By: Delaney M. Finderson, J.D. Candidate
Spring 2024
Several concerns exist about the pursuit of equitable access to essential records in the United States, particularly for individuals with disabilities. The existing framework contains federal and state protections, but there are still barriers to accessibility and affordability for all. The law covering Social Security Disability or Supplemental Income is ruled federally. It does not consider the full breadth of cost for those trying to apply for or continue their benefits. The law covering accommodations under the Americans with Disabilities Act has a federal basis but elaborately intertwines with state law regarding accessing medical records and paying for them. This paper will focus on Indiana and federal laws and how the existing barriers can be potentially lifted or relieved on a state and nationwide scale. To approach the medical records retrieval process as “one size fits all” could not be more negative when viewed from an individual with a disability’s lens.
I.HIPAA, 21st Century Cures, and HITECH: Oh My! Records Access and theirGuarantees
Federal law covers records access for the country of the United States and makes several promises as part of this coverage. However, the landscape of this area of law has some constants and fluctuations because of advocacy on both behalf of providers and behalf of patients. The heavy-hitter is HIPAA or the Health Insurance Portability and Accountability Act of 1996. HIPAA is a wide umbrella covering more than just records access, and it includes a variety of patient rights and protections through records access. Besides just accessing patient records when requested by the patient, there is also: the patient’s right to decide who gets to see your medical records, the right to decide when others get to see those medical records, the records must be delivered within a specific timeframe, and providers have a specific duty to safeguard and protect those records from unauthorized view or access.
1 The timeline under HIPAA is thirty days unless reasonable cause is demonstrated on the provider side. In that case, an additional thirty days extension can be granted.2
However, there are exceptions to these rights under HIPAA. Providers can provide access to patient records without authorization to the patient’s health insurance, for some disability benefits (like the Occupational Safety and Health Administration (OSHA) for workplace accidents), in situations of shared medical care for specific conditions with other providers, in response to subpoenas, and when a patient has authorized or designated a third party to be provided access.3 A provider can also withhold particular parts of the medical record, such as psychotherapy notes and information related to a pending criminal or civil action.4
HIPAA has been around for almost thirty years now, and it has stayed the same for the majority of that time. New laws like the 21st Century Cures Act and the Health Information Technology for Economic and Clinical Health Act (HITECH) have brought different factors into play for consideration by both providers and patients. HITECH was first signed into law in 2009, and its main goal was to encourage and promote the adoption of health information technology (like electronic health records, or EHR) while strengthening the privacy and security protections of HIPAA.5 The 21st Century Cures Act was signed into law in 2016 but launched in effect in 2022.
6 This particular Act’s goal in the realm of records was for interoperability between various EHRs across the country, and requiring the provider to give records to patients in an electronic format.7 The heavy-hitter of the 21st Century Cures Act was the digitalization push for EHRs, making sure that they are readable by humans when provided. But the biggest impact of the HITECH Act on patient-side was the limitation of cost for providing records; while HIPAA states that providers can charge “reasonable” fees based upon the amount of work involved in retrieving the records, HITECH described a flat rate cap, or “patient rate” for $6.50 in charges. However, this distinguishment for “patient rate” was not clear if it extended to third parties requesting records on behalf of patients. Almost immediately, litigation ensued because many providers were using third-party medical retrieval companies to handle the volume of requests, and they were losing profits.
II.The Bottom Line: Costs for Retrieving Patient Health Information
Patient Health Information, or PHI, belongs to the patient, as defined by HIPAA. However, medical providers are allowed to “a reasonable, cost-based fee, provided that the fee includes only the cost of: (i) Copying, including the cost of supplies for and labor of copying, the protected health information requested by the individual; (ii) Postage, when the individual has requested the copy, or the summary or explanation, be mailed; and (iii) Preparing an explanation or summary of the protected health information, if agreed to by the individual.”8 The flat rate from HITECH, which was mentioned above, made many believe that charging more than $6.50 for digital record retrieval is illegal, especially following the 21st Century Cures Act. Following the 2016 discussion and signing into law, the “patient rate” was available to all under new rules by the US Department of Health and Human Services (HHS). The ensuing argument and litigation led to Ciox Health, LLC v. Azar, which was ruled final in January 2020. Ciox Health, LLC, is one of the largest record retrieval companies in the United States and is used by many healthcare providers across the nation to respond to PHI requests. Ciox challenged the HHS expansions of the “patient rate,” which would and had caused a massive loss in revenue by providing third parties the right to only pay the “patient rate.”9 After hearing the arguments and reviewing HIPAA and 45 CFR 164.524, the court found that (1) the 2013 rule from HHS, which mandated the transfer of Protected Health Information (PHI) to third parties regardless of format, exceeded the boundaries set by Congress and was arbitrary and capricious; (2)the broadening of the “patient rate” in 2016 constituted a legislative rule by HHS that shouldhave undergone notice and comment according to the Administrative Procedures Act; and (3) the 2016 clarification by HHS regarding which labor costs could be recuperated under the “patient rate” was considered an interpretative rule, exempt from the notice and comment requirement.10
Before this case was finalized, HHS also put forward a new advisory opinion on PHI charges. “$6.50 is not the maximum amount that can be charged for all individual requests for a copy of PHI under the right of access. Rather, charging a flat fee not to exceed $6.50 is an option available to those entities that do not want to go through the process of calculating the actual or average costs for requests for electronic copies of PHI maintained electronically as permitted by the Privacy Rule,” stated the HHS.11 Because of this new opinion and the Ciox v. Azar ruling, the
“patient rate” is not accessible by third parties, and has led to exponential increases in charges for PHI retrieval. Some states have stepped in to institute their laws about PHI charges, but that can only apply to requests that occur within the state, otherwise, HIPAA and federal law following Ciox v. Azar and HHS rules apply. Indiana follows the federal requirements for costs of PHI retrieval, and will allow “patient rate” for the patient’s self-requests, but also does not extend that to third parties.12 The Office of Civil Rights has expressed that “while the Privacy Rule [HIPAA] permits the limited fee described above, covered entities should provide individuals who request access to their information with copies of their PHI free of charge.”13 Unfortunately, a majority of providers have decided against this path or they have already employed retrieval companies to charge and handle their EHRs and PHI requests. III. Navigating the Maze of Barriers to AccessKnowing that the trend and the law surrounding PHI and record access is complicated, digital, and costs money, try tackling this issue with a disability. The Americans with Disabilities Act and Section 504 of the Rehabilitation Act prohibit discrimination on the basis of disability, but this does not stop inequity and inequality.14 The framework of the realm of medical records strongly favors someone who knows and understands their legal rights, and the proper requesting process, and does not have any barriers to finding the necessary information.
If a patient does not know their legal rights regarding their PHI, they can have several difficulties with requesting copies of their PHI. Overcharging, abuse of the timeliness requirement, failure to provide the PHI digitally, or denial of provision of PHI are all possible. For many, this information is not taught or explained in a provider’s office and often appears as a lengthy form with small print that patients are required to sign their acknowledgment of before any treatment. For an individual with a disability, this can mean that there is no acknowledgment because they are unaware of their rights as a patient. For example, if they have an intellectual disability or they have a visual or reading comprehension disability, then this form provides no notice or assistance at all. Next, the requesting process is different for every single healthcare provider. While there is a standard electronic health records system, there is no legal requirement for the same requesting process across the board. This means that every time a different provider’s PHI is needed, the patient has to re-learn the way to send a request. These issues are only general; for every individual patient, there are specific barriers they run into throughout the mazes that have been created to obtain their medical records.
Firstly, the requirement for the production of medical records is standardly digital after the 21st Century Cures Act.15 A majority of healthcare providers’ websites are not accessible to those with disabilities. A large healthcare umbrella in northeast Indiana, Parkview Health, does offer a variety of ways to request PHI, but their website is mostly in green type on a white background, which can be difficult for an individual with colorblindness. The website does not have a screenreading option, although it is translateable with Speechify, a text-to-speech reading extension on Google Chrome.
16 Parkview allows their patient portal, MyChart, to have patients request their records digitally. If an individual cannot use the portal, then the next option is to mail or fax a request.17 The amount of options to get records access is helpful, but the provision of those records is going to be in a digital form on a CD, by email, flash drive, or by paper copy. If an individual cannot use or work the digital format the provider offers, then the “patient rate” no longer applies and the patient can be charged a per-page copying fee. This is a double-pronged issue: if an individual with a disability cannot use the digital formatting, then they have to pay higher rates to access the same PHI than another person without a disability. Digital and paper formatting is a necessary choice for individuals with disabilities, but the healthcare provider may not even offer a choice. Further, it is intertwined with the affordability of the individual’s medical records. This highlights another key issue with the costs of a complicated system: obtaining PHI for disability benefits can be costly and difficult for individuals with disabilities.
When an individual with a disability is applying for Social Security Disability (SSD), Supplemental Income (SSDI), or accommodations in the workplace, school, or housing, the individual is expected to provide the records to substantiate the claim. In any of the above situations, they require timely, accurate, and adequate medical records. This means the records must be within the prior six months, detailed, and consistent in diagnosis and recommendations, all while being thorough to establish a disability as a matter of medical certainty.18 Because of this,an individual with a disability would likelyneed to request extensive portions of their PHIfrom multiple providers, often.Even with a “patient rate” this can be costly.Individuals withdisabilities whoutilizea personto assist them with theirrequests are especially challengedbecause they often cannot receive a “patient rate” when third parties are making the request.This includespersonal representatives,family members, caregivers, attorneys, or guardians.19
TheSocial Security Administration(SSA)does have support involvement with EHRs,called the Electronic Records Express, or ERE.20This allows the individual to upload theirelectronic medical records directly into a unique file for their application, or they can choose tofax the electronic records to the SSA for them to then insert intothe file.Use of the EREis free,which can help ease the cost burden on applicantsbecause it eliminates the need for postage ortransportation to an office site.21However, the federal law,SSA, andhealthcare providersare notrequired to help in affording the cost of obtaining the records in the first place.Unfortunately, toagain make a double-edged sword, most individuals applying for SSD orSSDIare unemployed or unable to work.Thismeansindividuals with noincome are required to pay money they do nothave toget the assistance and money they need.There are some stateside supports, like Nevada,that protect their citizens with disabilities by not allowing PHI charges at all when the records arerequested as part ofthe application or appeal.22California offers similar programsupport, where every person is allowed onefree copy oftheirPHIwhen applying or appealing for a state or federal disability assistance program.
23 One of the big medical retrieval companies, Sharecare (a direct competitor of Ciox Health, LLC from the case discussed above) offers an exception to their retrieval charges. If the third party or patient provides a copy of representation paperwork or the initial application form for SSD or SSDI, they will waive any charges in full. Yet, most companies, healthcare providers, and states do not have program assistance or options for individuals with disabilities.
IV.Remove the Maze or, at least, Provide a Map
There are a multitude of ways to improve the medical records system to not only make it less complicated and affordable, but accessible for individuals with disabilities. There is an argument that because of the level of difficulty in the current system, it could constitute information-blocking under the 21st Century Cures Act. The Cures Act “defines information blocking as business, technical, and organizational practices that prevent or materially discourage the access, exchange, or use of EHI when an actor knows, or (for some actors like electronic health record vendors) should know, that these practices are likely to interfere with access, exchange, or use of EHI.”24 After reviewing every challenge presented by the record retrieval process, it is clear that the practices unique to this area are harmful and can cause a disparate impact on individuals with disabilities. Beyond just this argument, tangible solutions are needed.
On a federal level, instituting a requirement under HIPAA, HITECH, and the 21st Century Cures Act that all providers establish the same requesting process to make it easier to navigate. Next, creating a carve-out in the law for healthcare providers to provide copies in digital and paper format at the same cost for individuals with disabilities. These would help make the requesting process understandable while making it more equitable across the board for those with disability barriers and those without.
On a statewide level, offering program assistance like waivers of record costs for those with disabilities, specialty rates for third parties as low as the “patient rate,” or prohibiting charges for PHI retrievals in its entirety are all possible solutions. These options help make the cost of PHI equal for each individual’s situation.
These suggested modifications to the United States’s current medical record retrieval process are not exhaustive, nor are they perfect in their application. However, taking some or all of the recommendations will help alleviate the pressure and unequal harm on individuals with disabilities, alongside the benefit of making the system more streamlined, navigable, and affordable. Rather than facing a maze of confusion and barriers, the law can create a ramp with some signage that shows the exact path to equity in patient health information and access. Ensuring equitable access to medical records not only upholds the fundamental principles of inclusivity and equal opportunity but also embodies the ethos of “one for all, and all for one,” fostering a society where every individual can actively participate and lead empowered lives.
ENDNOTES
1 Individuals’ right under HIPAA to access their health information 45 CFR § 164.524.
2 (OCR), O. for C. R. (2021, June 28). How timely must a covered entity be in responding to individuals’ requests for access to their PHI? US Department of Health and Human Services. https://www.hhs.gov/hipaa/for-professionals/faq/2050/how-timely-must-a-covered-entity-be/index.html
3 Robert, T. (2024, March 24). HOW HIPAA gives you the right to see your medical records. Verywell Health. https://www.verywellhealth.com/your-rights-to-your-medical-records-under-hipaa-1719157
4 Individuals’ right under HIPAA to access their health information 45 CFR § 164.524.
5 Alder, S. (2023, December 1). What is the Hitech Act? 2024 update. The HIPAA Journal. https://www.hipaajournal.com/what-is-the-hitech-act/
6 Robert, T. (2024, March 24). HOW HIPAA gives you the right to see your medical records. Verywell Health. https://www.verywellhealth.com/your-rights-to-your-medical-records-under-hipaa-1719157
7 Lengyel-Gomez, B. (2020, October 29). 21st Century cures act-A Summary. HIMSS. https://www.himss.org/resources/21st-century-cures-act-summary
8 Individuals’ right under HIPAA to access their health information 45 CFR § 164.524.
9 Ciox Health, LLC v. Azar, 435 F. Supp. 3d 30, 38 (D.D.C. 2020)
10 Id.
11 (OCR), O. for C. R. (2021b, June 28). New clarification – $6.50 flat rate option is not a cap on fees. US Department of Health and Human Services. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/clarification-flat-rate-copy-fee/index.html
12 IN.gov. (2021, December 14). Privacy and Security of Health Records. Indiana Medicaid for Providers. https://www.in.gov/medicaid/providers/business-transactions/health-insurance-portability-and-accountability-act-hipaa/privacy-and-security-of-health-records/
13 Lazzarotti, J. J. (2021, July 22). Information blocking and HIPAA’s right to access: Compliance burdens for healthcare providers. Jackson Lewis. https://www.jacksonlewis.com/insights/information-blocking-and-hipaas-right-access-compliance-burdens-healthcare-providers
14 ADA.gov. (1990). The Americans with Disabilities Act. Americans with Disabilities – US Department of Justice Civil Rights Division. https://www.ada.gov/
15 Lengyel-Gomez, B. (2020, October 29). 21st Century cures act-A Summary. HIMSS. https://www.himss.org/resources/21st-century-cures-act-summary
16 Google. (n.d.). Speechify text to speech voice reader. Google. https://chromewebstore.google.com/detail/speechify-text-to-speech/ljflmlehinmoeknoonhibbjpldiijjmm?hl=en-US&utm_source=ext_sidebar
17 Parkview.com. (n.d.). Access Medical Records. Parkview Health. https://www.parkview.com/patients-and-visitors/medical-records-information/access-medical-records
18 Morgan & Morgan. (n.d.). Social Security Disability Medical Records Request. Disability Care Center. https://www.disabilitycarecenter.org/medical-qualifications/medical-documentation/
19 Rubin Law. (2017, October 30). HIPAA and Adults with Special Needs. Rubin Law – Blog. https://www.rubinlaw.com/blog/hipaa-and-adults-with-special-needs/
20 SSA.gov. (n.d.). Social Security: Electronic Records Express. Social Security Administration . https://www.ssa.gov/ere/
21 Id.
22 How free medical records help you win disability benefits. Cannon Disability Law. (2024, January 30). https://cannondisability.com/blog/how-to-get-free-medical-records-to-win-your-social-security-disability-benefits/
23 How free medical records help you win disability benefits. Cannon Disability Law. (2024, January 30). https://cannondisability.com/blog/how-to-get-free-medical-records-to-win-your-social-security-disability-benefits/
24 Lazzarotti, J. J. (2021, July 22). Information blocking and HIPAA’s right to access: Compliance burdens for healthcare providers. Jackson Lewis. https://www.jacksonlewis.com/insights/information-blocking-and-hipaas-right-access-compliance-burdens-healthcare-providers
744 E Till Rd, Suite 102
