  guidance within the constraints of HIPAA and the HITECH Act. Stakeholders  Identified Fees and  Other Challenges for  Patients Accessing  Medical Records and  Challenges for  Providers in  Allocating Resources  to Respond to  Requests Patient advocates and others we interviewed described challenges  patients face accessing medical records, such as high fees. Provider  representatives described challenges providers face, including allocating  staff time and other resources to respond to requests for medical records. Patient Advocates and  Other Stakeholders  Described High Fees for  Obtaining Medical  Records, While Providers  and Patients May Be  Unaware of Patients’  Access Rights Multiple stakeholders we interviewed—patient advocates, a provider  representative, experts, and a representative from an ROI vendor—told  us that some patients have incurred high fees when requesting access to  their medical records. Stakeholders noted that in some cases the fees  reported by patients appear to exceed the reasonable, cost-based  standard established under HIPAA. One patient advocacy organization,  which collects information on patients’ access to their medical records,  described the following examples reported to them by patients: Two patients described being charged fees exceeding $500 for a  single medical record request. One patient was charged $148 for a PDF version of her medical  record. Two patients were directed to pay an annual subscription fee in order  to access their medical records. One patient was charged a retrieval fee by a hospital’s ROI vendor for  a copy of her medical records. Retrieval fees are prohibited under  HIPAA. In addition, according to patient advocates we interviewed, high fees can  adversely affect patients’ access to their medical records. For example,  one patient advocate told us that some patients simply cancel their  requests after learning about the potential costs associated with their  request. Another patient advocate told us that patients are often unable to  afford the fees charged for accessing their medical records, even in cases  when the fees are allowed under HIPAA or applicable state law. This  advocate explained that per-page fees, even if legally authorized, can  pose challenges for patients; in particular, patients who have been  seriously ill can accumulate medical records that number in the  thousands of pages and can, as a result, face fees in excess of $1,000 for  a single copy of their records. Stakeholders we interviewed told us that in many cases, providers may  also be unaware of patients’ right to access their medical records and the  laws governing the fees for doing so. Two patient advocates and an expert said that patients are sometimes  denied access to their medical records. Patient advocates and experts told us that some providers are not  aware of the 2016 OCR guidance, which describes patients’ rights to  access their medical records, as well as the permitted fees for such  access. One patient advocate and a provider representative also noted that  providers may be confused about caregivers’ and family members’  access to medical records. For example, providers sometimes  incorrectly deny family members’ access to a patient’s health  information, which HIPAA allows under certain circumstances. Provider representatives, patient advocates, and an expert agreed  that providers could benefit from more training on medical record  access issues, including training on the options patients have for  accessing their medical records. Stakeholders we interviewed also noted that patients themselves are not  always aware of their right to access their medical records, do not always  know that they can submit a formal complaint to HHS’s OCR when denied  access, and could benefit from specific educational efforts that raise  awareness of these issues. For example, patient advocates said that the  “notice of privacy practices” form that patients receive and are asked to  sign when they first seek care from a provider could be improved to raise  awareness of the rights associated with accessing medical records. This  form is used to explain a provider’s privacy policies and obligations, and  what patients have to do to obtain access to their medical records.  However, a provider association and an expert told us that these forms  are not always easy for patients to understand, and patients might not  always read them. OCR has developed a standard privacy notice that  providers may adopt if they choose. However, a patient advocate told us  that most providers are still using their own versions of the notice. Provider Representatives  and Other Stakeholders  Described Challenges of  Allocating Staff Time and  Other Resources, While  Technology Has Improved  Patients’ Ability to Access  Records Multiple stakeholders we interviewed told us that responding to patient  requests for medical records can be challenging because it requires the  allocation of staff and other resources and as a result, responding to such  requests can be costly. Furthermore, a provider representative, three  representatives from ROI vendors, and a patient advocate confirmed that  providers and their staff may lack the expertise needed for responding to  requests for medical records in a manner that complies with HIPAA and  applicable state laws. Providers can receive training on HIPAA related  issues; however, a patient advocate told us that this training, which may  be provided by private companies, often focuses on security issues (i.e.,  maintaining secure medical record systems) and not on the rights of  patients. In addition, stakeholders we interviewed commonly stated that the  increased use of electronically stored health information in EHRs has  resulted in a more complex and challenging environment when  responding to requests for patients’ medical records. For example, these  stakeholders noted the following: Extracting medical records from EHRs is not a simple “push of a  button” and often requires providers or their ROI vendors to go  through multiple systems to compile the requested information.  Stakeholders noted that printing a complete record from an EHR  system can result in a document that is hundreds of pages long due to  the amount of data stored in EHR systems. Representatives from three ROI vendors told us that as providers  have transitioned from using paper records to using EHR systems,  information has been scanned into electronic medical records. This  has, in some cases, resulted in records being incorrectly merged  (e.g., the records of two patients merged into a single record). As a  result, when responding to a medical record request, providers or their  vendors must carefully go through each page of the record to ensure  only the correct patient’s medical records are being released. A provider representative, representatives from four ROI vendors, and  two experts noted that providers often have multiple active EHR  systems, or have legacy EHR systems in which some medical records  are stored. This requires providers and their vendors to go through  multiple EHR systems to extract information in response to a medical  record request. Some providers still have a mix of paper and electronic records, which  ROI vendors and provider representatives told us makes responding  to medical record requests more difficult and time consuming. A provider representative and other stakeholders said that while  patients can request copies of their records in an electronic format,  providers may have security concerns about sending information via  unsecured email or providing electronic information via a patient’s  USB stick, which increases the risk of a provider’s system becoming  infected with malware. While health information technology has created some challenges for  providers, numerous stakeholders we interviewed told us that the  technologies have made accessing medical records and other information  easier and less costly for patients. For example, multiple stakeholders we  interviewed told us that an increase in the use of patient portals has  reduced the number of patient requests for access to their medical  records because patients are able to directly access some health  information through the portals. As we have previously reported, patient  portals have facilitated patient access to medical records and patients  have noted the benefits from having such electronic access, even though  portals do not always contain all the information patients need. The use  of patient portals has not eliminated patient requests for access to their  medical records; a provider representative we interviewed said that many  patients still prefer to obtain paper copies of their records. OCR Investigates  Complaints, Audits  Providers, and  Educates Patients  and Providers about  Patient Access To enforce patients’ right of access under HIPAA’s Privacy Rule, the HHS  OCR undertakes four types of efforts. OCR (1) investigates complaints it  receives from patients and others regarding access to patient medical  records, (2) audits a sample of providers to determine the extent to which  their policies and procedures are compliant with HIPAA, (3) reports to  Congress on compliance with HIPAA, and (4) educates patients and  providers about patients’ rights to access their medical records. Investigation of Patient  Complaints OCR has established a process for investigating patients’ complaints over  access to their medical records. Via an online portal on its website, OCR  receives complaints submitted by patients. Staff in OCR’s headquarters  office conduct an initial review of the information provided by the  complainant. According to OCR officials, complaints that cannot be  immediately resolved are generally assigned to a regional office  investigator, who is responsible for reviewing the complaint and obtaining  additional information from the complainant and provider, if needed.  After the investigator completes the investigation, OCR issues a letter to  both the provider and patient explaining what OCR has found. Depending  on the nature of the findings, OCR may, for example, issue technical  assistance to the provider; close the complaint without identifying a  violation; require the provider to implement a corrective action plan;  conduct a more detailed investigation; and, if warranted, levy a civil  monetary penalty. According to OCR officials, the use of civil monetary  penalties is rare and reserved for situations where providers’ behavior is  particularly egregious. Examples of patient access complaints provided to us by OCR included  complaints about the following: providers not responding even after the patient made multiple  requests, or providers taking longer than 30 days to respond to a  request for medical records or other information ; providers charging excessive fees for copies of patients’ medical providers not responding to requests from personal representatives or providers denying medical records requests from a parent or parents  of children. Our analysis of OCR data also shows that the amount of time OCR takes  to investigate and close a patient access complaint varies. OCR received  a total of 583 patient access complaints between February 2016 and  June 2017, closing 437 of these complaints during that same time period.  These 437 complaints took anywhere from 11 to 497 days to close. (See  fig. 2.) The majority of these 437 complaints (63 percent) were closed in  200 or fewer days. OCR officials stated that while there is no required  time frame for closing a complaint involving patients’ access to their  medical records, they aim to close cases in fewer than 365 days. According to OCR officials, while there is no required time frame for  closing a patient access case, investigators aim to get patients access to  their medical records as soon as possible, which typically occurs before  the case is formally closed (i.e., a formal letter is issued to provider and  patient). OCR officials noted a number of reasons why complaints can  take a significant amount of time to close. In some cases, the patient  receives her records early in the investigation, but the complaint is kept  open by OCR to ensure that agreed-upon or recommended corrective  actions are taken by the provider—for example, training staff on patient  access rights or demonstrating that the provider’s policies pertaining to  patient access have been changed. In other complaints, time is needed  for OCR to obtain consent from the patient who filed the complaint. OCR  officials noted that in some instances, patients ultimately decide they do  not want to give OCR consent to investigate their complaint, due to  concerns that the provider will learn their identity. OCR officials also noted  that complaints that are moving towards more serious enforcement  actions, such as civil monetary penalties, may also take a long time to  close. Finally, OCR officials noted that their own staffing limitations in  regional offices can sometimes result in complaints taking additional time  to close. OCR Audits The HITECH Act requires OCR to conduct periodic audits of selected  covered entities in order to review the policies and procedures the  covered entities have established to meet HIPAA requirements and  standards. The right of patients to access their medical records is  included in these requirements. As part of its most recent audit, OCR  officials stated that they reviewed 103 covered entities regarding their  policies related to patient access to health information, including the  entities’ notice of privacy practices. In addition, OCR reviewed any  access requests the covered entities received from patients, including  both requests that were granted and requests that were denied. OCR  examined these access requests to determine whether access was  provided in a manner that was consistent with the covered entities’  policies and procedures and whether the entities fulfilled the requests  they received within the 30-day time frame established under the Privacy  Rule. OCR also examined any fees that were charged for access and  whether those fees met HIPAA’s reasonable, cost-based standard. OCR  officials said that after completing each audit, OCR submitted a draft  report for the audited entity for review. The entity had 10 days to review  and submit any feedback to OCR, which OCR reviewed and incorporated  into the entity’s final audit report. According to OCR officials, OCR has  completed this phase of the audit program and will release a final report  in 2018. Annual Report to  Congress The HITECH Act directs HHS to submit an annual report to Congress on  compliance with HIPAA that includes details about complaints of alleged  violations of the Privacy Rule and the resolution of these complaints.  The patient right of access is part of the HIPAA and Privacy Rule  requirements. The report, which is issued by OCR, includes information  on the patient access complaints OCR has received, the number of  investigations it has conducted, and the fines OCR has levied. OCR  issued its most recent report in 2016. The report summarized complaints  and enforcement actions for the 2013 through 2014 calendar years. OCR  officials stated that they are in the process of reviewing a draft report that  will be released in mid-2018 and contain information and data from  calendar years 2015 and 2016. Provider and Patient  Education Efforts As part of its responsibilities to enforce HIPAA’s Privacy Rule, OCR also  provides a variety of educational materials that aim to educate both  patients and providers about patients’ right to access their medical  records. These materials include the following:  In September 2017, OCR published a pamphlet that aims to educate  consumers, particularly caregivers, about patients’ rights to access  their medical records, including how to file a complaint if denied  access. OCR has worked with ONC to produce three videos (“Your Health  Information, Your Rights!”) and an infographic aimed at educating  patients and others about patients’ rights to access their medical  records. OCR has developed provider education videos that aim to educate  providers on the rights of patients to access their medical records and  how such access can enable patients to be more involved in their own  care. Providers can receive continuing education credits for watching  these videos. To assist providers, OCR has worked with ONC to develop a model  notice of privacy practices to help providers adequately communicate  access rights to patients in a standardized, easy-to-understand way. Agency Comments We provided a draft of this report to HHS for review. HHS provided us  with technical comments, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional  committees, the Secretary of Health and Human Services, and other  interested parties. In addition, the report is available at no charge on the  GAO website at http://www.gao.gov. If you or your staffs have any questions about this report, please contact  me at (202) 512-7114 or at yocomc@gao.gov. Contact points for our  Office of Congressional Relations and Office of Public Affairs can be  found on the last page of this report. Other major contributors to this  report are listed in appendix I. Appendix I: GAO Contact and Staff  Acknowledgments GAO Contact Staff  Acknowledgments In addition to the contact named above, Tom Conahan, Assistant  Director; Andrea E. Richardson, Analyst-in-Charge; Krister Friday; and  Monica Perez-Nelson made key contributions to this report.
HIPAA and its implementing regulations, as amended by the Health Information Technology for Economic and Clinical Health Act, require health care providers to give patients, upon request, access to their medical records, which contain protected health information (i.e., diagnoses, billing information, medications, and test results). This right of access allows patients to obtain their records or have them forwarded to a person or entity of their choice—such as another provider—in a timely manner while being charged a reasonable, cost-based fee. Third parties, such as a lawyer or someone processing disability claims, may also request copies of a patient's medical records with permission from the patient. The 21st Century Cures Act included a provision for GAO to study patient access to medical records. Among other things, this report describes (1) what is known about the fees for accessing patients' medical records and (2) challenges identified by patients and providers when patients request access to their medical records. GAO reviewed selected HIPAA requirements and implementing regulations and guidance, and relevant laws in four states selected in part because they established a range of fees associated with obtaining copies of medical records. GAO also interviewed four provider associations, seven vendors that work for providers, six patient advocates, state officials, and Department of Health and Human Services' (HHS) officials. The information GAO obtained and its analysis of laws in the selected states are not generalizable. HHS provided technical comments on this report. Available information suggests that the fees charged for accessing medical records can vary depending on the type of request and the state in which the request is made. Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations, providers are authorized to charge a reasonable, cost-based fee when patients request copies of their medical records or request that their records be forwarded to another provider or entity. In the case of third-party requests, when a patient gives permission for another entity—for example, an attorney—to request copies of the patient's medical records, the fees are not subject to the reasonable cost-based standard and are generally governed by state law. According to stakeholders GAO interviewed, the fees for third-party requests are generally higher than the fees charged to patients and can vary significantly across states. The four states GAO reviewed have state laws that vary in terms of the fees allowed for patient and third-party requests for medical records. For example, three of the states have per-page fee amounts for patient and third-party records requests. The amounts charged are based on the number of pages requested and vary across the three states. One of the three states has established a different per-page fee amount for third-party requests. The other two do not authorize a different fee for patient and third-party requests. One of the three states also specifies a maximum allowable fee if the provider uses an electronic health records system. The other two do not differentiate costs for electronic or paper records. In the fourth state, state law entitles individuals to one free copy of their medical record. The statute allows a charge of up to $1 per page for additional copies. Patient advocates, provider associations, and other stakeholders GAO interviewed identified challenges that patients and providers face when patients request access to their medical records. Patients' challenges include incurring what they believe to be high fees when requesting medical records—for example, when facing severe medical issues that have generated a high number of medical records. Additionally, not all patients are aware that they have a right to challenge providers who deny them access to their medical records. Providers' challenges include the costs of responding to patient requests for records due to the allocation of staff time and other resources. In addition, according to provider associations and others GAO interviewed, fulfilling requests for medical records has become more complex and challenging for providers, in part because providers may store this information in multiple electronic record systems or in a mix of paper and electronic records.