Copy Fees and Patients’ Rights to Obtain a Copy of Their Medical Records: From Law to Reality

Abstract

Patients have a legal right under HIPAA to a copy of their medical records. Personal life-long medical records rely on patients’ ability to exercise this right inexpensively and in a timely manner. We surveyed 73 hospitals across the US, with a geographic concentration around Boston, to determine their policies about fees for copying medical records and the expected time it takes to fulfill such requests. Fees range very widely, from $2-55 for short records of 15 pages to $15-585 for long ones of 500 pages. Times also range widely, from 1–30 days (or longer for off-site records). A few institutions provide records for free and even fewer make them accessible on-line. We argue that electronic records will help solve the problem of giving patients access to their own records, will do so inexpensively and in a format more likely to be useful than paper.

Introduction

Laws, regulations and evolving practice suggest that patients should get and keep copies of their own medical records. This can assure that records are available to new care providers when patients relocate, help educate the patient about his or her own medical conditions and possible therapies, and provide a backup in case institutions misplace records, fail to maintain them after they are no longer legally required to do so, or change identity so much that they can no longer be found.

We have argued elsewhere that patients should maintain their own copy of a life-long medical record¹ and have outlined policy and technical steps toward achieving this goal². In the ideal case, patients could make their records available to any of their care providers to make sure that each provider has the most comprehensive picture of the patient’s medical history. In return, providers would add new observations, diagnoses, test results, etc., to the patient’s records to make sure that they remain up to date.

A first step toward comprehensive life-long records, however, requires that patients be able to obtain copies of their existing records, wherever they are now held. Inspired by dismal anecdotal reports from a class assignment where many students found it extremely difficult in practice to get copies of their medical records, we undertook a study of just how hard it is to accomplish this task at typical U.S. hospitals and clinics.

This paper presents a brief summary of patients’ legal rights to a copy of their health records, reports on the costs and time delays imposed by seventy-three hospitals on patients who try to do so, discusses the implications for making the patient-controlled life-long record a reality, and concludes with an additional argument for electronic health records.

Law

The “Health Insurance Portability and Accountability Act” (HIPAA)³, Public Law 104–191, was signed into law on August 21, 1996. On the basis of its provisions, the Secretary of the Department of Health and Human Services (HHS) promulgated the “Standards for Privacy of Individually Identifiable Health Information” (the so-called “Privacy Rule”), which went into universal effect in April 2004. Because “protecting the confidentiality of health information is only a portion of the principle of health privacy” and “assuring patients access to their health information is the other part of the equation”⁴, among other important provisions, the Privacy Rule guarantees patients’ rights to access their medical records and to obtain a copy of them⁵, except in certain circumstances⁶, within thirty days from the date the request is received (sixty days if requested information is stored off-site⁷); this time can be extended by no more than thirty days⁸.

The HIPAA privacy regulation establishes a minimum federal floor for protecting privacy and providing access to medical records; therefore, State laws “more stringent” than the federal rule can be enacted or, if already enacted, will remain in effect⁹. With respect to patient privacy, a State law is more stringent when it provides individuals greater privacy protections; with respect to patient access, a State law is more stringent when it provides individuals greater access to medical records.

If patients request copies of their medical records as permitted by the Privacy Rule, they may be required to pay for the copies. The covered entity may impose reasonable, cost-based fees. The fee may include only the cost of copying (including supplies and labor) and postage, if the patient requests that the copy be mailed¹⁰. The fee may not include costs associated with searching for and retrieving the requested records. If the patient has agreed to receive a summary or explanation of his or her protected health information, the covered entity may also charge a fee for preparation of the summary or explanation.

Under many State laws enacted before the Privacy Rule, entities can charge individuals fees for copies of their medical records (usually the maximum fee is set by the law), but fees that are not cost-based may be contrary to the Privacy Rule.

However, the concept of “reasonable fee” is flexible: as is stated in Hardin County v. Valentine, “what might be a reasonable fee for copying one or two pages may be totally unreasonable when applied to a 500-page single record”¹¹. There do not appear to be many cases dealing with the issue of reasonable charges for reproduction costs of medical records – either before or after HIPAA – so we might conclude that the costs imposed by health care providers on patients are viewed as reasonable, but such assumption is probably incorrect. In fact, this may be due to the high cost of litigation compared to the relatively low cost of obtaining the medical records, even when the cost of obtaining such records is outrageous¹².

Reality

Methods

We selected seventy-three hospitals from twenty-five states as our sample. Thirty-three were chosen due to their “popularity”: they were designated by USNews.com as the best hospitals in the US in 2004 in various categories; among them, we chose all of the “top hospitals”¹³. We also included every hospital in the greater Boston area, except one that would not respond to repeated enquiries; they amount to twenty-nine facilities (nine of them were also listed by USNews) and they range from very little hospitals to highly specialized clinics and general hospitals. The other eleven hospitals were chosen to increase geographic diversity. We identified them via a simple “Google”¹⁴ search based on the name of each chosen city and the word “hospital”. Two additional hospitals that we approached were non-responsive to our requests for information and are not included in our sample.

Information was retrieved directly from hospitals, through their websites, e-mails, phone calls and direct contact. Because all of the information sought from the selected institutions is public and because no patient-specific information was sought, we did not request IRB review. We considered only the cost to obtain a copy of medical records printed on paper; copies of microfilms and x-rays are usually more expensive and they were not included because, as we will see, cost is already a serious issue even just looking at the cheaper paper records. We also did not consider copy fees set for attorneys and insurance companies, which are usually higher, and we note that records are usually released for free to physicians for the purpose of continuity of care. We focused only on records requested by patients on their own.

In addition, we calculated the costs of obtaining three hypothetical records, made up of 15, 50 and 500 pages, to make the data more comprehensible to the reader. A 15-page record might represent a very simple medical history, such as a single brief hospitalization. The 50-page record might represent a patient with several such simple episodes or one more major hospital encounter. The 500-page records might be typical of someone with repeated hospital encounters, perhaps because of multiple episodes of a chronic condition. Elderly and severely ill patients may in fact have much longer records, but we selected these three page-counts for comparison.

Results

Table 1 shows the data collected in the study. For each institution from which we were able to obtain data, we list the identity of the institution, the means by which we obtained the information, the copying charge (per page, for various ranges of numbers of pages), any additional administrative fee, and the reported typical times it takes to get the record. The Table also identifies the type of institution and the number of beds as an indication of size. Finally, it includes calculated costs for obtaining records of 15, 50 and 500 pages from each institution.

Table 1.

Legend: (1) Source: W=web; E=email; P=phone; DC=direct contact. (2) In dollars. Unless otherwise indicated, cost is per page. (3) F=flat; NFF=no fixed fee (4) A=abstract; M=microfilm (5) Administrative fee, in dollars. (6) In days. BD=business days; F=off-site information; M=maximum; NFT=no fixed time; O=on-site information; U=usually. (7) C=children's general; CO=children's other specialty; G=general medical and surgical; O=other specialty; P=psychiatric (8) Approximate values (cents are not considered). Sample records: 15 pages; 50 pages; 500 pages. (9) 4 hospitals, 24 clinics.

Name, city, state	Cost per page(1)(2)(3)(4)	Fee(5)	Time(6)	Type(7)	Beds	Sample Prices (8)
St. Vincent's Hospital, Birmingham, AL	(E) 1-25: 1; 26>: 0.50; M 1-25: 1.50; M 26>: 1		2 U	G	338	15	37	262
El Dorado Hospital, Tucson, AZ	(P) 0.50	20	5 U	G	166	27	45	270
Children's Hospital, Los Angeles, CA	(P) 0.25		15 U	C	286	3	12	125
Good Samaritan Hospital, Los Angeles, CA	(P) 0.25	20	10 BD	G	408	23	32	145
USC University Hospital, Los Angeles, CA	(E) 1-500: 0.20; 501>:0.10		1-5 U 15M	O	269	3	10	100
UCSF Medical Center, San Francisco, CA	(W) 1-100: 0.25;101>:0.15		15	G	546	3	12	85
California Pacific Medical Center, San Francisco, CA	(E) 0.25		5–15	G	1279	3	12	125
UCLA Medical Center, Los Angeles, CA	(P) (E) 0.25		15 U	G	592	3	12	125
Stanford Hospital and Clinics, Stanford, CA	(P) 0.25	15	15	G	433	18	27	140
University of Colorado Hospital, Denver, CO	(E)1-10: 0; 11-40:0.50; 41-100:0.33; 101>:0.15		10–12 U	G	368	2	18	94
Memorial Hospital, Colorado Springs, CO	(E) 1-40: 0.50; 41>: 0.33		5 BD	G	477	7	23	171
Bristol Hospital, Bristol, CT	(E) Hosp. records: 0.65; Physician off. records:0.45		30 M	G	134	9	32	325
Hartford Hospital, Hartford, CT	(E) 0.32		10–20 U	G	867	4	16	160
UF&Shands Jacksonville, Jacksonville, FL	(E) 1			G	733	15	50	500
Jackson Memorial Hospital, Miami, FL	(E) 1			G	1838	15	50	500
Saint Joseph's Hospital, Atlanta, GA	(P) 0.85		3–5 BD U	G	346	12	42	425
Shriners Hospital of Honolulu, Honolulu, HI	(E) 1-20: 20 F; 21>: 0.50		21 U	CO	40	20	35	260
Eastern Idaho Regional Medical Ctr., Idaho Falls, ID	(P) 1-50: 0; 51>: 0.35		NFT	G	341	0	0	157
The University of Chicago Hospitals, Chicago, IL	(W) 1-25: 0.78; 26-50: 0.52; 51>: 0.26; M: 1.30		15–30	G	579	11	32	149
St. John's Hospital, Springfield, IL	(E) 1-25: 0.81; 26-50: 0.54; 51>: 0.27		15 U	G	700	12	33	155
Columbus Regional Hospital, Columbus, IN	(P) 0		1 U	G	325	0	0	0
Arbour Hospital, Jamaica Plain, MA	(P) 0.15	15	10 BD	P	118	17	22	90
Arbour-HRI Hospital, Brookline, MA	(P) NFF		NFT	P	68
Beth Israel Deaconess Medical Center, Boston, MA	(P) 1-100: 0.50;101>: 0.25		21 U	G	532	7	25	150
Boston Medical Center, Boston, MA	(P) 0.15		7	G	547	2	7	75
Brigham and Women's Hospital, Boston, MA	(P) 0.48		10–15 BD	G	725	7	24	240
Cambridge Hospital, Cambridge, MA	(P) 1-100: 0.50;101>: 0.25		7–10 BD	G	182	7	25	150
Caritas Carney Hospital, Dorchester, MA	(P) 1-100: 0.50; 101>: 0.25		7 U	G	197	7	25	150
Caritas St. Elizabeth's Medical Center, Boston, MA	(P) 1-100: 0.50; 101>: 0.25		7–14 U	G	400	7	25	150
Dana-Farber Cancer Institute, Boston, MA	(W) 0		5–7 BD	O	27	0	0	0
Faulkner Hospital, Boston, MA	(P) 0.25	15	30 M	G	150	18	27	140
Franciscan Hospital for Children, Boston, MA	(P) 0 (1st copy)		7–14 U 30 M	CO	100	0	0	0
Jewish Memorial Hosp. and Rehab. Ctr., Boston, MA	(P) 0.15	12	30 M	O	207	14	19	87
Lahey Clinic, Burlington, MA	(W) 0.50	15		G	267	22	40	265
Lawrence Memorial Hosp. of Medford, Medford, MA	(P) 1-100: 0.50; 101>: 0.25	5	7–10 U 14 M	G	134	12	30	180
Lemuel Shattuck Hospital, Jamaica Plain, MA	(P) 0.25	6	NFT	P	278	9	18	131
Lowell General Hospital, Lowell, MA	(P) 0.55		5–7 BD	G	200	8	27	275
Massachusetts Eye and Ear Infirmary, Boston, MA	(W) 1: 12; 2>: 0.50		30 45 M	O	45	19	36	261
Massachusetts General Hospital, Boston, MA	(P) 1-100: 0.50; 101>: 0.25		30 M	G	893	7	25	150
McLean Hospital, Belmont, MA	(E) 1-100: 0.50; 101>: 0.25	15	30 M	P	167	22	40	165
Mount Auburn Hospital, Cambridge, MA	(W) 1-100: 0.50; 101>: 0.25	15	30M O 60M F	G	183	22	40	165
New England Baptist Hospital, Boston, MA	(P) 1-100: 0.50; 101>: 0.25		30 M	O	161	7	25	150
Newton-Wellesley Hospital, Newton, MA	(P) 1-100: 0.55;101>: 0.25		7–10 BD	G	236	8	27	155
Quincy Medical Center, Quincy, MA	(W) 1-100: 0.55; 101>: 0.25		7–10 BD	G	282	8	27	155
Shriners Hospital of Springfield, Springfield, MA	(E) 1-10: 10 F; 11>: 0.50		21 U	CO	40	12	30	255
Somerville Hospital, Somerville, MA	(DC)1-100: 0.55;101>: 0.25		7–10 BD	G	122	8	27	155
Spaulding Rehabilitation Hosp., Boston, MA	(W) 1-100: 0.50; 101>: 0.25		7 U	O	296	7	25	150
Tufts-New England Medical Center, Boston, MA	(P) 1-100: 0.50; 101>: 0.25		30M O 60M F	G	451	7	25	150
Winchester Hospital, Winchester, MA	(P) 0.50	13		G	200	20	38	263
Youville Hospital and Rehab. Ctr., Cambridge, MA	(P) 1-100: 0.50; 101>: 0.25	13	10–14 U	G	246	20	38	163
Union Memorial Hospital, Baltimore, MD	(P) 0.63		10–21	G	327	9	31	315
Johns Hopkins Medicine, Baltimore, MD	(P) (E) 0.63		14–21 U	G	900	9	31	315
University of Michigan Medical Ctr., Ann Arbor, MI	(W) 1-30:0; 31-50:1.00; 51-80:0.50; 81>:0.20		7 BD U	G	755	0	20	119
Abbott Northwestern Hospital, Minneapolis, MN	(P) 1.07		7–10 U	G	627	16	53	535
Mayo Clinic, Rochester, MN	(P) 1.05		30	G	797	15	52	525
North Kansas City Hospital, North Kansas City, MO	(P) 0.40 (M: 1.50)	17.05	5–10 BD	G	351	23	37	217
Children's Mercy, Kansas City, MO	(W) 0.38	16.33	30	C	241	22	35	206
Barnes-Jewish Hospital, Saint Louis, MO	(W) 0.40 (M: 1.50)		30 M	G	904	6	20	200
St. Peter's Hospital, Helena, MT	(P) 0.50		10	G	99	7	25	250
Duke University Medical Center, Durham, NC	(W) 1-20: 10 F; 21>: 0.50		5 U - 30 M	G	746	10	25	250
Hospital for Special Surgery, New York, NY	(W) 0.75		30M O 60M F	O	134	11	37	375
The Mount Sinai Hospital, New York, NY	(W) 0.75		30M O 60M F	G	914	11	37	375
New York-Presbyterian Hospital, New York, NY	(E) 0.75		10 BD	G	2146	11	37	375
The Cleveland Clinic, Cleveland, OH	(P) 1-10: 1.02; 11-50: 0.51; 51>: 0.20	15	7–14 BD	G	1045	27	45	135
Deaconess Hospital, Oklahoma City, OK	(E) 1: 1.00; 2>: 0.50		5	G	313	8	25	251
Temple University Hospital, Philadelphia, PA	(P) 1.17		7–10 BD	G	601	17	58	585
Hospital of the University of PA, Philadelphia, PA	(P) 1-20: 1.75; 21-60: 0.88; 61>: 0.30		15 BD	G	633	26	61	207
Shriners Hospital of Houston, Houston, TX	(E) 15 F		21 U	CO	40	15	15	15
The Methodist Hospital, Houston, TX	(E) 55.64 F			G	938	55	55	55
Overlake Hospital Medical Center, Bellevue, WA	(P)1-30: 0.88; 31>: 0.67		14 U	G	337	13	39	341
University of Washington Medical Ctr., Seattle, WA	(P) 1-50: 0.88; 51>: 0.67		15 BD	G	386	13	44	345
Columbia St. Mary Milwaukee, WI	(E) 0			G	(9)	0	0	0

Only a very few institutions charge a flat fee for a complete medical record, irrespective of length. If we exclude those four hospitals that give one copy of a patient’s record for free, the ranges of fees for records of 15, 50 and 500 pages are summarized here:

Discussion

The results of the study are limited by the small sample size, which may not be fully representative of all American hospitals. However, the data show how wide and variable is the concept of “reasonable fee” in practice, not only across the entire US, but also inside a limited area like the greater Boston area, in which only two hospitals give a copy of their medical records for free to their outpatients, whereas others charge as much as hundreds of dollars. Clearly, these fees range from a relatively minor annoyance to a serious financial impediment to patients obtaining their own records.

Note that most of these prices do not exceed the maximum copy fees permitted by applicable state laws. In fact hospitals tend to set the copy fees at or near the fee limits determined by state laws.

From the legal viewpoint, our data show that even state laws can be unreasonable and set prices that are not cost-based. For example, consider the maximum charges allowed by Minnesota law for 2005: $1.10 per page plus $14.41 for time spent retrieving and copying the records¹⁵. In an environment in which commercial copy businesses typically charge less than $0.10 per page while managing to earn a profit from their activity, the fee provisions of the Minnesota law appear not to comply with the Privacy Rule. The allowed per page fee exceeds reasonable costs, and the additional fee for retrieving and copying the records includes a portion for retrieval that is specifically prohibited by the Privacy Rule. By contrast, California law limits copying fees to $0.25 per page¹⁶, and California institutions report consistently among the lowest copying fees. If State-prescribed fee limits are too high, they fail to protect patients’ rights.

In addition, laws and regulations that allow excessive fees can also impede modernization and improved efficiency of operation of hospital functions such as releasing health records. If laws forbade the costs of inefficiency to be passed on to patients, such a restriction could provide incentives to the institution to become more efficient and possibly more profitable¹⁷.

One source of possible increased efficiency might be to provide copies of the medical record in electronic rather than paper form. For institutions where a large fraction of the record is already in electronic form, this approach should be quite attractive. Nevertheless, nearly all institutions assume that a copy of the records must be on paper and that the cost of providing such a copy must be page-related.

The Privacy Rule, in fact, allows “access to the protected health information” to be provided “in the form or format requested by the individual, if it is readily producible in such form or format.” So, if access can be provided in electronic format, if that format is requested by an individual, and if the institution agrees to provide the data in that format, then the patient should be allowed to receive it by paying only a small, cost-based fee. However, HIPAA covered entities may not be forced to release copies of medical records in an electronic format. It is interesting to see that Barnes-Jewish Hospital maintains records in digital format on CD, but patients can not request an electronic copy of their medical records even if these are already stored in that format¹⁸. Only the University of Chicago Hospitals release some information on electronic media (multiple x-rays on one CD for $20). It is also interesting to see that only Beth Israel Deaconess Hospital gives its patients complete and free on-line access to their medical records (“PatientSite”¹⁹), but it charges them for hard copies. The Cleveland Clinic also offers a similar service (“MyChart”), but access is limited to “portions” of medical records, though it is possible to look on-line at test results²⁰.

We were also concerned about the time needed to obtain a copy of medical records. As we have seen, HIPAA gives covered entities up to ninety days from the date the request is received if information is stored in an off-site facility. Table 1 shows the reported time usually needed by the hospitals of this study to release copies of medical records. As is the case with fees, there are enormous variations in reported times, from a minimum of one day to a maximum of sixty days for information stored off-site.

Conclusion

As we have seen, obtaining a copy of his or her medical records can be a long and expensive process for a patient. In addition, the typical restriction, that a patient may get only paper copies of records, flies in the face of nascent popular views that “the hard copy medical record is increasingly a dinosaur in health care delivery contexts”²¹. In addition, as populations age, we can expect that there will be more and more long medical records, and as individuals live longer and more active lives, we can expect each individual medical record to grow in length. Each of these factors argues for innovative ways to provide patients their medical records, among which electronic health records would hold many important benefits.

The desirability and advantages of electronic health records have been argued for a long time²². They include legibility, speed and ease of accessibility, permanence, simplicity of encryption and authentication, standardization, etc., some of which have been achieved in practice whereas others await demonstration. From our study of the difficulties patients face in getting a copy of their medical records, we derive another argument in favor of electronic records. Were they to be electronic, institutions could fulfill their HIPAA requirements for patient access easily, at very low cost, and with virtually no delay. We expect that everyone would benefit.

Table 2.

The four hospitals that give records for free are not included in the table because it would always drop the lowest end of the range to 0.

Pages	Boston	Western	Central	Eastern	National
15	$2-22	$2-27	$6-55	$0-27	$0-55
50	$7-40	$10-45	$15-55	$7-61	$7-61
500	$75-275	$85-345	$15-535	$75-585	$15-585