|
MA Medical Record Copy Fees Released: October 1, 2023 Massachusetts statute (Chapter 111, section 70) was amended in 2003 to provide a standardized process for calculating an annual update for medical record copying fees. Since that time, MHA has provided members with its calculation using the change in the Consumer Price Index (CPI) for medical care services in effect. Specifically, MHA uses the most recently published U.S. All Urban CPI for Medical Care Services produced monthly by the U.S. Bureau of Labor Statistics (BLS). For the most current analysis, we used the total of the BLS indices for the 12 months through August 2023, divided by the same for the 12 months through August 2022. While some entities may use other state or local factors to determine their rates, the method we use is the same method that the Centers for Medicare and Medicaid Services, private health plans, and the Commonwealth of Massachusetts use in calculating their annual inflationary updates. For the period, effective October 1, 2023, we have determined that the rate using these indices has increased by 1.8292%, which would result in a maximum state-based rate for copying fees as follows:
Recent Federal Guidance on Setting Copying Fees for Medical Information In 2017 the federal Office of Civil Rights (OCR) started issuing a series of frequently asked questions (FAQs) addressing patients’ rights to access their medical records pursuant to the HIPAA provisions. These FAQs were updated on October 20, 2022, with a comprehensive guidance document entitled Individuals’ Right Under HIPAA to Access their Health Information 45 CFR § 164.524 (the Guidance). In particular, one of the FAQs set forth minimum requirements providers must follow regarding the fees individuals (as defined by HIPAA to mean “the person who is the subject of the protected health information.” See 45 C.F.R. 160.103) may be charged for copies of their health information. Similar to our prior Advisories, MHA urges members to consider the following overview of the OCR FAQ and the updated Guidance on copy fees, which we believe providers should continue to follow for requests made by the person who is the subject of the protected health information, whether the information is being provided directly to the patient. Specifically, OCR indicated that a healthcare provider, or a business associate operating on its behalf, may charge an individual a reasonable, cost-based fee that covers certain labor, supply, and postage costs incurred in connection with copying the protected health information (PHI) requested by the individual (or creating a summary or explanation of the information, if the individual agrees). The fee must be calculated in one of the following manners: (1) by calculating actual allowable costs to fulfill each request; (2) by using a schedule of costs based on average allowable labor costs to fulfill standard requests; or (3) in the case of requests for an electronic copy of PHI maintained electronically by either of the methods set forth in (1) or (2), or a flat fee not to exceed $6.50 (including all labor, supplies, and postage). Note that the Guidance has clarified that $6.50 is a permitted alternative to a cost-based fee calculation, but is not a fee cap. The provider, or its business associate, must inform the individual of the approximate fees in advance. In addition, because the fee may vary based on the form and format and manner of access requested or agreed to by the individual, the provider must, at the time such details are being negotiated or arranged, inform the individual of any fees that may be assessed as a result of the form, format and manner requested (or agreed to) by the individual. For example, under HIPAA and state law, it is expected that a provider will waive the fee for any request from a patient for a record that will be used for claims, eligibility reviews, or other administrative reviews being conducted by Medicare, MassHealth, or other public assistance programs (Health Safety Net, Children’s Medical Security Plan, Healthy Start, Food Stamps, etc.). It is important to note that these cost restrictions apply only if the individual or their representative (such as a parent or guardian) is requesting a copy of the PHI for themselves. Further, a provider may not charge an individual a fee for merely accessing (i.e., viewing and inspecting) their PHI, even if the individual takes notes or photos of his or her record. OCR further clarified that the cost restrictions apply regardless of specific state law provisions. For example, Massachusetts state statute allows a provider to charge an additional fee to cover the actual cost of postage (regular or priority/next day mailing) and preparation of an explanation or summary of the hospital or clinic medical record if so requested. These separate costs (such as postage) would now be included in the calculation as outlined by OCR. For records delivered to a third party at the individual’s request and for requests that come directly from a third party with a valid HIPAA authorization form (e.g., from a lawyer or other party that is not for the purposes that are exempt from fees), the HIPAA copy fee limits outlined by OCR do not apply. Instead the provider may use the fee schedule allowed under Massachusetts law as outlined above. Given the number of challenges that attorneys have made regarding this issue, members should be aware that there have been two court cases that help clarify this issue. Specifically, the US federal district court for the Northern District of Alabama issued a ruling on February 14, 2018, in the case of Bocage v. Acton Corporation that distinguishes the copying fees for patient-directed requests as separate from an attorney-submitted authorization. Specifically the court ruled that plaintiff attorneys do not get the patient rate under HIPAA just by their being the “representative of the patient.” This decision is consistent with an August 27, 2007, case decided by U.S. Court of Appeals in California, Webb v Smart Document Solutions, LLC. Hospital counsel should note that the Alabama case is important because the Webb case was based on the HIPAA regulations before the enactment of HITECH, while the Alabama case was decided after the enactment of HITECH. MHA believes that these cases are persuasive for application in Massachusetts given a prior case of a similar nature. In 2015, a Massachusetts Superior Court (civil docket#SUCV2014-03043-F) had issued a slip decision that denied a plaintiff attorney’s motion that a Massachusetts hospital must produce records at the HIPAA cost for “pushing a button.” The judge specifically disagreed and stated that the hospital cost schedule (following MGL 111 sec 70 and yearly updates from the MHA) was in compliance with both federal and state law. While the federal district court case is outside the Massachusetts jurisdiction, it is nonetheless persuasive and is the first federal court case decided under HITECH ruling that the copying fee caps set by HIPAA do not apply to an attorney’s request of medical information with a patient authorization.
Notably, the Guidance makes it clear that OCR has accepted the federal district Court’s order in Ciox Health v. Azar, No. 18-cv-0040 (DC Dist. Court January 23, 2020), ruling that the HIPAA limitation on copying fees does not apply to copies of records sent to third parties at the individual’s request, and that the individual’s right to direct that records be sent to third parties applies only to electronic records, not paper records. It is up to each provider to develop a process to determine the actual cost of the labor required to copy the PHI (exclusive of the cost of searching for, retrieving, and otherwise preparing the responsive information for copying). If that cost is greater than the fee schedule allowed under Massachusetts law, using the annual update provided by MHA, then the provider should use the Massachusetts fee schedule (as outlined above) as the basis for the cost to the patient. If your actual costs of the labor required to copy the PHI is less than the standardized rate under the fee schedule in the Massachusetts law, you should use your lower rate. MHA recommends that each provider contact their contracted medical records vendor, if you have one, to determine if they have already developed a process to calculate such costs (labor, supply, and postage costs) to use in your comparison and to be used if your facility is contacted by OCR for such information. Therefore providers are encouraged to periodically undertake (and document) a study of the actual labor costs for permitted activities (copying, scanning or conversion, but not retrieval) and use the results to determine the specific rates to be charged for non-electronic PHI copies. The following provides examples of what may, and may not, be included or deemed labor when calculating the rates: INCLUDED: Photocopying paper PHI. Scanning paper PHI into an electronic format. Converting electronic information in one format to the format requested by or agreed to by the individual. Transferring (e.g., uploading, downloading, attaching, burning) electronic PHI from a covered entity’s system to a web-based portal (where the PHI is not already maintained in or accessible through the portal), portable media, email, app, personal health record, or other manner of delivery of the PHI. Creating and executing a mailing or an email with the responsive PHI. NOT INCLUDED: Reviewing the request for access. Searching for, retrieving, and otherwise preparing the responsive information for copying. This includes labor to locate the appropriate designated record sets about the individual, to review the records to identify the PHI that is responsive to the request and to ensure the information relates to the correct individual, and to segregate, collect, compile, and otherwise prepare the responsive information for copying. |