Are Attorneys Entitled to the HIPAA Medical Fee Rate?

Patients (or their personal representatives, who are individuals authorized under law to act on behalf of a patient in making health-care related decisions) typically request copies of their medical records from their providers. Traditionally, state law governed the amount providers could charge for a medical record copy fee. State laws typically permit providers to charge a per-page copy fee, of up to a certain dollar value, or to charge a flat fee of up to a certain amount for the entire medical record. Many covered entities simply charge the maximum amount that state law allows. Such state laws (and the healthcare providers acting in accordance with them), however, cannot do an end-run around the HIPAA right of access rules, the latter of which provide that HIPAA medical fees – medical record copy fees –  must be reasonable. The permitted HIPAA medical fee for attorneys is discussed.

A HIPAA medical fee, that is a flat fee, untethered to the actual costs of reproduction, may be considered excessive under the HIPAA Privacy Rule’s right of access provisions. When the two laws are in conflict, HIPAA, the federal law, prevails.    

The HIPAA Privacy Rule’s Right of Access and the HIPAA Medical Fee

This point – that HIPAA preempts contrary state law – has been reiterated under guidance provided by the Department of Health and Human Services’ (HHS) Office for Civil Rights. This guidance specifies that HIPAA, through its right of access provisions, limits the amounts that a covered entity may charge a patient requesting access to his or her medical records.

Under the HIPAA Privacy Rule Right of Access, medical record copy fees must be reasonable and cost-based.

This means that providers may only charge patients, or their personal representatives, for the following:

• Labor for copying the PHI requested by the individual, whether in paper or electronic form.  
  • Labor for copying includes only labor for creating and delivering the electronic or paper copy in the form and format requested or agreed upon by the individual, once the PHI that is responsive to the request has been identified, retrieved or collected, compiled and/or collated, and is ready to be copied.
• Supplies for creating the paper copy (i.e.,  paper, toner) or electronic media (i.e., CD or USB drive) if the individual requests that the electronic copy be provided on portable media.
• Labor to prepare an explanation or summary of the PHI, if the individual in advance both chooses to receive an explanation or summary and agrees to the fee that may be charged.

The HIPAA rule requiring that medical record copy fees must be reasonable and cost-based has led to development of the term “HIPAA Rate.” This term is used colloquially to describe the HIPAA medical record fee for copies of medical records – a fee that is cost-based, and therefore often lower, than that traditionally permitted under state law.

Does the “HIPAA Rate” Apply to Attorneys Seeking Medical Records on Behalf of Their Clients?

According to 2017 Guidance provided by the Office for Civil Rights (OCR) of the Department of Health and Human Services, the HIPAA rate applies when:

• A patient (or the patient’s personal representative) requests copies of medical records; and
• When a patient (or the patient’s personal representative) directs a covered entity to send PHI to a third party.

Under the HIPAA Privacy Rule, a covered entity in the above two circumstances is prohibited from charging an individual who has requested a copy of her PHI more than a reasonable, cost-based fee for the copy; the fee may cover only certain labor, supply, and postage costs that may apply in fulfilling the request.  

In contrast, the “HIPAA rate” does NOT apply when a third party directly requests PHI from a covered entity. Where the third party is initiating a request for PHI on its own behalf, with the individual’s HIPAA authorization, the cost-based fee restrictions do not apply.

Therefore, when an attorney – a third party – directly requests PHI from a covered entity and provides the required HIPAA patient authorization, the attorney does not have the right to be charged the “reasonable, cost-based fee rate” that individuals who seek PHI are entitled to. This is because attorneys are not considered to be “personal representatives” to whom the cost-based fee applies. A personal representative is an individual authorized to make patient healthcare decisions. A law firm seeking medical records to be used in litigation is not requesting medical records to make patient healthcare decisions; it is simply acting as a lawyer. Therefore, the fee amount attorneys may be charged for access to patient medical information, is governed by state law, not HIPAA.