Skip to Content
Search Site Menu

HPS Legal Alert: A Primer on Your Client’s Legal Rights to Access Health Information

By Richard L. Allen, Jr.

Injury attorneys are aware of the challenges that often arise when attempting to obtain a client’s medical records. Regardless of the type of “injury” that we are discussing, it is vital for the attorney to obtain a complete set of records relating to the client’s injuries and treatment. However, other attorneys, be it business, tax, probate, or other practices, sometimes need to obtain medical records to assist in the representation of their client. Those attorneys who are not accustomed to the battles that accompany the efforts to obtain medical records are often shocked by the expense of the records, the delay in obtaining the records, and the fact that sometimes health care professionals just ignore the request for records. What all attorneys should know is that federal legislation has been enacted that is designed to assist patients in obtaining their records. The purpose of this article is to briefly discuss the laws that assist attorneys in obtaining records for a reasonable cost in a reasonable time frame.

Health Insurance Portability and Accountability Act (HIPAA)

Most people are aware of HIPAA and that it is a federal law that requires the creation of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge. HIPAA also provides that “Except as otherwise provided…an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set for as long as the protected health information is maintained in the designated record set…”  HIPAA goes on to say that the healthcare provider must provide the individual with access to the medical information “in the form and format requested by the individual…” This last part is important because if you don’t specify the format, the records might be provided to you in such a way that they are nearly impossible to read. HIPAA has privacy and security requirements governing the use of not only paper records but importantly also applies to electronic recording of individually identifiable health information. In his January 20, 2004, State of the Union Address, President George W. Bush stated, “By computerizing health records, we can avoid dangerous medical mistakes, reduce costs and improve care.” This push to computerize health records was enhanced by President Bush signing two Executive Orders which required the Department of Health and Human Services (HHS) to help advance efforts to achieve the goal. The first order directed the Secretary of HHS to establish a position of a national health information technology coordinator and the second order permitted the expansion of health information technology to the private and public sector.

Health Information Technology for Economic and Clinical Health Act (the HITECH Act)

President Obama continued President Bush’s health records initiative by signing the HITECH Act into law. The HITECH Act amended the Social Security Act to authorize incentive payments to eligible healthcare providers for the adoption of meaningful use of electronic health records. The HITECH Act provided billions of dollars in incentives for clinicians and hospitals for the meaningful use of health information technology. The HITECH Act established a goal of utilization of electronic health records for each person in the United States by 2014. The HITECH Act also provided for a right to obtain electronic versions of the medical record, the right to direct a copy to another individual, and the right to limit the fee to the labor cost involved in providing the electronic record. This last right is particularly important since the HITECH Act limits the provider to the actual cost to provide the electronic record. The HITECH Act provides that the charge of $6.50 is an alternative to calculating the actual cost of providing the record, and so despite the number of pages in the record, most hospitals and healthcare professionals will provide the records for a cost of $6.50. The records must be provided in thirty days plus a thirty-day extension. It also includes MRIs, CT scans, and other films in the definition of the right to access. The right to access requires that when a patient sends to a healthcare provider a written request, signed by the individual patient, identifying a person designated to receive the healthcare information and identify where to send it, then the right to limit the fee as discussed applies. Note that at the present, the request must come directly from the patient.

21st Century Cures Act

Seema Verma, the Administrator for the Centers of Medicare & Medicaid Services, stated in 2019, “At the end of the day it’s all the patient’s data. If it affects and touches their medical record, then that belongs to them.”  Despite the position of CMS, HIPAA and HITECH, the protected right of access was often hindered by the practices of those in control of the patient’s personal health information. Because of this, in late 2016 the Cures Act was signed into law. Blocking access to patient healthcare information was so prevalent that the Cures Act defined “information blocking” as any practice that “is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information.” If a patient’s guaranteed right of access is blocked as defined in the Cures Act, then the healthcare provider is violating HIPAA, and the Cures Act provides that the abuse should be reported to the Health and Human Services Office of Civil Rights (OCR). OCR can enforce a patient’s rights to access health information. If the abuse is reported to OCR, that should lead to an investigation. The penalties provided for in the Act may be up to $1,000,000.00 per violation (which will be paid to the government, not the patient). 

Key Takeaways

These three federal laws together can help assure that patients can access their healthcare information and are invaluable for attorneys who are trying to assist their clients when obtaining their healthcare records. If you are dealing with a case where obtaining medical records are involved and would like to discuss your options, please contact Rick Allen, or any other member of our Haliczer Pettis & Schwamm legal team.