HIPAA Confusion Leading to Litigation: Health Care Providers May Continue to Charge State Fee Schedules for Third-Party Medical Record Requests

Recent changes to HIPAA have led to confusion, with a significant number of attorneys claiming that they are entitled to a lower “HIPAA rate” for copies of medical records. While the issue may seem arcane, this confusion is becoming the subject of litigation against covered entities and their release-of-information vendors.

HIPAA permits covered entities to disclose health information to attorneys in numerous situations, such as in response to an individual’s authorization, subpoena, and court orders that meet the HIPAA requirements. The term “individual” is defined to mean the person who is the subject of the information. In these situations, covered entities may charge a fee for providing a copy of the individual’s record. These fees usually are established by state law. Since the Privacy Rule was finalized in December 2000, the right for individuals to access their own health information (under 45 C.F.R. § 164.524(c)(4)) has restricted the fees that a covered entity may charge an individual for protected health information maintained in a “designated record set,” which generally includes medical records and billing records. Under this limited Privacy Rule section, a health care provider may charge an individual only a “reasonable, cost-based fee” for a copy of the individual’s medical record. HIPAA has and continues to provide that covered entities may charge third parties, including attorneys that do not qualify as personal representatives, the fee schedule established under state law. In the commentary to the December 2000 Privacy Rule, the U.S. Department of Health and Human Services (“HHS”) made clear that it did “not intend to affect the fees that covered entities charge for providing protected health information to anyone other than the individual.” 65 Fed. Reg. 82,557 (Dec. 28, 2000).

In the preamble commentary to 2002 amendments to the Privacy Rule, HHS reiterated this position. In response to concerns that HIPAA restricted the amount that could be charged to attorneys and other third parties, HHS stated:

[HHS] clarifies that the Rule, at § 164.524(c)(4), limits only the fees that may be charged to individuals, or to their personal representatives in accordance with § 164.502(g), when the request is to obtain a copy of protected health information about the individual in accordance with the right of access. The fee limitations in § 164.524(c)(4) do not apply to any other permissible disclosures by the covered entity, including disclosures that are permitted for treatment, payment or health care operations, disclosures that are based on an individual’s authorization that is valid under § 164.508, or other disclosures permitted without the individual’s authorization as specified in § 164.512.

67 Fed. Reg. 53,254 (Aug. 14, 2002).

The 2009 Health Information Technology for Economic and Clinical Health (“HITECH”) Act and a related rule (commonly known as the HIPAA Omnibus Rule) recently have created some confusion in this area. Part of this confusion may stem from the Privacy Rule permitting an individual to direct a covered entity to send a copy of the medical record to a third party. 45 C.F.R. § 164.524(c)(3)(ii). Or it may be the Omnibus Rule’s clarification that a covered entity may not charge an individual a fee established under state law when the fee is more than the actual cost of copying the medical record. 78 Fed. Reg. 5636 (Jan. 25, 2013). Whatever the source of confusion, an increasing number of attorneys (such as attorneys in malpractice cases) are claiming that they are entitled to the “HIPAA rate” rather than the fee established under state law.

To the contrary, HIPAA continues to permit covered entities to charge third-party requestors the fees established under state law. First, the regulations governing fees for providing copies of protected health information continue to only govern requests from individuals. Section 164.524(c)(4), which limits fees to a reasonable, cost-based amount, only applies “[i]f the individual requests a copy of the protected health information.” Similarly, while the HITECH Act and Omnibus Rule clarify that an individual may have a copy of the medical record sent to a designated third party, this right only applies to “an individual’s request for access.” See 45 C.F.R. § 164.524(c)(3)(ii). While the preamble discussion clarifies that a covered entity may not charge the state-authorized fee if in excess of the covered entity’s costs, this discussion is in reference to requests from individuals (rather than from third parties). 78 Fed. Reg. 5636 (Jan. 25, 2013).

Second, third-party requests for medical records are subject to a limit on the sale of protected health information (added pursuant to the HITECH Act), which explicitly permits the covered entity (or its business associate) to charge “a fee otherwise expressly permitted by other law.” See 45 C.F.R. § 164.502(a)(5)(ii)(B)(2)(viii). In the commentary to the HIPAA Omnibus Rule, HHS clarifies that business associates, such as release-of-information vendors, may continue to charge third parties those fees permitted under state law:

For example, a number of commenters stated that covered entities often outsource to release of information (ROI) vendors the processing of requests for copies of medical records from third parties and that these vendors and not the covered entities bill for the reasonable costs of providing the records to the requestors. Commenters asked that the final rule clarify that business associates can continue to receive payment of costs from third parties for providing this service on behalf of covered entities.

* * * * *

[W]e add the term “business associate” in the general exception permitting reasonable, cost-based fees to prepare and transmit data (or fees permitted by state laws) to make clear that business associates may continue to recoup fees from third party record requestors for preparing and transmitting records on behalf of a covered entity, to the extent such fees are reasonable, cost-based fees to cover the cost to prepare and transmit the protected health information or otherwise expressly permitted by other law.

78 Fed. Reg. 5606 (Jan. 25, 2013).

Accordingly, third-party requests for medical records, including attorneys’ requests, continue to be subject to fees established under state law. A request from an attorney qualifies for the “HIPAA rate” rather than the state-authorized fee only if the attorney qualifies as the individual’s “personal representative” under HIPAA, meaning that the attorney has authority to act on behalf of the patient with respect to making decisions related to health care (i.e., treatment decisions). See 45 C.F.R. § 164.502(g). HHS has clarified that “an attorney of an individual may or may not be a personal representative under the rule depending on the attorney’s authority to act on behalf of the individual in decisions related to health care.” 65 Fed. Reg. 82,651 (Dec. 28, 2000). The mere fact that an attorney represents an individual in litigation does not mean that the attorney has authority to act on behalf of the individual in decisions related to health care.

When a covered entity receives a request from an attorney or other third party who is not the individual’s personal representative under HIPAA, the covered entity should continue to require a HIPAA-compliant authorization (or otherwise meet the requirements for a disclosure, such as going through the subpoena or court order process) and the covered entity or its release-of-information company may continue to charge the state-authorized copying rate.