You have a right under both federal and state law to be provided a copy of your own medical records, and to receive it promptly after you make a written request. You also can authorize someone else – such as a lawyer at our law firm, or another doctor, or a family member – to be sent a copy of your records. Here is some detailed background on your legal rights to your medical records.
According to the Health Insurance Portability and Accountability Act (“HIPAA”), codified at 42 U.S.C.A. §§ 1320d-1320d-8, a “covered entity” must permit an individual to obtain a copy of their protected health information that is maintained in a designated record set. (45 C.F.R. § 164.524(b)(1)).
Who is Subject to HIPAA?
Providers must provide access to records when they get a valid authorization. Here is the regulation that defines what’s in a valid authorization: 45 C.F.R. § 164.508(b) and (c). A valid authorization must contain the name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure, and to whom the covered entity may make the requested use or disclosure. 45 C.F.R. § 164.502(a)(1)(iv).
Health care providers also have a duty under state law to send you a copy of your medical records if you ask for them in writing.
If under applicable law a person has authority to act on behalf of in individual who is an adult or an emancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation. 45 C.F.R. § 164.502(g)(2).
If under applicable law an executor, administrator, or other person has authority to act on behalf of a deceased individual or of the individual’s estate, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation. 45 C.F.R. § 164.502(g)(4).
Upon Receipt of an Adequate Authorization, Health Care Providers must Release Medical Records Within 30 days.
“The covered entity must act on a request for access no later than 30 days after receipt of the request” 45 C.F.R. §164.524(b)(2)(i).
There are exceptions to the 30-day time period. “If the request for access is for protected health information that is not maintained or accessible to the covered entity on site, the covered entity must take [the required action] by no later than 60 days from the receipt of such a request.” 45 C.F.R. § 164.524(b)(2)(ii). Additionally, if the covered entity cannot meet the 30-day time limit, it may “extend the time for such actions by no more than 30 days, provided that” the entity provides the requesting individual with a written statement of the reasons for the delay and the date by which it will complete its action. 45 C.F.R. § 164.524(b)(2)(iii)(A). Only one such extension is permitted. 45 C.F.R. § 164.524(b)(2)(iii)(B).
Health Care Providers Must Release Medical Records in the Format Requested.
It’s best to specify in your request that you want the records in electronic format, if they’re kept that way by the hospital (or other provider). That will potentially save you a lot of money. (See next section.) Here’s what the federal regulation says: “The covered entity must provide the individual with access to the protected health information in the form or format requested by the individual, if it is readily producible in such form or format; or, if not, in a readable hard copy form or such other form or format as agreed to by the covered entity and the individual” 45 C.F.R. § 164.524(c)(2)(i). Thus, if the medical records are kept electronically and if the individually requests an electronic copy, the covered entity must provide the electronic format, if it is readily producible in such form and format. “The covered entity may provide the individual with a summary of the protected health information requested, in lieu of providing access to the protected health information or may provide an explanation of the protected health information to which access has been provided, if: (A) The individual agrees in advance to such a summary or explanation; and (B) The individual agrees in advance to the fees imposed, if any, by the covered entity for such summary or explanation.” 45 C.F.R. § 164.524(c)(2)(ii).
Health Care Providers are Allowed to Charge for Copies of Medical Records, But the Charge Must Be Reasonable.
This means that the hospital or other provider can charge only for putting everything onto a CD or a secure website (a fee usually well under $100), not the per-page charges that many hospitals try to impose, which can run easily into many hundreds or even thousands of dollars for a long hospital stay.
This applies to any “covered entity,” as mentioned above. If the provider is NOT covered by federal law, they can charge fees as allowed by the state the entity is located in.
In the Washington, D.C. area, the District of Columbia has no specific fees allowed for a hospital’s transmission of medical records to a patient.
Maryland and Virginia do have statutes that limit the amount a health care provider may charge when a patient requests a copy of their records.
Maryland law allows a “fee for copying not to exceed 76 cents for each page of the medical record, and the actual cost of postage and handling. There may be a preparation fee of $22.88, if the records are sent to another provider.” (Md. Code Health Gen § 4-304) The federal HIPAA regulations do not allow a charge for a preparation fee for records provided directly to the patient.
Here is a somewhat dated compilation of state laws done by a group at Georgetown University Law School, last updated in 2001 and 2002.
While we cannot guarantee the information is up-to-date, it should help you get started on getting information about your own state.