Patients may request copies of their medical records, or request that copies of their records be sent to a designated person or entity of their choice. In a patient request, a patient or former patient requests access to or copies of some or all of her medical records, in either paper or electronic format. For example, a patient might want to keep copies for her own personal use or to bring with her when moving or changing providers. In a patient-directed request, a patient or former patient requests that a provider or other covered entity send a copy of the patient’s medical records directly to another person or entity, such as another provider. For example, a patient might request that her medical records be forwarded to another provider because the patient is moving or wants to seek a second opinion. In a third-party request, a third party, such as an attorney, obtains permission from a patient (via a HIPAA authorization form that is signed by the patient) to access the patient’s medical records. For example, with permission from the patient, a lawyer might request copies of a patient’s medical records to pursue a malpractice case. HIPAA’s Privacy Rule—the regulations that implement HIPAA’s privacy protections—requires that upon request, HIPAA-covered entities, such as health care providers and health plans, provide individuals with access to their medical records. Under HIPAA’s implementing regulations, providers and other covered entities must respond to a patient or patient- directed request for medical records within 30 days. The Privacy Rule also establishes an individual’s right to inspect or obtain a copy of his or her medical records which, as amended in 2013, includes the right to direct a covered entity to transmit a copy of the medical records to a designated person or entity of the individual’s choice. Individuals have the right to access their medical records for as long as the information is maintained by a covered entity or by a business associate on behalf of a covered entity, regardless of when the information was created; whether the information is maintained in paper or electronic systems onsite, remotely, or is archived; or where the information originated. Finally, the HIPAA Privacy Rule also describes the circumstances under which protected health information in medical records may be released to patients and third parties. In February 2016, OCR issued guidance to explain its 2013 regulations. Among other things, this guidance states that as part of a patient’s right of access, patients have the right to obtain copies of their medical records and the right to have their records forwarded to a person or entity of their choice; in these circumstances, patients are only to be charged a “reasonable, cost-based fee.” The guidance further notes that state laws that provide individuals with greater rights of access to their medical records are not preempted by HIPAA and still apply. With respect to fees, patients may not be charged more than allowed under the Privacy Rule, even if state law provides for higher or different fees. To respond to medical record requests, providers either use staff within their organization or may contract with ROI vendors to conduct this work. In general, both providers’ staff and ROI vendors follow the same process when fulfilling requests for medical records for both individual patients and third parties. (See fig. 1.) Available information suggests that the allowable fees for accessing medical records vary by type of request—that is, whether a patient or third party is making the request—and by state. Federal laws establish limits on the fees that may be charged for two of the three types of requests for medical records: (1) patient requests, when patients request access to their medical records, and (2) patient-directed requests, when patients request that their records be sent to another person or entity, such as another provider. HIPAA does not establish limits on fees for third-party requests. For patient and patient-directed requests, providers may charge a “reasonable, cost-based fee” under HIPAA’s implementing regulations. OCR’s 2016 guidance gives examples of options providers (or a ROI vendor responding to requests for medical records on behalf of a provider) may use in determining a “reasonable cost-based fee.” (See table 1.) In addition to the HIPAA requirements, some states have established their own fee schedules, formulas, or limits on the allowable fees for patient and patient-directed requests. State laws that allow for higher fees than permitted under HIPAA are preempted by the federal law, but those providing for lower fees are not preempted. Representatives from ROI vendors, provider representatives, and other stakeholders we interviewed told us that not all states have established their own requirements governing the fees for medical record requests and, among the states that have, the laws can vary. For example, states can vary as to whether they set a maximum fee that may be charged or whether they establish a fee schedule that is applicable to paper records, electronic records, or both. While states may establish per-page amounts that can be charged for a copy of a patient’s medical records, these per-page amounts can vary. In contrast with patient and patient-directed requests, the fees for third- party requests are not limited by HIPAA’s reasonable, cost-based standard for access requests and are instead governed by state laws, regulations, or other requirements. For third-party requests, providers and vendors working on their behalf may charge whatever is allowed under these state requirements. According to ROI vendors and other stakeholders we interviewed, such fees are typically higher than the reasonable, cost-based fees permitted under HIPAA for patient and patient-directed requests and may be established by formulas that vary by state. For example, states can vary as to whether they establish per- page copy fees, allow providers to charge a flat fee, or charge different fees based on the type of media requested (e.g., electronic copies, X- rays, microfilm, paper, etc.). Additionally, state laws of general applicability (for example, the commercial code) may govern the permissible fees applicable to ROI release of records. Representatives of ROI vendors we interviewed stated that there is significant variation in the state laws that govern the fees for third-party requests, and companies employ staff to track the different frameworks. Across the four selected states, we found examples of the kinds of variation stakeholders have described in the allowable fees for patient and third-party requests for medical records. (See table 2.) Three of the states— Ohio, Rhode Island, and Wisconsin—have established per-page fee amounts. The amounts charged are based on the number of pages requested and vary across the three states. These three states have also established specific fee rates for requesting media such as X-ray or magnetic resonance imaging scan images. One state—Ohio—has established a different per-page fee amount for third-party requests. The other three states have not established different fees for different types of requests (i.e., between patient and third-party requests). One state—Rhode Island—specifies a maximum allowable fee if the provider uses an electronic health records (EHR) system for patient and patient-directed requests. One state—Kentucky—entitles individuals to one free copy of their medical record under state law. The statute allows a charge of up to $1 per page for additional copies of a patient’s medical records. In some cases, questions have been raised about the fee structure that should be applied to certain types of requests. Representatives from ROI vendors we interviewed told us that they have seen an increase in third parties (primarily law firms) submitting requests for medical records and indicating that the requests are patient-directed and therefore subject to HIPAA’s reasonable, cost-based fee standard. According to these representatives, it is sometimes difficult for them to determine whether it is an attorney making a third-party request or an attorney submitting a patient-directed request because, for example, patient-directed requests are submitted by a patient’s attorney and appear similar to traditional third-party requests (e.g., they appear on legal letterhead). As a result, the representatives said that they are often unsure about which fee structure to apply to the request: a reasonable, cost-based fee or a fee for a third-party request, which ROI vendors told us is typically higher. When asked about the reported distinction between fees for patient- directed and third-party requests, OCR officials told us that they are in the process of considering whether any clarification is needed to their 2016 guidance. This guidance describes the requirements of HIPAA and the Health Information Technology for Economic and Clinical Health (HITECH) Act, as well as their implementing regulations. HIPAA provides patients with a legally enforceable right of access to their medical records. OCR officials explained that the HITECH Act amended HIPAA and specifies that a patient’s right of access includes the right to direct a provider to transmit the records directly to an entity or individual designated by the individual. According to OCR officials, the same requirements for providing a medical record to an individual, such as the limits on allowable fees and the format and timeliness requirements, apply to patient-directed requests. OCR officials told us that they are considering whether—and if so, how—they could clarify the 2016 guidance within the constraints of HIPAA and the HITECH Act. Patient advocates and others we interviewed described challenges patients face accessing medical records, such as high fees. Provider representatives described challenges providers face, including allocating staff time and other resources to respond to requests for medical records. Multiple stakeholders we interviewed—patient advocates, a provider representative, experts, and a representative from an ROI vendor—told us that some patients have incurred high fees when requesting access to their medical records. Stakeholders noted that in some cases the fees reported by patients appear to exceed the reasonable, cost-based standard established under HIPAA. One patient advocacy organization, which collects information on patients’ access to their medical records, described the following examples reported to them by patients: Two patients described being charged fees exceeding $500 for a single medical record request. One patient was charged $148 for a PDF version of her medical record. Two patients were directed to pay an annual subscription fee in order to access their medical records. One patient was charged a retrieval fee by a hospital’s ROI vendor for a copy of her medical records. Retrieval fees are prohibited under HIPAA. In addition, according to patient advocates we interviewed, high fees can adversely affect patients’ access to their medical records. For example, one patient advocate told us that some patients simply cancel their requests after learning about the potential costs associated with their request. Another patient advocate told us that patients are often unable to afford the fees charged for accessing their medical records, even in cases when the fees are allowed under HIPAA or applicable state law. This advocate explained that per-page fees, even if legally authorized, can pose challenges for patients; in particular, patients who have been seriously ill can accumulate medical records that number in the thousands of pages and can, as a result, face fees in excess of $1,000 for a single copy of their records. Stakeholders we interviewed told us that in many cases, providers may also be unaware of patients’ right to access their medical records and the laws governing the fees for doing so. Two patient advocates and an expert said that patients are sometimes denied access to their medical records. Patient advocates and experts told us that some providers are not aware of the 2016 OCR guidance, which describes patients’ rights to access their medical records, as well as the permitted fees for such access. One patient advocate and a provider representative also noted that providers may be confused about caregivers’ and family members’ access to medical records. For example, providers sometimes incorrectly deny family members’ access to a patient’s health information, which HIPAA allows under certain circumstances. Provider representatives, patient advocates, and an expert agreed that providers could benefit from more training on medical record access issues, including training on the options patients have for accessing their medical records. Stakeholders we interviewed also noted that patients themselves are not always aware of their right to access their medical records, do not always know that they can submit a formal complaint to HHS’s OCR when denied access, and could benefit from specific educational efforts that raise awareness of these issues. For example, patient advocates said that the “notice of privacy practices” form that patients receive and are asked to sign when they first seek care from a provider could be improved to raise awareness of the rights associated with accessing medical records. This form is used to explain a provider’s privacy policies and obligations, and what patients have to do to obtain access to their medical records. However, a provider association and an expert told us that these forms are not always easy for patients to understand, and patients might not always read them. OCR has developed a standard privacy notice that providers may adopt if they choose. However, a patient advocate told us that most providers are still using their own versions of the notice. Multiple stakeholders we interviewed told us that responding to patient requests for medical records can be challenging because it requires the allocation of staff and other resources and as a result, responding to such requests can be costly. Furthermore, a provider representative, three representatives from ROI vendors, and a patient advocate confirmed that providers and their staff may lack the expertise needed for responding to requests for medical records in a manner that complies with HIPAA and applicable state laws. Providers can receive training on HIPAA related issues; however, a patient advocate told us that this training, which may be provided by private companies, often focuses on security issues (i.e., maintaining secure medical record systems) and not on the rights of patients. In addition, stakeholders we interviewed commonly stated that the increased use of electronically stored health information in EHRs has resulted in a more complex and challenging environment when responding to requests for patients’ medical records. For example, these stakeholders noted the following: Extracting medical records from EHRs is not a simple “push of a button” and often requires providers or their ROI vendors to go through multiple systems to compile the requested information. Stakeholders noted that printing a complete record from an EHR system can result in a document that is hundreds of pages long due to the amount of data stored in EHR systems. Representatives from three ROI vendors told us that as providers have transitioned from using paper records to using EHR systems, information has been scanned into electronic medical records. This has, in some cases, resulted in records being incorrectly merged (e.g., the records of two patients merged into a single record). As a result, when responding to a medical record request, providers or their vendors must carefully go through each page of the record to ensure only the correct patient’s medical records are being released. A provider representative, representatives from four ROI vendors, and two experts noted that providers often have multiple active EHR systems, or have legacy EHR systems in which some medical records are stored. This requires providers and their vendors to go through multiple EHR systems to extract information in response to a medical record request. Some providers still have a mix of paper and electronic records, which ROI vendors and provider representatives told us makes responding to medical record requests more difficult and time consuming. A provider representative and other stakeholders said that while patients can request copies of their records in an electronic format, providers may have security concerns about sending information via unsecured email or providing electronic information via a patient’s USB stick, which increases the risk of a provider’s system becoming infected with malware. While health information technology has created some challenges for providers, numerous stakeholders we interviewed told us that the technologies have made accessing medical records and other information easier and less costly for patients. For example, multiple stakeholders we interviewed told us that an increase in the use of patient portals has reduced the number of patient requests for access to their medical records because patients are able to directly access some health information through the portals. As we have previously reported, patient portals have facilitated patient access to medical records and patients have noted the benefits from having such electronic access, even though portals do not always contain all the information patients need. The use of patient portals has not eliminated patient requests for access to their medical records; a provider representative we interviewed said that many patients still prefer to obtain paper copies of their records. To enforce patients’ right of access under HIPAA’s Privacy Rule, the HHS OCR undertakes four types of efforts. OCR (1) investigates complaints it receives from patients and others regarding access to patient medical records, (2) audits a sample of providers to determine the extent to which their policies and procedures are compliant with HIPAA, (3) reports to Congress on compliance with HIPAA, and (4) educates patients and providers about patients’ rights to access their medical records. OCR has established a process for investigating patients’ complaints over access to their medical records. Via an online portal on its website, OCR receives complaints submitted by patients. Staff in OCR’s headquarters office conduct an initial review of the information provided by the complainant. According to OCR officials, complaints that cannot be immediately resolved are generally assigned to a regional office investigator, who is responsible for reviewing the complaint and obtaining additional information from the complainant and provider, if needed. After the investigator completes the investigation, OCR issues a letter to both the provider and patient explaining what OCR has found. Depending on the nature of the findings, OCR may, for example, issue technical assistance to the provider; close the complaint without identifying a violation; require the provider to implement a corrective action plan; conduct a more detailed investigation; and, if warranted, levy a civil monetary penalty. According to OCR officials, the use of civil monetary penalties is rare and reserved for situations where providers’ behavior is particularly egregious. Examples of patient access complaints provided to us by OCR included complaints about the following: providers not responding even after the patient made multiple requests, or providers taking longer than 30 days to respond to a request for medical records or other information ; providers charging excessive fees for copies of patients’ medical providers not responding to requests from personal representatives or providers denying medical records requests from a parent or parents of children. Our analysis of OCR data also shows that the amount of time OCR takes to investigate and close a patient access complaint varies. OCR received a total of 583 patient access complaints between February 2016 and June 2017, closing 437 of these complaints during that same time period. These 437 complaints took anywhere from 11 to 497 days to close. (See fig. 2.) The majority of these 437 complaints (63 percent) were closed in 200 or fewer days. OCR officials stated that while there is no required time frame for closing a complaint involving patients’ access to their medical records, they aim to close cases in fewer than 365 days. According to OCR officials, while there is no required time frame for closing a patient access case, investigators aim to get patients access to their medical records as soon as possible, which typically occurs before the case is formally closed (i.e., a formal letter is issued to provider and patient). OCR officials noted a number of reasons why complaints can take a significant amount of time to close. In some cases, the patient receives her records early in the investigation, but the complaint is kept open by OCR to ensure that agreed-upon or recommended corrective actions are taken by the provider—for example, training staff on patient access rights or demonstrating that the provider’s policies pertaining to patient access have been changed. In other complaints, time is needed for OCR to obtain consent from the patient who filed the complaint. OCR officials noted that in some instances, patients ultimately decide they do not want to give OCR consent to investigate their complaint, due to concerns that the provider will learn their identity. OCR officials also noted that complaints that are moving towards more serious enforcement actions, such as civil monetary penalties, may also take a long time to close. Finally, OCR officials noted that their own staffing limitations in regional offices can sometimes result in complaints taking additional time to close. The HITECH Act requires OCR to conduct periodic audits of selected covered entities in order to review the policies and procedures the covered entities have established to meet HIPAA requirements and standards. The right of patients to access their medical records is included in these requirements. As part of its most recent audit, OCR officials stated that they reviewed 103 covered entities regarding their policies related to patient access to health information, including the entities’ notice of privacy practices. In addition, OCR reviewed any access requests the covered entities received from patients, including both requests that were granted and requests that were denied. OCR examined these access requests to determine whether access was provided in a manner that was consistent with the covered entities’ policies and procedures and whether the entities fulfilled the requests they received within the 30-day time frame established under the Privacy Rule. OCR also examined any fees that were charged for access and whether those fees met HIPAA’s reasonable, cost-based standard. OCR officials said that after completing each audit, OCR submitted a draft report for the audited entity for review. The entity had 10 days to review and submit any feedback to OCR, which OCR reviewed and incorporated into the entity’s final audit report. According to OCR officials, OCR has completed this phase of the audit program and will release a final report in 2018. The HITECH Act directs HHS to submit an annual report to Congress on compliance with HIPAA that includes details about complaints of alleged violations of the Privacy Rule and the resolution of these complaints. The patient right of access is part of the HIPAA and Privacy Rule requirements. The report, which is issued by OCR, includes information on the patient access complaints OCR has received, the number of investigations it has conducted, and the fines OCR has levied. OCR issued its most recent report in 2016. The report summarized complaints and enforcement actions for the 2013 through 2014 calendar years. OCR officials stated that they are in the process of reviewing a draft report that will be released in mid-2018 and contain information and data from calendar years 2015 and 2016. As part of its responsibilities to enforce HIPAA’s Privacy Rule, OCR also provides a variety of educational materials that aim to educate both patients and providers about patients’ right to access their medical records. These materials include the following: In September 2017, OCR published a pamphlet that aims to educate consumers, particularly caregivers, about patients’ rights to access their medical records, including how to file a complaint if denied access. OCR has worked with ONC to produce three videos (“Your Health Information, Your Rights!”) and an infographic aimed at educating patients and others about patients’ rights to access their medical records. OCR has developed provider education videos that aim to educate providers on the rights of patients to access their medical records and how such access can enable patients to be more involved in their own care. Providers can receive continuing education credits for watching these videos. To assist providers, OCR has worked with ONC to develop a model notice of privacy practices to help providers adequately communicate access rights to patients in a standardized, easy-to-understand way. We provided a draft of this report to HHS for review. HHS provided us with technical comments, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees, the Secretary of Health and Human Services, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staffs have any questions about this report, please contact me at (202) 512-7114 or at yocomc@gao.gov. Contact points for our Office of Congressional Relations and Office of Public Affairs can be found on the last page of this report. Other major contributors to this report are listed in appendix I. In addition to the contact named above, Tom Conahan, Assistant Director; Andrea E. Richardson, Analyst-in-Charge; Krister Friday; and Monica Perez-Nelson made key contributions to this report.

Summary: HIPAA and its implementing regulations, as amended by the Health Information Technology for Economic and Clinical Health Act, require health care providers to give patients, upon request, access to their medical records, which contain protected health information (i.e., diagnoses, billing information, medications, and test results). This right of access allows patients to obtain their records or have them forwarded to a person or entity of their choice—such as another provider—in a timely manner while being charged a reasonable, cost-based fee. Third parties, such as a lawyer or someone processing disability claims, may also request copies of a patient's medical records with permission from the patient. The 21st Century Cures Act included a provision for GAO to study patient access to medical records. Among other things, this report describes (1) what is known about the fees for accessing patients' medical records and (2) challenges identified by patients and providers when patients request access to their medical records. GAO reviewed selected HIPAA requirements and implementing regulations and guidance, and relevant laws in four states selected in part because they established a range of fees associated with obtaining copies of medical records. GAO also interviewed four provider associations, seven vendors that work for providers, six patient advocates, state officials, and Department of Health and Human Services' (HHS) officials. The information GAO obtained and its analysis of laws in the selected states are not generalizable. HHS provided technical comments on this report. Available information suggests that the fees charged for accessing medical records can vary depending on the type of request and the state in which the request is made. Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations, providers are authorized to charge a reasonable, cost-based fee when patients request copies of their medical records or request that their records be forwarded to another provider or entity. In the case of third-party requests, when a patient gives permission for another entity—for example, an attorney—to request copies of the patient's medical records, the fees are not subject to the reasonable cost-based standard and are generally governed by state law. According to stakeholders GAO interviewed, the fees for third-party requests are generally higher than the fees charged to patients and can vary significantly across states. The four states GAO reviewed have state laws that vary in terms of the fees allowed for patient and third-party requests for medical records. For example, three of the states have per-page fee amounts for patient and third-party records requests. The amounts charged are based on the number of pages requested and vary across the three states. One of the three states has established a different per-page fee amount for third-party requests. The other two do not authorize a different fee for patient and third-party requests. One of the three states also specifies a maximum allowable fee if the provider uses an electronic health records system. The other two do not differentiate costs for electronic or paper records. In the fourth state, state law entitles individuals to one free copy of their medical record. The statute allows a charge of up to $1 per page for additional copies. Patient advocates, provider associations, and other stakeholders GAO interviewed identified challenges that patients and providers face when patients request access to their medical records. Patients' challenges include incurring what they believe to be high fees when requesting medical records—for example, when facing severe medical issues that have generated a high number of medical records. Additionally, not all patients are aware that they have a right to challenge providers who deny them access to their medical records. Providers' challenges include the costs of responding to patient requests for records due to the allocation of staff time and other resources. In addition, according to provider associations and others GAO interviewed, fulfilling requests for medical records has become more complex and challenging for providers, in part because providers may store this information in multiple electronic record systems or in a mix of paper and electronic records.