Previously, we presented a high-level summary of the Department of Health and Human Services’ (HHS) recently released proposed rule to revise the HIPAA Privacy Rule and a deep dive into the Individual Right of Access Proposals.

This week's post inspects the proposed changes to permitted fees under HIPAA for accessing PHI and electronic-PHI.

For a background on current HIPAA policies, see HIPAA and MIPS: Explained as easily as humanly possible.

When Would These Changes Need to Be Implemented?

HHS is proposing to require compliance with any finalized policies by 240 days after the publication of the Final Rule. As the Proposed Rule was just published, it would likely be more than a year from now.

Proposed Changes to HIPAA Policies on Fees for Access to PHI and ePHI

Permitted Fees

The Proposed Rule describes categories for which covered entities cannot charge a fee.

Current Requirement
You can charge a reasonable, cost-based fee to fulfill access requests from individuals for copies of their PHI with the following limits on the allowable fees to:

• The costs of labor for copying the PHI requested by the individual, whether in paper or electronic form; 
• The costs of supplies for creating the paper copy or electronic media (e.g., CD or USB drive) if the individual requests that the electronic copy be provided on portable media;
• Postage, when the individual requests that the copy, or the summary or explanation, be mailed; and
• Costs for preparing an explanation or summary of the PHI, if agreed to by the individual.

You may not charge any fee or include in fee calculations the costs associated with verification; documentation; searching for and retrieving the PHI; maintaining systems; recouping capital for data access, storage, or infrastructure; or other costs not listed above.

Proposed New Requirement

HHS is categorizing the proposed permitted fees based on the method of PHI access and who the recipient of the PHI is (either the individual/personal representative or a third party to which the patient directs you to send their PHI. 

HHS published the table below to summarize the proposed changes.

Important notes:

• Internet-based method: this refers to portals, APIs and any similar technology used to request and obtain PHI through the individual right of access.
• HHS states that it does not intend free access to apply to situations in which the patient is using an online portal to submit a request for copies of PHI to be sent to them in a manner that would require you to incur allowable costs for supplies, postage, or labor for copying. If the internet-based method were used for requesting and obtaining the PHI, it would need to be free.

Notice of Access and Authorization Fees

HHS proposes to require you to provide advance notice of approximate fees for copies of PHI requested under the Individual Right of Access.

Current Requirement
You must currently provide advance notice of fees under HIPAA However, since the fee a covered entity is permitted to charge will vary based on the form and format and manner of access requested or agreed to by the individual, covered entities must, at the time such details are being negotiated or arranged, inform the individual of any associated fees that may impact the form and format and manner in which the individual requests or agrees to receive a copy of their PHI.

Proposed New Requirement

In addition to the current requirement, HHS proposes to require you to do the following:

• Post the fee schedule online (if you have a website)
• Make the fee schedule available to individuals at the point of service upon the individual's request
  • In paper or electronic form
  • Location: at the point of care or at an office that is responsible for releasing medical records, as well as orally (e.g., over the phone) as applicable. Point of care could also include a customer service call center that handles requests for records, or any location at which PHI is made available for individuals to inspect.

HHS proposes that the notice must include:

• All types of access available free of charge, and
• The fee schedule for:
  • Copies provided to individuals (with respect to all readily producible electronic and non-electronic forms and formats for such copies)
  • Copies of PHI in an EHR directed to third parties designated by the individual (with respect to all readily producible electronic forms and formats for such copies)
  • Copies of PHI sent to third parties with the individual's valid authorization (with respect to all forms and formats for such copies).

In addition to the above requirements, HHS proposes to require you to provide, upon an individual's request, the following:

• An individualized estimate of the approximate fees you will charge for the request copies of PHI.
  • This must be completed within 15 calendar days and prior to any extension of time that may be allowed for providing the copies.
• An itemization of the charges for labor for copying, supplies, and postage, as applicable, which constitute the total fee you charge the individual for PHI copies.
  • Importantly, there is no proposal to amend the current lack of prohibition on allowing you to require individuals to pay a fee for copies of PHI upfront, before receiving such copies.
    
    

More Blogs on the HIPAA Privacy Proposed Rule

Part 1: High-Level Summary

Part 2: Individual Right of Access Deep Dive

Part 4: Disclosures