Federal law requires that you provide your patients with “adequate access” to their medical records based on a specific set of criteria. Fail to comply, and you could be hit with significant violation penalties. Information blocking rule.
The problem is that these rules are confusing and implementing them correctly can be a challenge This post can help. Below you’ll find a breakdown on the related medical records “adequate access” rules, along with several tactics to help you more easily comply.
What Law Defines “Adequate Access?” Information blocking rule.
Patient records access is governed by HIPAA and, in subsequent years, has been more clearly defined by the 21st Century Cures Act.
The right of access rule under HIPAA – 45 CFR § 164.524 – gives patients the right to inspect and obtain copies of their protected health information (PHI) from providers. This requires you to allow patients to view copies of their medical records in a manner of the patient’s choosing, and to give the patient that access no later than 30 days after your office receives the request.
The 21st Century Cures Act (“Cures Act”), although signed into law several years ago, has only just recently gone into effect. The Cures Act was designed to help accelerate medical product development, bringing new innovations and advances to patients more quickly and efficiently. Part of the Act designates the Office of the National Coordinator for Health Information Technology (ONC) to utilize electronic health records to improve patient care.
The ONC subsequently adopted a Final Rule aimed to “support seamless and secure access, exchange, and use of electronic health information.” This new information blocking rule changed the way you responded to requests for patient records. So, if you haven’t changed your process to comply with this new rule, your practice is at risk of being audited and paying substantial violation penalties.
What Is “Adequate Access?”
The ONC’s Final Rule included a provision that requires that you provide patients with electronic access to their electronic health information (EHI) at no additional cost. Information blocking provisions also are outlined, giving the conditions under which denying a patient access to records is allowable.
So, what does it mean to provide “adequate access” to patient records? Providing “adequate access” doesn’t automatically mean you have to turn over any and all records when patients request them, but it is important you know specifically when you can refuse access.
If you receive a patient request for paper copies of their health records, for example, you must provide a paper copy of those records if the request otherwise follows the law. You can charge a reasonable fee to cover the costs of reproducing those records, such as for labor for copying the records or supplies to create a paper copy. However, you cannot charge a flat fee to give out copies of records without showing they are cost-based and necessary.
Records requests must be fulfilled within 30 days of you receiving them, but extensions are allowed in case you need additional time to provide adequate access, such as retrieving records from storage.
Note: Many states have specific laws related to what you can charge for supplying medical records and how quickly you must turnaround request. Be sure to confirm your state law before charging anything.
Why Should You Care About “Adequate Access” Rules?
Ensuring that your practice follows this information blocking rule is the best way to avoid potentially hefty fines for compliance violations (even innocent ones). Usually, violations are identified after an audit that was driven by a patient complaint.
At the most basic level, you should have a plan in place for responding to records requests in order to comply with the HIPAA regulations and the information blocking rule. However, giving your patients the information they seek in a timely manner is simply another way your practice can provide exceptional service to your patients.
If you have a patient that requests a copy of their records and you give them access within a few days of that request, your patient walks away feeling as if your practice cares about their needs and works hard to provide great service even when you’re not completing a money-making task.
Failing to properly fulfill a records request could open your practice up to fines and penalties from the Office for Civil Rights at the U.S. Department of Health and Human Services. From Sept. 9, 2019 to Sept. 10, 2021, the OCR settled 20 investigations regarding the HIPAA Right of Access Initiative, many of which targeted physician practices.
Here are a few of the related OCR cases that were settled:
- A Florida-based primary care and interventional pain management practice was fined $85,000 in December 2019 for not sending a patient’s records when requested.
- A Colorado psychiatry practice was fined $10,000 for not providing a father with a copy of his minor son’s medical records.
- A New York pain and neurology provider was fined $100,000 for not supplying a patient with access to her x-ray, MRI, or CT scan images.
Avoid Violating Information Blocking Rules
Following all the ins and outs of correctly providing adequate access to patient medical records can be frustrating, but there are some key provisions to keep in mind that can help.
There are eight types of clinical notes that you are required make available. These include:
-
- Consultation notes
- Discharge summary notes
- History and physical
- Imaging narratives
- Laboratory report narratives
- Pathology report narratives
- Procedure notes
- Progress notes
The above notes should be provided to a patient or their personal representatives within 30 days of receiving their request. This does not, however, mean you should wait until day 29 or 30 to fulfill a request. It is important that provide requested records to your patients as quickly as possible, and that you do so within the 30-day timeframe.
Along with knowing what information you are required to provide, it is just as important for you to know when you can deny requests. The items below are not covered under the Right to Access rule and don’t require you make them available:
- Information that’s not used to make decisions about the individual
- Psychotherapy notes separated from the rest of a patient’s records, such as those recorded during personal therapy sessions
- Information that’s being compiled in reasonable anticipation of or for use in a civil, criminal, or administrative action or court proceeding
To learn more about the information blocking rule, adequate access, and other matters related to patient access to medical records, check out Healthcare Training Leader’s online training, Stop Cures Act and Patient Access Fines, led by Joseph Lazzaretto, Esq., CIPP.
 |
Subscribe to Healthcare Practice Advisor |
| Get actionable advice to help improve your practice’s reimbursement, compliance, and success in this weekly eNewsletter. |
|
|
|