It used to be a reasonable charge was appropriate, either a flat fee, such as $25 or an actual accounting of costs.  That is still true today, however, the numbers have changed a bit.  In fact, recently, Health and Human Services published additional information to help clarify what is acceptable fees.  You can see that here.

This all falls under Individuals’ Right under HIPAA to Access their Health Information  45 CFR § 164.524.  Per this guidance: “The Privacy Rule generally requires HIPAA covered entities (health plans and most health care providers) to provide individuals, upon request, with access to the protected health information (PHI) about them in one or more “designated record sets” maintained by or for the covered entity. This includes the right to inspect or obtain a copy, or both, of the PHI, as well as to direct the covered entity to transmit a copy to a designated person or entity of the individual’s choice.”

So, what are the rules?

1. Patients have a right to their records, billing and payment, insurance, lab tests, images, wellness and disease management information and clinical notes.

2. Patients don’t have to sign a document, but it is strongly recommended to verify identity.

3. Form and Format of Patient information matters.  If the patient requests digital data, you must provide digital data as long as you have digital data. If you only maintain paper records, then printed copies are acceptable.

4. Emails should be encrypted.  Unencrypted email is allowed only if the patient specifically requests it and is notified of the dangers of unsecured transmissions containing their Protected Health Information.

5. A patient can bring their own media (thumb drive, backup drive, etc.), but you need to complete a Risk Analysis on the device prior to plugging it in or transferring data to it.  If you are unsure, call IT.

6. Requests for records can be denied only if the request involves psychotherapy notes, info for a legal proceeding, requested by an inmate where the request would jeopardize the health, safety, security, custody or rehab of the inmate or staff of the correctional facility.

7. You can charge a reasonable, cost-base fee to cover certain labor, supply and postage costs.  You have to use one of the following methods: Actual Costs, Average Costs or Flat fee for electronic copies of PHI maintained electronically.

Lets dive deeper into these categories to find out which one is best for your practice.

Actual costs: You can add up the actual time it takes your staff to copy records or create a summary letter.  Charging for the time to look up or retrieve the records is NOT allowed.  You can also add hard costs such as media (paper, CD/DVD Disc or USB Drive) as well as postage.  If you go this route, you must inform the patient PRIOR to executing the request as to an approximate cost.

Average costs: Most people go this route to put a reproducible cost on each request.  It’s the same as Actual Costs in that you can charge per page plus media, however, there is a big gotcha here — you can’t charge per page if the data lives in digital form.  So, if you have all of your xrays in digital form, you must send them in digital form (email) and cannot charge to print them out.

Flat Fee for electronic copies of PHI maintained electronically: Realistically, this is the route most dentists and small practices will go because of how data is created and stored in today’s technology.  This fee is capped at $6.50, inclusive of all labor, supplies and any applicable postage.

To sum this all up — if you have digital data, you should email it and charge no more than $6.50.  If you have paper charts or film xrays, you can charge the actual costs of labor, media and postage and make sure to write up a bill of charges and inform the patient of approximate cost before starting.

And if someone tries to charge you a crazy amount, and try to blame it on HIPAA — now you have the real answer.