Healthcare providers and their release of information vendors continue trying to navigate the February 25, 2016 OCR guidance on patient access to medical records. One of the most common issues involves distinguishing a patient directed request from a patient attorney request. As of February 15, 2018, there is some official clarification from the United States District Court for the Northern District of Alabama.
In Bocage, the patients’ attorneys requested medical records utilizing a law firm request letter coupled with a HIPAA authorization. Bocage v. Acton Corporation, Case No. 2:17-cv-01201-RDP (N.D. Ala. Filed Feb. 15, 2018). The defendant responded to the attorney’s request by supplying the medical record and invoicing the attorney a $5 retrieval fee.
The patient’s attorney argued that the $5 retrieval fee violates HIPAA and that an attorney representing an individual is subject to the fee restrictions imposed by HIPAA and HITECH. However, the court disagreed, relying on the February 25, 2016 guidance, which states in relevant part, “Where the third party is initiating a request for PHI on its own behalf, with the individual’s HIPAA authorization the access fee limitations do not apply.” For more information, see Individuals’ Rights under HIPAA to Access Their Health Information 45 CFR § 164.524, U.S. Dep’t of Health & Human Services (Feb. 25, 2016).
The court’s summary holding states that “a legal representative who requests an individual’s protected health information (and is not a personal representative of the individual) is not entitled to the fee limitations imposed under HIPAA by 45 C.F.R. § 164.524(c)(4).” Bocage at 12.
While this case is only persuasive authority in other states, this is a federal court decision regarding federal law and Ciox feels confident this decision is consistent with OCR enforcement efforts. Therefore, providers and vendors now have a United States District Court decision supporting the position that when a third party submits a HIPAA authorization the request is deemed to be an authorized request for which the HIPAA labor cost standards do not apply.
.svg)
