Jennifer Cronenberg, Interim CEO

Each year NOSSCR issues the list of the maximum amount states are allowed to charge a third-party for an individual’s medical records. Why is this allowed at all and how did we get here?

• 1996: HIPAA enacted, allowing Congress three years to issue comprehensive health privacy legislation (noting if Congress failed to act, HHS would issue privacy regulations by rulemaking instead)

• 2002: HIPAA Privacy Rule published (after Congress failed to act), introducing the “patient rate,” a “reasonable, cost-based fee” limit for medical records, applying only to patient-made requests

• 2009: HITECH enacted, giving patients the ability to direct a copy of their electronic health record to a third party

• 2013: Omnibus Rule extended the third-party-directive to any format of records, not just electronic

• 2016: HHS Guidance added the “flat fee” option of $6.50, and clarified that this applies to patient-requested records and patient-directed records sent to third-parties

• 2018: CIOX sued, arguing HHS exceeded its authority

• 2020: CIOX Heath v. Azar decision issued, vacating the expansion of the “patient rate” to third parties, and reverting third-party requests to the maximum amount allowed by state statute

• 2021: 21st Century Cures Act added that no fees may be charged for electronic access of an individual’s electronic health information by the individual or a designated third-party (meaning portal access, NOT an electronic copy that is pulled and sent by the provider)

• Now: Lacking a more comprehensive federal plan, third-parties must rely on state statutes limiting fees that can be charged for medical records requests

What can be done?

1. Check out the updated list of the maximum each state allows for medical records charges, published in this Forum issue. Push back if you request records in a state and the provider (or copy service) tries to charge you more than the allowed amount.

2. Know that many of the states that have carve outs for Social Security disability cases have them because NOSSCR members have taken the initiative to lobby state legislators to change the state laws. Please reach out to NOSSCR if you would like to join this fight in your state.

3. Report instances of non-compliance with the state limits to HHS as “information blocking,” because that’s what they’re doing – blocking needed health information. 

4. Know that NOSSCR is hard at work behind the scenes advocating for full-scale reform (See these prior Forum articles on the many actions NOSSCR is taking).  

---

---