Can a Practice Charge a Patient’s Attorney for Copies of Medical Records?

While most medical practices have implemented policies governing how much to charge patients for medical records requests, many are less certain about how to handle such requests when they are made by a patient’s attorney. Do the federal guidelines for records requests apply when it is an attorney, rather than the patient, making the request?

The same fee limitations that govern patients’ records requests do apply to requests from their attorneys.

Background

The HIPAA Privacy Rule requires medical practices to provide patients, upon request, with access to medical information about them maintained by the practice. HIPAA also imposes limits on the fees that can be charged to patients to access their own records. Under HIPAA, the amount of money that a practice may charge for copies of a patient’s medical records varies, based on two factors: who is requesting the medical record and whether the record is maintained in hard copy or electronic form.

Guidance for Practices

The Privacy Rule states that a personal representative (for example, someone with a health care power of attorney or a child’s parents) must be treated like the patient, so the fee limitation also applies to requests from a personal representative. In addition, a patient (and/or a personal representative) can direct a covered entity to send protected health information (PHI) to a third party, so long as the patient’s access request is in writing, signed by the individual, and clearly identifies the designated person or entity to receive the records and where the records should be sent. This request can be submitted by the patient directly or by a third party on behalf of and at the direction of the patient, and the fee limitation applies in either situation.

When a patient’s attorney requests copies of the patient’s medical records, the request most likely is being made “on behalf and at the direction of” the patient. A practice should confirm this assumption and make sure the request meets the listed requirements before releasing the medical record. But assuming these conditions are met, we recommend that practices apply the HIPAA fee limitations to requests from the patient’s attorney. Our recommendation is based on two factors:

• The Office for Civil Rights (OCR), the federal agency charged with enforcing HIPAA, most likely will interpret the regulations in this manner.
• The potential liability from defending against an accusation of HIPAA non-compliance, even if ultimately defeated, far exceeds any additional fees that could be obtained by not applying these limitations.

When a Request Includes a HIPAA Authorization

In some cases, a patient’s attorney may directly request the patient’s medical records pursuant to a HIPAA authorization. One of OCR’s regional offices did provide guidance in 2015 that the fee limitations would not apply under these circumstances, as the right to access applies to a patient or their personal representative, not the patient’s legal representative. Under this view, the request by the attorney accompanied by an authorization is not a request for access by the individual.

We believe, however, that despite this guidance, it would be risky for a medical practice to impose higher fees in these circumstances. OCR has expressed concern about physicians attempting to circumvent the access fee limitations by treating individual requests for access like other HIPAA disclosures, such as by having an individual fill out a HIPAA authorization when the individual requests access to their medical information (including to direct a copy of the medical information to a third party). OCR has also stated that when the form of a request from a third party does not make clear whether the request is a request for access initiated by the patient or merely a HIPAA authorization to disclose PHI to the third party, the medical practice may clarify whether the request was directed by the patient. Given these statements from OCR and the nature of the relationship between the patient and their attorney, we think it becomes hard to argue that the request from the legal representative should not be treated like a request from the individual.

More extensive guidance from OCR is available at https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html.