In a third-party request, a third party, such as an attorney, obtains  permission from a patient (via a HIPAA authorization form that is  signed by the patient) to access the patient’s medical records. Among other things, this guidance states that as part of a patient’s right of  access, patients have the right to obtain copies of their medical records  and the right to have their records forwarded to a person or entity of their choice; in these circumstances, patients are only to be charged a  “reasonable, cost-based fee.” The guidance further notes that state laws  that provide individuals with greater rights of access to their medical  records are not preempted by HIPAA and still apply. In general, both providers’ staff and ROI vendors follow the same process  when fulfilling requests for medical records for both individual patients  and third parties. Available Information Suggests That Fees for Accessing Patient Medical Records Vary by Type of Request and State

Available information suggests that the allowable fees for accessing  medical records vary by type of request—that is, whether a patient or  third party is making the request—and by state. Federal laws establish  limits on the fees that may be charged for two of the three types of  requests for medical records: (1) patient requests, when patients request  access to their medical records, and (2) patient-directed requests, when  patients request that their records be sent to another person or entity,  such as another provider. For patient and patient-directed requests, providers may charge a  “reasonable, cost-based fee” under HIPAA’s implementing regulations. In contrast with patient and patient-directed requests, the fees for third- party requests are not limited by HIPAA’s reasonable, cost-based  standard for access requests and are instead governed by state laws,  regulations, or other requirements. Across the four selected states, we found examples of the kinds of  variation stakeholders have described in the allowable fees for patient  and third-party requests for medical records. Three of the states— Ohio, Rhode Island, and Wisconsin—have  established per-page fee amounts. The amounts charged are based  on the number of pages requested and vary across the three states. One state—Ohio—has established a different per-page fee amount  for third-party requests. The other three states have not established  different fees for different types of requests (i.e., between patient and  third-party requests). One state—Rhode Island—specifies a maximum allowable fee if the  provider uses an electronic health records (EHR) system for patient  and patient-directed requests. One state—Kentucky—entitles individuals to one free copy of their  medical record under state law. The statute allows a charge of up to  $1 per page for additional copies of a patient’s medical records. This guidance describes the requirements of HIPAA and the  Health Information Technology for Economic and Clinical Health  (HITECH) Act, as well as their implementing regulations. In addition, according to patient advocates we interviewed, high fees can  adversely affect patients’ access to their medical records. Provider Representatives and Other Stakeholders Described Challenges of Allocating Staff Time and Other Resources, While Technology Has Improved Patients’ Ability to Access Records

Multiple stakeholders we interviewed told us that responding to patient  requests for medical records can be challenging because it requires the  allocation of staff and other resources and as a result, responding to such  requests can be costly. In addition, stakeholders we interviewed commonly stated that the  increased use of electronically stored health information in EHRs has  resulted in a more complex and challenging environment when  responding to requests for patients’ medical records. Some providers still have a mix of paper and electronic records, which  ROI vendors and provider representatives told us makes responding  to medical record requests more difficult and time consuming. Examples of patient access complaints provided to us by OCR included  complaints about the following: providers not responding even after the patient made multiple  requests, or providers taking longer than 30 days to respond to a  request for medical records or other information ; providers charging excessive fees for copies of patients’ medical providers not responding to requests from personal representatives or providers denying medical records requests from a parent or parents  of children. HHS provided us  with technical comments, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional  committees, the Secretary of Health and Human Services, and other  interested parties.
Why GAO Did This Study

HIPAA and its implementing regulations, as amended by the Health Information Technology for Economic and Clinical Health Act, require health care providers to give patients, upon request, access to their medical records, which contain protected health information (i.e., diagnoses, billing information, medications, and test results). This right of access allows patients to obtain their records or have them forwarded to a person or entity of their choice—such as another provider—in a timely manner while being charged a reasonable, cost-based fee. Third parties, such as a lawyer or someone processing disability claims, may also request copies of a patient's medical records with permission from the patient.
The 21st Century Cures Act included a provision for GAO to study patient access to medical records. Among other things, this report describes (1) what is known about the fees for accessing patients' medical records and (2) challenges identified by patients and providers when patients request access to their medical records. GAO reviewed selected HIPAA requirements and implementing regulations and guidance, and relevant laws in four states selected in part because they established a range of fees associated with obtaining copies of medical records. GAO also interviewed four provider associations, seven vendors that work for providers, six patient advocates, state officials, and Department of Health and Human Services' (HHS) officials. The information GAO obtained and its analysis of laws in the selected states are not generalizable. HHS provided technical comments on this report.

What GAO Found

Available information suggests that the fees charged for accessing medical records can vary depending on the type of request and the state in which the request is made. Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations, providers are authorized to charge a reasonable, cost-based fee when patients request copies of their medical records or request that their records be forwarded to another provider or entity. In the case of third-party requests, when a patient gives permission for another entity—for example, an attorney—to request copies of the patient's medical records, the fees are not subject to the reasonable cost-based standard and are generally governed by state law. According to stakeholders GAO interviewed, the fees for third-party requests are generally higher than the fees charged to patients and can vary significantly across states.
The four states GAO reviewed have state laws that vary in terms of the fees allowed for patient and third-party requests for medical records. For example, three of the states have per-page fee amounts for patient and third-party records requests. The amounts charged are based on the number of pages requested and vary across the three states.
One of the three states has established a different per-page fee amount for third-party requests. The other two do not authorize a different fee for patient and third-party requests.
One of the three states also specifies a maximum allowable fee if the provider uses an electronic health records system. The other two do not differentiate costs for electronic or paper records.
In the fourth state, state law entitles individuals to one free copy of their medical record. The statute allows a charge of up to $1 per page for additional copies.
Patient advocates, provider associations, and other stakeholders GAO interviewed identified challenges that patients and providers face when patients request access to their medical records.
Patients' challenges include incurring what they believe to be high fees when requesting medical records—for example, when facing severe medical issues that have generated a high number of medical records. Additionally, not all patients are aware that they have a right to challenge providers who deny them access to their medical records.
Providers' challenges include the costs of responding to patient requests for records due to the allocation of staff time and other resources. In addition, according to provider associations and others GAO interviewed, fulfilling requests for medical records has become more complex and challenging for providers, in part because providers may store this information in multiple electronic record systems or in a mix of paper and electronic records.