OCR Guidance on Access Rights Brings Significant Changes to "Reasonable, Cost-Based" Fee Calculation and Other Obligations

On February 25, 2016, the Department of Health and Human Services, Office for Civil Rights ("OCR") issued updated guidance and FAQs regarding an individual's right to access its protected health information ("PHI") under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA").  Buried in the lengthy guidance are significant changes to the meaning of "reasonable, cost-based" fees, and requirements for covered entities (and their business associates) when granting individuals access to PHI.

The Right of Access

HIPAA requires covered entities to provide individuals, upon request, with access to their PHI.  This includes the right to inspect or obtain a copy of their PHI, as well as to direct the covered entity to transmit a copy to a designated person or entity.  Covered entities may only charge individuals a "reasonable, cost-based" fee to access a copy of their records.  The fee may include only the cost of:  (1) labor for copying the PHI, whether in paper or electronic form; (2) supplies for creating the paper copy or electronic media (e.g., CD); (3) postage; and (4) preparing an explanation or summary of the PHI, if agreed to by the individual.

The New Guidance and FAQS

Labor Fees

OCR clarified what costs may be included in the labor component of the "reasonable, cost-based" fee.  Covered entities may include only the labor for creating and delivering a copy of the PHI (whether paper or electronic) once the PHI that is responsive to the request has been identified, retrieved or collected, compiled and/or collated, and is ready to be copied.

OCR reiterated that labor for copying does not include costs associated with reviewing the request for access or searching for, retrieving and otherwise preparing the responsive information for copying.  Specifically, covered entities may not charge for labor to:  (1) locate PHI; (2) identify PHI that is responsive to the request and ensure it relates to the correct individual; or (3) segregate, collect, compile and otherwise prepare responsive information for copying.

Permissible labor costs are limited to reasonable labor costs associated with:  (1) photocopying paper PHI; (2) scanning paper PHI into electronic format; (3) converting electronic information in one format to the format requested or agreed to by the individual; (4) transferring (e.g., uploading, downloading, attaching, burning) electronic PHI to a web-based portal, portable media, e-mail, app, personal health record or other manner of delivery; (5) creating and executing a mailing or e-mail with responsive PHI; and (6) preparing an explanation or summary of the PHI (if the individual chooses in advance to receive the explanation or summary and agrees to the associated fees).

Methods of Calculating Fees

OCR provides for three methods of calculating the "reasonable, cost-based" fee:

1. Actual Costs. A covered entity may calculate the actual labor costs to fulfill a request.  Hourly rates for such labor must be reasonable given the activity being performed.  Further, any applicable supplies (e.g., CD) and postage may be added to the costs.
2. Average Costs. A covered entity may develop a schedule of costs for labor based on average labor costs to fulfill standard types of requests.  OCR stresses that average costs cannot be a per-page fee if the records are maintained electronically.  Applicable supplies and postage may be added.
3. Flat Fee (Only for PHI Maintained Electronically). A covered entity may charge individuals a flat fee for all standard requests for electronic copies of PHI maintained electronically, provided the fee does not exceed $6.50, inclusive of all labor, supplies and postage.

Other Guidance

The guidance makes several other changes to the current access standards.  For example, OCR indicates that covered entities must provide individuals advance notice of the approximate fee they may be charged for the copy.  Upon request, the covered entity also should provide individuals with a breakdown of the charges for labor, supplies and postage.  Similarly, OCR suggests that covered entities post on their websites or otherwise make available an approximate fee schedule for regular types of access requests.

Next Steps

To ensure compliance with this new guidance, covered entities should:

• Consider whether revisions are necessary to their access fee schedules.
• Carefully review their access policies and procedures, and make necessary revisions.
• Review their notice of privacy practices, and, if they will be requiring individuals to make access requests in writing, add this requirement to the description of access rights in the notice.
• If applicable, talk to their release of information vendor regarding these changes.

Reinhart's Health Care team is available to assist you in reviewing your HIPAA policies and procedures, and addressing other HIPAA‑related issues.  Please feel free to contact Heather Fields or Nicole Dermer, or any member of Reinhart's Health Care team, or your Reinhart attorney, to discuss your HIPAA‑related questions or concerns.