HIPAA goes hand-in-hand with the new regulations.

You may recall from some of my previous Compliance columns (tinyurl.com/OPLKBrown ) that the Information Blocking Rule requires patients to have access to your secure portal to see their medical records within a timely manner. Failure to deliver can lead to consequences.

On Dec. 15, 2022, a Florida primary care practice agreed to pay $20,000 and undergo a 2-year Corrective Action Plan for delaying the provision of medical records to a patient.¹ The case had dragged on for more than 3 years, no doubt costing the practice much more. The situation involved a daughter trying to get her deceased father’s medical records for months.

The expectation for medical record provision is within 30 days under the Health Insurance Portability and Accountability Act (HIPAA), with proposals during the past few years aimed at shortening this requirement to 15 days. Meanwhile, 4 business days is considered timely for the Centers for Medicare & Medicaid Services (CMS) interoperability programs, such as the Merit-based Incentive Payment System (MIPS).

Patient rights

The U.S. Department of Health & Human Services (HHS) explains to patients, “the Privacy Rule gives you, with few exceptions, the right to inspect, review, and receive a copy of your medical records and billing records that are held by health plans and health care providers covered by the Privacy Rule.”² For eyecare practices, complete record releases must be for all medical information in the patient’s chart unless the patient limits the request. Letters and chart notes from other providers in the practice charts must now be part of the release.

The Office for Civil Rights (OCR) encourages patients to “Get It, Check It, and Use It” regarding their medical records.³ This campaign reinforces the OCR’s expectations for patients to become actively engaged in their and their family’s health care and wellness by reviewing their medical records. In addition, the OCR provides this offer to help: “If you think your health information privacy rights have been violated in any way, you have the right to file a complaint with the OCR. … We’re serious about working with you to protect your health information and make sure you have access to it.”³

Regarding practices charging patients for their medical records, HHS offers this guidance to patients:

“A provider cannot deny you a copy of your records because you have not paid for the services you have received. However, a provider may charge for the reasonable costs for copying and mailing the records. The provider cannot charge you a fee for searching for or retrieving your records.”²

Review your policies

Now is a great time for practices to review and update their medical records release policies to ensure compliance with federal HIPAA laws and any applicable state laws. For instance, the Pennsylvania Department of Health updated its charge limits for medical records provision, effective Jan. 1, 2023.⁴ Generally, follow the stricter law and check with your state medical society for further guidance. OP

REFERENCES

1. HHS Civil Rights Office Resolves HIPAA Right of Access Investigation with $20,000 Settlement. HHS. https://bit.ly/3Qq7nzB . Accessed Jan. 5, 2023.
2. Your Medical Records. HHS. https://bit.ly/2YXmANe . Accessed Jan. 5, 2023.
3. Get it. Check it. Use it. HHS, OCR. https://bit.ly/3WNbGre . Accessed Jan. 5, 2023.
4. Amendments to Charges for Medical Records. Pennsylvania Department of Health. https://bit.ly/2G0KpLE . Accessed Jan. 5, 2023.

Ms. Brown is a senior consultant with BSM Consulting in Tucson, AZ. She has experience in the ophthalmic industry holding managerial, clinical, and surgical roles for more than 30 years.