The good news, is patients are entitled to access and retrieve their electronic medical records at little or no cost. The latest federal regulations under the 21st Century CURES Act of 2016, which become effective April 5, 2021, allow patients simpler, less expensive and faster access of their electronic medical records upon request. Patients can now request copies of their medical records through the patient portal provided by the health care provider or one maintained for the patient’s representative allowing downloading of electronic medical records. Alternatively, patients can obtain their records through separate applications available to smartphone users or by electronic delivery through other means, such as a PDF attachment to secure email or by compact disc, or CD (the cost is usually $6.50 per disc). In most cases where electronic medical records are readily available through health information technology systems established by the provider, there is no cost to access them. Moreover, patients may request to have their electronic medical records delivered directly to a third party, such as another health care provider, guardian or attorney. The provider has 30 days to supply the electronic records. If a request for an extension is timely made, then up to 60 days will be allowed. Violations of these regulations subject the provider to stiff monetary fines of up to $100,000 per complaint to be imposed by the ONC (Office of the National Coordinator for Health Information Technology). A brief history is in order.
In 1996, and as modified in 2000, HIPAA (the Health Insurance Portability and Accountability Act) originally allowed patients access to their medical records. The federal regulations were updated and modified again in 2009 and 2013 by the HITECH (Health Information Technology for Economic and Clinical Health) Act, establishing guidelines for the implementation of electronic health information systems and allowing patients different methods to access to their ePHI (electronic Protected Health Information), i.e. medical records, upon request. Health care providers could charge patients their reasonable labor costs, but not for searching, verifying and retrieving medical records. The patient had the right to direct that his/her medical records be sent to a third party (third-party directive), such as another doctor, representative, attorney etc., at no additional cost. The provider had 30 days to comply, unless an extension was requested within this time; then another 30 days were allowed. Failure to comply allowed the patient to file a complaint with the OCR (Office of Civil Rights), which had the authority to direct compliance and impose monetary penalties.
In 2016, Congress passed the CURES Act, which was designed to help accelerate medical product development and bring new innovations and advances to patients who need their medical records in a quicker, more efficient manner and at a lower cost. The CURES Act recognized that patients need to readily obtain their electronic medical records and provided a simple framework to coordinate and readily access their records. By 2017, electronic medical records were maintained and available on health information systems used by 96% of acute care hospitals and 79.7% of office-based physicians. Patients’ electronic medical records, since known as EHI (electronic health information) to replace ePHI, were recognized to belong to the patient and include the physician’s clinical notes to include progress notes, laboratory test results, medications, procedure reports, operative reports and pathology reports. Under the CURES Act, electronic access is defined as an Internet-based method that makes EHI available to patients upon request with no manual effort required by providers, so there is no charge for downloading these records. It also includes email and cloud computing. Fees charged by providers under this system are viewed as suspect. The patient may still choose to direct that his/her medical records be sent to any third party as described above. This choice must be made clear at the time the request is made. As under HITECH, the provider must comply within 30 days and cannot impose fees for verifying, searching and retrieving the EHI. Unfortunately, some third-party entities acting as intermediaries, such as Ciox Health (now known as CIOX Health), imposed various obstacles and fees to patient access known as information blocking. Litigation ensued and Ciox prevailed in blocking the patient’s right to designate a third party to receive records without the third party paying additional fees. (Ciox Health LLC v. Azar. 435 F. Supp 3d 30)
This decision led to further recent rule changes under the CURES Act to combat information blocking and restore the third-party directive as originally set forth under HIPAA and the HITECH Act without imposing additional costs or fees. However, reasonable fees for labor costs may still be imposed if downloading of EHI is not readily available by the provider. The original HIPAA and HITECH rule guidance sets forth a $6.50 charge for electronic transmission to a CD. The CURES rules were further expanded to allow certain exceptions to information blocking prohibitions. Patients are not entitled to receive psychotherapy notes or records prepared in anticipation of third-party litigation such as a medical malpractice defense. The new changes now become effective April 5, 2021 and make it unequivocally clear that patients have the paramount interest and right to be closely involved with their medical care and decisions regarding future care. This includes not only easy, inexpensive and fast access to medical records, but the right to correct errors made by health care providers in documenting patient complaints, history and discussions with patients. Further, patients with family members who have powers of attorney or guardians, as well as other patient representatives and attorneys, may access and be recipients of the patient’s directive. Most importantly, this allows patients to request health care providers to send EHI directly to other treating physicians or attorneys who represent the patient in potential medical malpractice or other litigation matters at no additional cost. The federal acts and regulations supersede and preempt state law provisions to the contrary or ones that are more onerous, such as New York’s 75-cent-per-page charge for paper copies. Providers who do not comply with these rules may be subject to stiff penalties imposed by the ONC upon review of the patient’s complaint. The relevant CURES, HITECH and HIPAA provisions may be viewed at https://www.healthit.gov/sites/default/files/2018-12/LeveragingHITtoPromotePatientAccess2.pdf.
So how do patients like you request their electronic medical records? The first step is to determine from your health care provider how to make the request and what information and form to submit. At many large institutions and hospitals, patients already have patient portals set up which will direct you as to how to make this request and access records through the portal. Alternatively, hospitals, as well as physicians’ offices, doctors and medical groups, usually have a person or automated system available to advise how to request your records. The request will usually be made in writing, including your full name, address, date of birth, phone number and email address and may require a form of identification, such as a driver’s license. Your request should ask for full and complete EHI medical records and information maintained by the provider and direct how you wish to receive the EHI, such as through a patient or representative portal, online “patient facing” smartphone applications which are secure or other electronic means, such as secure email, CD or cloud-based programs. The method you choose depends in part upon your sophistication and ability to use computer and smartphone technology to your advantage. Alternatively, you may direct that the full and complete EHI be sent directly to a third party such as another physician or your attorney, including the name, address, and email address of the recipient. Once again, the provider has 30 days to comply or request a 30-day extension. Otherwise, you have the right to file a complaint with the ONC requesting review and directing the provider to comply or face possible imposition of monetary fines.
Once you make the request, a follow-up call or email should be sent within 20 days to find out the status of your request. If any obstacles are imposed, the provider needs to be reminded of your right to timely receive your EHI and file a complaint with the ONC for noncompliance and to impose penalties for unreasonably blocking access or not complying with your directives. Caution: do not request hardcopy versions when electronic medical records are available, as almost all providers now have the information technology and systems for you to readily access and provide your electronic medical records. Requesting paper copies will likely lead to the imposition of costs for photocopies, which, in New York, can cost as much as 75 cents per page. Unfortunately, many large hospital systems will still try to charge you this exorbitant rate to receive a copy of your medical records. This should be strongly resisted, as it is a clear violation of your rights to receive your electronic medical records (EHI).
If you believe you suffered serious harm or injuries caused by medical or professional negligence, please contact our very experienced and skilled attorneys and staff at Duffy & Duffy to discuss how best to proceed and request your medical records. We have over 70 years of combined experience in investigating and prosecuting medical malpractice and negligence claims and can advise and guide you through the process, which can be time-consuming and confusing. We have forms you may use to request access to your complete medical records, which include the patient directive to send your EHI to our office for review. These forms will include the necessary language and information required to allow compliance with HIPAA, HITECH and the CURES Acts. Please feel free to contact us promptly for a free initial consultation at 516-394-4200 or e-mail awc@awclaw.com.
*Alan W. Clark, a trial attorney, is Of Counsel to Duffy & Duffy, PLLC. He is Board Certified and recertified in Professional Medical Negligence by the American Board of Professional Liability Attorneys (ABPLA) and is a member of the ABPLA; the American Association of Justice; the New York State Trial Lawyers Association; the New York State Bar Association; the New York State Association of Trial Lawyers; and the Nassau County Bar Association.
