When health care providers provide copies of medical records to an individual patient or to third parties at the direction of that individual patient, they are permitted under HIPAA to recover “a reasonable, cost-based fee.” Health care providers have generally determined this fee by relying on a schedule established by state statute, such as the Michigan Medical Records Act (MRA). However, recent guidance issued by the Office for Civil Rights of the U.S. Department of Health and Human Services (OCR) may preempt these state statutes if the state statutes are “contrary to” the guidance (i.e., where it is not possible to comply with both HIPAA and the state statute). Where state statutes merely provide greater rights of access than HIPAA, however, the state statute is not preempted and health care providers must comply with both.

The guidance issued by OCR permits a fee that includes only: (1) labor for copying the records requested by the individual whether in paper or electronic form; (2) supplies for creating the paper copy (e.g., toner and paper) or electronic media (e.g., CD or USB drive) if the individual requests that the electronic copy be provided on portable media; (3) postage, when the individual requests that the copy, or the summary or explanation, be mailed; and (4) preparation of an explanation or summary of the records, if agreed to by the individual. The guidance also describes three methods that health care providers may use to calculate the fee. First, the provider may calculate the actual labor and supply costs incurred to fulfill the request. However, this cost may only include the items outlined above. Second, the provider may develop a schedule of costs for labor based on average labor costs to fulfill standard types of access requests. Again, any such average may only be derived from the costs specifically permitted (so, for example, if time is spent searching and retrieving the information, this time may not be included). Finally, for all electronic requests of PHI maintained electronically, the health care provider may simply charge a flat fee of $6.50 (if paper is involved, however, one of the other two methods must be used).

This guidance arguably preempts fee schedules such as that under the MRA. The MRA established a fee schedule based on the number of pages in the records, ranging from $1.17 a page to $0.23 a page (as well as an initial fee of $23.34 that may not be charged if the patient requests his or her own record). This schedule is not cost-based, nor is it calculated based on actual or average costs of labor and supplies. More importantly, the MRA rates are likely much higher than the actual or average costs of labor and supplies. However, the MRA also provides that a “medically indigent individual” may not be charged anything for copies of their medical records. This provision is not contrary to anything in HIPAA, merely provides greater rights of access for certain individuals, and is therefore likely not preempted.

What this means for health care providers is that they can no longer rely on state statutes as a “safe harbor” with respect to the medical records fees they charge for information proficed to patients or to others at the direction of the patient. They will need to calculate their actual or average costs of labor and supplies, or outsource medical record production to a third party who has already calculated these costs