There is a lot of uncertainty about how much covered entities can charge patients for PHI access under HIPAA Rules. Many healthcare providers feel they have received conflicting information about the allowable charges for providing patients with copies of their protected health information (PHI).
Patients are likewise confused. Many individuals would like to obtain copies of their health data, and are allowed to do so under the HIPAA Privacy Rule, yet they are concerned about how much they will be charged for exercising their rights.
The U.S. Department of Health and Human Services (HHS) has issued a clarification on the charges that can be applied by healthcare providers.
Previous guidance issued by the HHS had been misinterpreted by many covered entities. Some believed that the maximum permitted charge was $6.50. The FAQs published on the HHS website explain that covered entities should charge a flat fee of $6.50 (or less) for providing patients with copies of their ePHI. That fee includes labor, printing, and supplies.
A flat fee can be charged if covered entities do not want to calculate the actual costs for providing patients with copies of their ePHI. However, the charging of a flat fee is only one option.
Alternatively, covered entities can calculate the actual (allowable) costs for providing each individual with a copy of their PHI. Covered entities also have the option of using a schedule of average (allowable) costs for fulfilling standard requests.
The HHS has also clarified how “unusual” requests for copies of ePHI can be handled. Even if a covered entity chooses to charge patients under the average cost model or charges a flat fee for PHI access, patients may be charged more for requests that do not fit the standard model. Should that be the case, covered entities would still only be able to charge for costs permitted by the Privacy Rule.
Patients should be provided with copies of their PHI for free, although covered entities are permitted to charge patients for supplies and labor costs for providing copies of PHI, provided the fees are reasonable. Labor costs can include the time taken to print, mail, or email PHI for example, but not the cost of retrieving records or searching for patients’ PHI.
Office for Civil Rights Director Jocelyn Samuels explained that the provision of PHI to patients is “critical to enabling individuals to take ownership of their health and well-being,” she went on to say that “this core right is rendered meaningless when individuals cannot afford to pay the fees.”