by Kim Murphy-Abdouch, MPH, RHIA, FACHE
Patient-centered healthcare initiatives are underway to enable patients to take more responsibility for their healthcare. To do so, patients must be able to access, utilize, and share their health information. Access to health information through patient portals and other electronic means is increasing with the adoption of electronic health records (EHRs), but not all providers have EHRs or patient portals and not all information may be available electronically. Patients are expected to continue to request paper and electronic copies of their medical records. This research project was initiated to obtain up-to-date data regarding health information management (HIM) practices related to patients’ access to their health information.
Keywords: patient portal, electronic health record (EHR), Health Insurance Portability and Accountability Act (HIPAA), American Recovery and Reinvestment Act (ARRA), Health Information Technology for Economic and Clinical Health (HITECH) Act, meaningful use
This research was undertaken to identify contemporary practices in providing patients with access to their health information. The increased adoption of health information technology has expanded patients’ access to their health information; however, in the transition from paper medical records to electronic health records (EHRs), existing health information management (HIM) policies and practices must be evaluated to ensure that patients are supported in their efforts to access and manage their health information. This research provides up-to-date data regarding EHR adoption, portal availability and utilization, and HIM practices surrounding patients’ access to their paper and electronic medical records.
Patient-centered healthcare initiatives are underway to enable patients to take more responsibility for their healthcare. To do so, patients must be able to access and share their health information.1–3 Under the Health Insurance Portability and Accountability Act (HIPAA), patients have a right to see and obtain a copy of their medical records. The American Recovery and Reinvestment Act (ARRA) extends those rights through modifications to HIPAA, requiring healthcare providers who utilize EHRs to give patients copies of their medical records in an electronic format, such as a flash drive or DVD, upon request. Patient portals are also expanding in the healthcare industry, allowing patients to link directly to EHR systems to access their health information. The stage 1 meaningful use criteria required healthcare providers to provide patients with timely electronic access to their health information (including lab results, problem lists, medication lists, and allergies) within four business days of the information being available to the eligible professional.4 However, not all of a patient’s medical records may be available through a patient portal, and patients may not utilize a portal even though it may be available to them. For these and other reasons, patient demand for access to paper and electronic copies of medical records will continue to exist.
HIPAA allows providers to charge patients a “reasonable” cost-based fee for providing paper or electronic copies of medical records. Most states also have statutes setting the maximum fees that may be charged for copies of medical records.5 Neither HIPAA nor the state statutes require that patients be charged for access to and copies of their medical records. Cost could present a barrier to patients, discouraging them from accessing information they need to better manage their health.6
The American Health Information Management Association (AHIMA) Consumer Engagement Practice Council has recommended that healthcare organizations remove or reduce costs associated with providing patients with access to their health information.7 However, data regarding individual healthcare organizations’ practices regarding patients’ access to their health information are limited. An unpublished study of Michigan Health Information Management Association professionals conducted in 2002 revealed a lack of consistency in whether patients were charged a fee and in the amounts charged.8 A later study of 73 hospitals in 25 states revealed wide variation in the fees patients were charged for their medical records, from free to hundreds of dollars.9
HIPAA defines the maximum fees that patients can be charged for their medical records, and the criteria for meaningful use further distinguish the patient from other third parties who may seek access to patient health information. Under the HITECH Act, effective September 23, 2013, patients have the right to request their health information in electronic form. The act requires that any fee imposed to provide the electronic copy cannot exceed the labor and supply costs of responding to the request.
State statutes address the maximum fees that may be charged to patients, insurance companies, attorneys, and other third parties. These fees are not generally cost-based and are likely to be inconsistent with HIPAA and HITECH regulations. This research project was developed to obtain contemporary data regarding HIM practices in providing patients with electronic and paper copies of their health information.
Under a partnership between Texas State University and the AHIMA Foundation, selected AHIMA members were invited to complete an anonymous survey regarding policies and practices surrounding patients’ access to their health information. Respondents were asked to provide information related to patient access to personal health information and were specifically advised that the survey was not intended to gather data regarding release-of-information practices related to third parties (such as attorneys, life insurance companies, long-term care insurance companies, etc.).
In September 2013, AHIMA sent three e-mail messages over a three-week period to selected AHIMA members, inviting them to participate in the survey and providing a link to the online survey. The 2,444 AHIMA members selected to receive the invitation included those with the following AHIMA profile: job level/category: Director/Officer; job title: HIM Director/Privacy Officer; and job setting: Acute Care, Integrated Delivery System, Clinic, Home Health, Behavioral Health, Ambulatory Surgery Center, or Other Provider.
The survey asked questions regarding EHR utilization, patient portal availability and utilization, provision of paper and/or electronic copies of records, charges for providing paper and electronic copies, use of software for the release-of-information function, and contracts with vendors for the release-of-information function.
Of the 2,444 AHIMA members invited to participate in the survey, 313 responded, resulting in a 12.8 percent response rate. All but three states and the District of Columbia were represented in the responses.
As depicted in Figure 1, nearly 75 percent of the survey respondents worked in the Acute Care and Integrated Delivery System settings.
Regarding EHR use and patient portal availability, Table 1 demonstrates EHR prevalence by type of healthcare organization, and Table 2 depicts the availability of patient portals by type of healthcare organization. A total of 274 respondents (87.5 percent) indicated that they have an EHR system. Of the respondents with an EHR system, 38.0 percent reported that they have a patient portal. However, portal utilization by patients was reported to be very low, with nearly 50 percent of the healthcare organizations with a patient portal reporting that less than 5 percent of their patients use the portal. Table 3 provides a summary of reported patient portal utilization.
Regarding charges for electronic and paper copies of records, more than half (52.6 percent) of respondents indicated that they charge patients for electronic copies of their medical records, and nearly two-thirds (64.7 percent) reported that they charge patients for paper copies of their medical records. Charges for electronic copies varied from a flat fee for a device to per-page fees or some combination of the two, and charges for paper copies were generally by page, with 65 percent reporting that they charged less than $1.00 per page. Nearly one in four respondents (23.6 percent) commented that they follow their state’s rates for copies. Following the state rates would suggest that the fees are not uniquely based on the cost to the facility. This finding would appear to be inconsistent with HIPAA and HITECH requirements that patients may only be charged a “reasonable cost-based fee” for copies of their medical records.
Regarding contracts with vendors and software utilization for the release-of-information function, more than two-thirds (72.8 percent) of respondents indicated that they contract with a vendor for some or all of their release-of-information functions, and nearly three-quarters (73.5 percent) utilize software to support the release-of-information function.
These survey results were similar to previous studies that revealed wide variation in whether patients were being charged for their medical records and the fees that were being charged. The results also demonstrate adoption of EHRs and availability of patient portals. The healthcare industry is at a crossroad of converging technologies and regulations affecting patients’ access to their health information.
Figure 2 depicts the regulations affecting patients’ access to their health information. The Centers for Medicare and Medicaid Services (CMS) has advised that charging for this access is inappropriate under the meaningful use criteria. Under HIPAA, patients have a right to see and obtain copies of their medical records. HIPAA allows providers to charge a “reasonable cost-based” fee for providing these copies. The fee may include only the labor and supply costs of copying and postage, and may not include costs to search for and retrieve the information. However, nearly 25 percent of the survey respondents commented that they follow the state rates for copies. The state statutes generally represent the maximum fees that healthcare providers can charge patients and other third parties for copies of medical records, and would not generally represent the unique supply and labor costs of each healthcare provider.
Navigating these disparate regulations can be confusing not only for the patients but also for a healthcare organization’s staff. Not only do the fees vary, but the time frames for responding to a patient’s request for information also vary. Under meaningful use criteria, healthcare organizations are encouraged to offer patients ready access to their information via a portal and within four days of a request for information. HIPAA allows up to 30 days to respond to a patient’s request, and state statutes vary from 15 to 30 days.
Given all these variations, the time may be opportune for HIM professionals and their vendor partners to reevaluate their policies and practices regarding time frames and charges for patient access to personal health information. The loss of revenue if patients are not charged may be a concern, but some of the cost of providing release-of-information services could be recovered by charging requestors who use the information for business purposes (attorneys, insurance companies, etc.) under the maximum allowable rates as set by the state statutes.
Patient requests for release of information are anticipated to decrease as EHRs and patient portals are implemented. The survey results demonstrated a high level of adoption of EHRs, with 87.5 percent of respondents reporting they had an EHR system. Patient portals were available at 38 percent of facilities with an EHR system, yet patient portal utilization was very low; 46 percent of respondents reported that less than 5 percent of their patients use the portal. This research did not assess why portal utilization was so low, but a recent literature review suggested that racial, ethnic, and literary barriers may influence portal utilization.10 Bowen et al. have suggested that “endorsing and facilitating patient access to health information through patient portals may be HIM’s biggest cultural shift since the advent of prospective payments and DRGs.”11
This research demonstrates the opportunity for HIM professionals to facilitate adoption of patient portals. HIM professionals are well positioned to encourage patients to use a portal and can do so by discussing benefits of use, authenticating patient identity, teaching patients how to securely access their information, and helping them understand their record. If a patient portal is not available or if patients choose not to use the portal, HIM professionals can assist by establishing a pertinent record set to give patients upon request. This pertinent record set could include summaries of care, laboratory tests, and radiology results and could serve as the starting point for giving patients access to their personal health information.
The healthcare industry is at a crossroad of converging technology and regulations influencing patients’ access to their personal health information. This research revealed wide variation in contemporary practices affecting patient access. HIM professionals are uniquely positioned to play a practical and strategic role in ensuring that patients are able to access, utilize, and share their health information. The time is opportune for HIM professionals to evaluate their policies and procedures to ensure that patient access is provided in secure and patient-friendly ways.
The author thanks the AHIMA Foundation; Sue Biedermann, MSHP, RHIA, FAHIMA; Susan H. Fenton, PhD, RHIA, FAHIMA; and Lisa Mohrhoff.
Kim Murphy-Abdouch, MPH, RHIA, FACHE, is a clinical assistant professor and clinical coordinator in the Health Information Management Department at Texas State University in San Marcos, TX.
Kim Murphy-Abdouch, MPH, RHIA, FACHE. “Patient Access to Personal Health Information: Regulation vs. Reality.” Perspectives in Health Information Management (Winter 2015): 1-10.