CHA News Article

New HIPAA Guidance Clarifies Patients’ Rights to Their Health Information

The U.S. Department of Health and Human Services, Office for Civil Rights (OCR) has released FAQs addressing fees that may be charged to patients for copies of their health information, and patients’ rights to have information sent directly to a third party (for example, to another health care provider, a family member, researchers, or a personal health record or mobile health app).

OCR notes that HIPAA regulations permit a health care provider to charge a reasonable, cost-based fee for patients to receive (or to be sent directly to a third party) a copy of their health information. However, the fee may include only certain labor, supply and postage costs. The FAQs provide detailed information about how to calculate this fee based on actual costs, average costs or a flat fee not to exceed $6.50 for electronic information. California providers are reminded that state law also caps the fee at no more than 25 cents per page for paper copies or 50 cents per page for copies from microfilm. This fee structure does not apply to attorneys requesting records from the health care provider.

Interestingly, OCR opines that health care providers should give patients copies of their health information for free, stating that:

while the Privacy Rule permits the limited fee described above, covered entities should provide individuals who request access to their information with copies of their PHI free of charge.  While covered entities should forgo fees for all individuals, not charging fees for access is particularly vital in cases where the financial situation of an individual requesting access would make it difficult or impossible for the individual to afford the fee. Providing individuals with access to their health information is a necessary component of delivering and paying for health care. We will continue to monitor whether the fees that are being charged to individuals are creating barriers to this access, will take enforcement action where necessary, and will reassess as necessary the provisions in the Privacy Rule that permit these fees to be charged.

CHA urges hospitals to read the FAQs at and make sure their policies are compliant with the requirements. Additional information about state and federal health information privacy and breach laws may be found in CHA’s California Health Information Privacy Manual.