When patients request a copy of their medical record, how much do you charge? And how do you itemize that expense? Do you have clear-cut policies about how to charge? An often overlooked element in the HIPAA Standards for Privacy of Individually Identifiable Health Information concerns how much an entity may charge patients or their designated representative for a copy of their medical record.
The HIPAA privacy standards section 164.524 (c)(4) states the following about charging patients for copies of their medical records:
Fees: If the individual requests a copy of the protected health information or agrees to a summary or explanation of such information, the covered entity may impose a reasonable, cost-based fee provided that fee includes only the cost of:
(i) Copying, including the cost of supplies for and labor of copying, the protected health information requested by the individual;
(ii) Postage, when the individual has requested the copy, of the summary or explanation, he mailed; and
(iii) Preparing an explanation or summary....
The preamble to HIPAA privacy standards section 164.524 (c)--Provision of Access further states:
We clarify this provision in the final rule. If the individual requests a copy protected health information, a covered entity may charge a reasonable, cost-based lee for the copying, including the labor and supply costs of copying. If hard copies are made, this would include the cost of paper. If electronic copies are made to a computer disk, this would include the cost of the computer disk. Covered entities may not charge any fees for retrieving or handling the information or for processing the request. If the individual requests the information to be mailed, the fee may include the cost of postage. Fees for copying and postage provided under state law, but not for other costs excluded under this rule, are presumed reasonable. If such per page costs include the cost of retrieving of handling the information, such costs are not acceptable under this rule (emphasis added).
Providers should familiarize themselves with the HIPAA mandate and establish a clear-cut policy for medical-record copy charges.
What Can and Cannot Be Charged?
In addition to paying for copies of the medical record, patients who request a summary of their record must agree in advance to pay the cost of such a summary. Therefore, many of the activities listed in the sidebar above will occur, and providers should determine which activities can be charged and which cannot. Also, a qualified individual needs to review and summarize the record.
Alternatively, the organization could consider these options:
* Establish an appointment schedule to have a health information professional, the attending physicians, and/or another healthcare professional review and explain the contents of the record to the patient
* Define the 'summary' as including certain designated documents such as transcribed or typed documents in the patient record
An hourly rate could be established for the first option, shared with the patient or patient's representative, and accepted by the patient before any effort begins. For the second option, the health information management (HIM) department could determine an average charge for these types of reports in a medical record of different stay increments, such as 1-5 days, 6-10 days, 11-20 days, 21-40 days, and more than 40 days. The charge would vary by length of stay. These are just two options; the healthcare organization's privacy committee may have considered others.
HIPAA Preempts Many State Laws
Although the preamble to the HIPAA privacy standards indicates that the per-page copy fees established by the states will be 'presumed' reasonable, some experts believe that this will be a point of contention with plaintiff attorneys nationwide. Many state-mandated copy fees are higher than the costs involved in the single activity of copying and, therefore, could be preempted by the HIPAA regulations. Preemption is intended to protect patients' right to privacy and to allow patients greater access to their protected health information.
Given these criteria, the state-mandated fees could be more costly than the labor needed to make copies, possibly making patients' access to their protected health information cost-prohibitive. As a result, HIPAA may open a quagmire whereby state fees are preempted by the lower 'reasonable' cost to make the copies. Note that this mandate applies only to copies requested by individuals or their designated representatives. Other requesters, such as insurers and attorneys, can continue to be charged the state-mandated fee.
Some state-mandated fees consist of a relatively substantial retrieval or handling charge ($10-$20) plus a per-page copy fee ($0.25-$1.00). Every state varies. Clearly, the HIPAA privacy standards preamble bars any covered entity from charging individuals the 'retrieval or handling lee.'
Negotiating with a Copy Service
Healthcare organizations that use a copy service should be aware that copy services nationwide are gearing up to propose modifications to their current contracts with clients to reflect the impact of HIPAA's mandate related to charging for copies. In states where patients can be charged for copies, providers may encounter requests for copy-service contract modifications such as these:
* Charge the patient the cost to copy, and charge the client healthcare organization the difference (including retrieval costs, invoicing costs, and managerial oversight)
* Begin charging other healthcare providers who traditionally received free copies, such as hospitals and physician offices (unlikely, but possible)
* Charge the client healthcare organization for copies previously provided free or at a reduced rate
* Set a flat monthly rate for unreimbursed services
* Require healthcare organization staff to handle HIPAA-related requests
As with any process change, providers should consider the relative merits of outsourcing. If the activity is not outsourced, monitoring the revenue impact will be important for budgeting purposes even though this revenue source may be minor compared with other sources of revenue. Discussing outsourcing options with qualified firms may disclose that, even with charge-back provisions, the firms may be more cost-effective and process-efficient than the in-house efforts.
Processing Requests Internally
Each organization needs to assess the advantages of handling the release-of-information activities internally. From a HIPAA standpoint, doing so would enable an organization to more closely control the release processes, meet the timeliness requirement mandated by HIPAA, and avoid involving a third party in the activities.
From a labor consideration, one full-time equivalent (FTE) employee probably can handle about 15 to 20 requests per working day. Conservatively, 0.5 to 0.75 hours would be required to perform each request that requires retrieval and copying.
Efficiencies are gained with electronic access to online documents. Although off-site storage, paper-records systems, and uncontrolled incomplete records can hinder timely processing, some requests require only a master patient index look-up or a reprint of a report stored electronically or are rejected due to inadequate identifying information or an unacceptable authorization, thereby requiring less response time.
Organizations that provide all the equipment for the copy service incur much of the expense. A healthcare organization that is pulling the records for a copy service to copy and bill is losing payment for the majority of the labor effort involved in processing a request.
On the other hand, from a staffing standpoint, providing this function in-house will mean hiring additional FTEs, adding to the department's expenses. Furthermore, it turnaround time was a consideration when the organization outsourced this function in the past, HIPAA's deadlines for completing release-of-information requests should be considered. Assessing whether your HIM department has adequate staffing and management oversight available to maintain timely responses to requests is imperative.
Providers can offset some direct costs under HIPAA through the revenues received for providing copies, but indirect costs will not be subsidized under HIPAA's restrictive 'individual' covenant. Further, organizations should expect that 'non-individual' requests, which can continue to be charged the state-mandated rates, will decline because some of those requesters will place the burden of obtaining a copy of the record on the individual.
Next Steps
CFOs, cost accountants, privacy officers, and HIM directors should discuss the impact that limitations on the cost of making copies under HIPAA will have on their organization and evaluate the best approach to achieve compliance, patient-friendly service, and fiscal goals.
AT A GLANCE
The HIPAA privacy rule allows providers to charge for providing copies of medical records to patients and their representatives.
* Providers need to know which activities in the retrieval and handling of such information can be included in the medical record copy charges.
* State-mandated fees for copies vary and may be preempted by HIPAA, requiring careful review by providers.
* Healthcare organizations that use a copy service may need to determine whether bringing the activity in house would be more cost-effective under HIPAA.
Practice Brief:
Release of Information Laws and Regulations, by Harry Rhodes and Joan C. Larson, looks at factors that affect the cost of release of information. The document also lists state release-of-information laws and regulations. To view the document, which was prepared jointly by the American Health Information Management Association and the Association of Health Information Outsourcing Services, visit library.ahima.org/xpedio/groups/public/documents/ ahima/pub_bok1_000052.html.
HIPAA PRIVACY RULE CHALLENGES
Unanticipated Challenges of the HIPAA Privacy Rule examines the unanticipated challenges that arose after the HIPAA privacy compliance deadline. Patient anxiety over privacy practices, state pre-emption analysis, and confusion over rights of minors are some of the challenges facing privacy officials. HFMA members can view this document free at www.hfma.org/resource/focus_areas/ HIPAA@Work/400230.htm. Nonmembers may purchase printed copies for $15 each by calling HFMA Member Services at (800) 252-HFHA, ext. 2.
POTENTIAL CHARGES FOR RELEASE OF PATIENT INFORMATION UNDER HIPAA Item Activity Possibly No Receipt, review, verification of the authorization x Retrieval of the record x Review of the record for restricted information x Identification of the pages to be copied x Copying of the pages x Reinsertion of the pages back in the record x Entering of the disposition of the request in the x request log Refiling of the record x Purchase of software to log/manage requests x Consumables to print reports, letters x Consumables to print an invoice x PC hardware costs x Copier maintenance costs x Printer, PC maintenance costs x Paper in copier x Toner for printer x Toner for copier x Staples to staple copies x Envelope to mail copies (if requested to be mailed) x Postage (actual) to mail copies (if requested to be x mailed) Handling fees over and above actual postage x EXAMPLES OF STATE-MANDATED COPYING FEES State Charge Arkansas * $5 (1-5 pages); $0.25/page (> 5 pages) Illinois $20 + $0.75 (1-25 pages); $0.50/page (26-50 pages); $0.25/page (> 50 pages) (September 1, 2001) Iowa * $20 (1-20 pages); $1/page (21-30 pages); $0.50/page (31-100 pages); $0.25/page (101-200 pages); $0.10/ page (> 200 pages) Kansas $15 (1-10 pages); $25 (11-50 pages); $25 + $0.35/page (> 50 pages) Kentucky First copy to patient is free; second copy $1/page + actual postage (1994) Minnesota $13.55 + $1.03/page(March 2002) Mississippi Hospitals, reasonable charges; physician practices, $1/page Nebraska $20 + $0.50/page (30-day response requirement); reasonable fee for items that cannot be copied on standard copy machine (August 28, 1999) North Dakota $25 (1-25 pages) + $0.75/page (> 25 pages) (March 1999) Oklahoma $0.25/page + actual postage South Dakota * First copy free; second request, $10 + $0.50/page Tennessee $20 (1-25 pages) + $0.25/page (> 25 pages) Texas $34.85 (1-10 pages) + $1.16/page (11-60 pages); $0.58/ page (61-400 pages); $0.30/page+ actual postage (> 400 pages) (August 24, 2001) * Based on Practice Brief: Release of Information Laws and Regulations, American Health Information Management Association and the Association of Health Information Outsourcing Services, January 1999. Source: 'Copying Costs: What Are They Worth under HIPAA?' Rose T. Dunn, HFMA Mid-American Conference and Trade Show, Branson, Mo., May 2002.
Questions or comments about this article may be sent to the author at rose@firstclasssolutions.com.
Rose T. Dunn, FHFMA, RHIA, CPA, is COO, First Class Solutions, Inc (SM), St. Louis, and a member of HFMA's Greater St. Louis Chapter.
