Dec. 10, 2004

Access to medical records

Following closure of a local physician practice, there is an advertisement in the Los Alamos Monitor informing patients of the closure and the process to follow when requesting copies of their medical records. As a professional trained in health information management and health-care privacy, I have been asked by numerous individuals these specific questions: 1) Can the provider charge for copies of records? 2) How can I obtain copies of my entire medical record; and 3) I requested my records weeks ago and have not received the copies. How long should I wait for the copies?

Access to an individual's medical record and the right to receive copies are fundamental rights outlined in new federal privacy legislation known as HIPAA (Health Insurance Portability and Accountability Act of 1996, effective April 2003). Remember the "Notice of Privacy Practices" that we began receiving in April 2003 when we presented to a healthcare provider? One of the required items a health-care provider should have in the notice are the patient rights outlined in HIPAA. One of the patient rights is the Right to Inspect and Copy. My response to the above questions are as follows:

• Can the provider charge for copies? The answer is yes. The Privacy Rule permits the covered entity to impose reasonable, cost-based fees. The fee may include only the cost of copying (including supplies and labor) as well as postage, if the patient requests that the copy be mailed. If the patient has agreed to receive a summary or explanation of his or her protected health information, the covered entity may also charge a fee for preparation of the summary or explanation. The fee may not include costs associated with searching for and retrieving the requested information. Refer to 45 CFR 164.524.
• Do I have the right to obtain copies of my entire medical record? The answer is yes. There are a few exceptions noted in the HIPAA privacy rule, but generally speaking, if an individual requests copies of their entire medical record, the provider should honor the request (without limiting the number of years copied). Exceptions to an individual's request for their entire medical record are expected to be rare because denial by a provider must meet specific reasons outlined in the HIPAA privacy rule.
• Is there a time limit requirement to produce the requested copies of my records? The answer again is tes. All requests are to be processed within 30 days if information is on-site, or 60 days if information is stored off-site. A 30-day extension to the deadline is allowed if the provider sends the requester a written statement noting the reasons for the delay and a date expected for completion of the request. This results in 60 days for on-site requests and 90 days for off-site requests as the maximum time allowed for processing requests.

Everyone should get to know these important rights, which help you protect your health information. More information about HIPAA and patient rights is available at www.hhs.gov/ocr/hipaa/ online, or call the HIPAA regional hotline at 1-866-282-0659. Individuals who believe their rights have been violated, may file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. There is a fact sheet on "How to File a Health Information Privacy Complaint with the Office for Civil Rights" at this Web site. The fact sheet contains a standardized form with instructions for filing a complaint.

--Catherine Porto, Team Leader, Health Information, Occupational Medicine (HSR-2), Laboratory privacy liaison to UC privacy officer