Are Attorneys Entitled to “HIPAA Rate”?

Over the past year, numerous lawsuits and complaints to the HHS Office for Civil Rights (“OCR”) have been filed by plaintiffs’ attorneys over a seemingly obscure HIPAA issue – the rate that health care providers and their release-of-information contractors may charge attorneys for copies of their clients’ medical records. In response to a Freedom of Information Act request, we have obtained a copy of a letter from OCR (Region III) confirming that requests from attorneys are not subject to the cost-based “HIPAA rate” applicable to patients’ requests for records, but rather are subject to the usually higher fee schedule established under state law.

The fact pattern that gives rise to this issue is typically that an attorney is bringing an action on behalf of a former patient that requires evidence of injury or other medical information. The attorney sends a letter to a health care provider requesting a copy of the former patient’s medical records. The attorney’s request will include a HIPAA-compliant authorization, signed by the patient (or the patient’s personal representative). The attorney often will claim entitlement to the fee limitation at 45 C.F.R. § 164.524(c)(4), which limits a health care provider’s charges to a patient for access to medical records to a “reasonable, cost-based fee.” The attorney also often cites to another Privacy Rule provision (§ 164.524(c)(3)(ii)) that permits a patient to have the health care provider send a copy of the patient’s records to a designated third party.

Attorneys have claimed that, because they are acting on behalf of the patient, they are entitled to the HIPAA rate for patient requests. In online postings, they have called it a “trick” when health care providers clarify that the HIPAA rate only applies to requests that come directly from patients, and have encouraged the filing of complaints with OCR in response to such clarifications. And, despite no private right of action under HIPAA, they have brought claims under state law claiming that they are entitled to the rate established for patients under HIPAA, rather than the rate that state law establishes as reasonable.

In response to a Freedom of Information Act request, we recently received an OCR Region III response, dated March 25, 2015, to one of these attorney complaints (click here for a copy). The letter distinguishes between “an individual’s right to access their protected health information, verses an attorney requesting copies of medical records with a signed Authorization by the patient.” OCR states that “[t]he rights under the individual access provisions at 45 C.F.R. § 164.524(a)(1) apply only to individuals (or their personal representatives under 45 C.F.R. § 164.502(g)) who request access to their medical records.… Since there was no request made directly by the individual and the attorney does not constitute a personal representative for purposes of 45 C.F.R. § 164.502(g), the requirements under 45 C.F.R. § 164.524(a)(1) do not apply here.” The letter further clarifies that state law governs the fees for attorney requests:

"With respect to the cases where a provider gives the medical records to the attorney, because the copy of the medical record is being provided under the authority of 45 C.F.R. § 164.502(a)(1)(iv), there is no applicable HIPAA restriction on the fees that the covered entity or business associate may charge in connection with such disclosure. In the absence of any HIPAA restriction on the fees, state law restrictions may apply."

Although this OCR letter is not binding on other OCR regions, it likely is the result of consultation with OCR headquarters. OCR has stated that it will soon be issuing further guidance on an individual’s right of access to protected health information, and we would not be surprised to see this upcoming guidance include the clarification included in this Region III letter.