New HIPAA guidance reiterates patients’ right to access health information and clarifies appropriate fees for copies

The President’s Precision Medicine Initiative prioritizes the ability of any American to participate in scientific research by individually donating their health information. This can only be made possible by robust access to patient data. At the Office for Civil Rights (OCR), we believe strongly that every individual should be able to easily exercise their right to access their health information, allowing them to be fully engaged in their care and empowered to make the health care decisions that are right for them. The HIPAA Privacy Rule has always provided individuals with the right to access and receive a copy of their health information from their providers, hospitals, and health insurance plans. But this right has not always been well-understood, and far too often individuals face obstacles accessing their health information, even from entities required to comply with HIPAA.

Last month we took an important step toward removing those obstacles by issuing a comprehensive fact sheet and the first in a series of topical frequently asked questions (FAQs) addressing patients’ right to access their medical records. Those FAQs set forth requirements providers must follow in sharing medical records with patients, including that they must do so in a timely manner and in a format that works for the patient.

Today, we are providing additional information to make this HIPAA right more of a reality. This second set of FAQs addresses additional issues, including the fees individuals may be charged for copies of their health information and the right of individuals to have their health information sent directly to a third party if they so choose.

HIPAA’s right of access is critical to enabling individuals to take ownership of their health and well-being – but this core right is rendered meaningless when individuals cannot afford to pay the fees. These new FAQs clarify that individuals can be charged only a reasonable, cost-based fee for the labor and supplies associated with making the copy, whether on paper or in electronic form.

Furthermore, the right to have information sent directly to a third party empowers individuals to send their information wherever they want it to go – for example, to another health care provider, a friend or family member, researchers, or even a consumer tool such as a personal health record or mobile health app. Today’s clarification moves us toward the health care ecosystem of the future, where the individual is at the center of his or her care and seamless communication of relevant health information takes place among patients, their families, and their health care providers.

Like the Access fact sheet and FAQs released last month, this second guidance is aimed primarily at providers, hospitals, and health plans required to comply with the HIPAA Privacy Rule. We continue to work with our colleagues to produce consumer-friendly resources, including sample communications tools, to encourage patients to access their health information. We hope that these new materials will engage and empower patients to take control of their health care decisions, improving the quality of care they receive and leading to a better overall health care delivery system.

The complete set of materials – the Fact Sheet and both the first and second set of FAQs -- may be found on OCR’s website at: http://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html.

Want to comment on this Blog? Visit our Twitter page @HHSOCR to share your thoughts and start a conversation.